Copilot commented on code in PR #13796:
URL: https://github.com/apache/trafficserver/pull/13796#discussion_r4189229227
##########
.github/workflows/cifuzz.yml:
##########
@@ -11,26 +11,26 @@ jobs:
steps:
- name: Build Fuzzers
id: build
- uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+ uses:
google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@8f634126459ac994f47076ee3ba0be6b348d75e2
with:
oss-fuzz-project-name: 'trafficserver'
language: c++
- name: Run Fuzzers
- uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+ uses:
google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@8f634126459ac994f47076ee3ba0be6b348d75e2
with:
oss-fuzz-project-name: 'trafficserver'
language: c++
fuzz-seconds: 300
output-sarif: true
- name: Upload Crash
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v7
Review Comment:
`v7` is a movable major-version tag, so this action is still not locked to a
known revision as the PR description claims. Pin the tag's current commit (and
let Dependabot update it) to make CIFuzz runs reproducible and avoid executing
later tag retargets implicitly.
This issue also appears on line 33 of the same file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
