jamesfredley commented on code in PR #16025:
URL: https://github.com/apache/grails-core/pull/16025#discussion_r3677406935
##########
.github/workflows/release.yml:
##########
@@ -247,7 +247,7 @@ jobs:
# downstream checksum/artifact-list combination steps all expect the
# default JDK 21 toolchain. Also keeps any future steps that touch the
# repository's own (non-Micronaut) Gradle config on the documented JDK.
- uses: actions/setup-java@v4
+ uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #
v5.2.0
Review Comment:
Reverted to `actions/setup-java@v4`, which is also what it was before this
PR. See the related thread on the major-version crossing: reverting fixes that
too, since `@v4` restores the exact pre-PR resolution behavior for both
reproducibility pins.
`RepositoryConventionsTask` now exempts the `actions` namespace, so the gate
agrees with the policy.
##########
.github/workflows/release.yml:
##########
@@ -224,7 +224,7 @@ jobs:
# staged from a JDK 25 runner. This is a NEW reproducibility pin -
# keep $JAVA_VERSION_MICRONAUT synced with the secondary JDK in
# etc/bin/Dockerfile so verifiers can reproduce the resulting JARs.
- uses: actions/setup-java@v4
+ uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #
v5.2.0
Review Comment:
Reverted to `actions/setup-java@v4`, restoring the pre-PR behavior for this
reproducibility pin. Details in the related thread you opened about the v4 to
v5 major-version crossing.
##########
.github/workflows/release.yml:
##########
@@ -87,7 +87,7 @@ jobs:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source
cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle
commercial Terms of Use)
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
- name: "⚙️ Run pre-release"
Review Comment:
Agreed, reverted. All `apache/grails-github-actions/*` references are back
to `@asf`, and `RepositoryConventionsTask` now exempts the `apache` owner
namespace from the SHA rule, so the gate no longer encodes the opposite of this
decision. A reference with an empty ref is still a violation, but any version
or branch ref is accepted.
##########
.github/workflows/release-publish-docs.yml:
##########
@@ -74,7 +74,7 @@ jobs:
# The docs themselves have no code dependency on Micronaut.
run: ./gradlew grails-doc:build -PgithubBranch=${TARGET_BRANCH}
- name: "🚀 Publish to GitHub Pages"
- uses: apache/grails-github-actions/deploy-github-pages@asf
+ uses:
apache/grails-github-actions/deploy-github-pages@fe90f651c47c5230cdd70b6fee0e0d250fea30ac
# asf
Review Comment:
Agreed, reverted. All `apache/grails-github-actions/*` references are back
to `@asf`, and `RepositoryConventionsTask` now exempts the `apache` owner
namespace from the SHA rule, so the gate no longer encodes the opposite of this
decision. A reference with an empty ref is still a violation, but any version
or branch ref is accepted.
##########
.github/workflows/release-close.yml:
##########
@@ -45,7 +45,7 @@ jobs:
ref: ${{ env.TAG }}
token: ${{ secrets.GITHUB_TOKEN }}
- name: "⚙️ Run post-release"
- uses: apache/grails-github-actions/post-release@asf
+ uses:
apache/grails-github-actions/post-release@fe90f651c47c5230cdd70b6fee0e0d250fea30ac
# asf
Review Comment:
Agreed, reverted. All `apache/grails-github-actions/*` references are back
to `@asf`, and `RepositoryConventionsTask` now exempts the `apache` owner
namespace from the SHA rule, so the gate no longer encodes the opposite of this
decision. A reference with an empty ref is still a violation, but any version
or branch ref is accepted.
##########
.github/workflows/groovy-joint-workflow.yml:
##########
@@ -105,7 +105,7 @@ jobs:
runs-on: ubuntu-latest
services:
mongodb:
- image: mongo:8
+ image:
mongo@sha256:951c2ff9fc6bdb6cb89b1dfea4a0e8ae3ee4fb287c0bf579b2bba54c7803f75d #
mongo:8
Review Comment:
Thanks, keeping this one. Dependabot is not currently configured to propose
these updates. Rather than add that here and widen this PR further, I would
rather do it as its own change so the config and its noise profile can be
reviewed on its own merits. Happy to open an issue for it if you want it
tracked.
The digest is the multi-arch manifest-list digest, as you verified, so it
resolves correctly on every runner architecture.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
