jamesfredley commented on code in PR #16025:
URL: https://github.com/apache/grails-core/pull/16025#discussion_r3677921288
##########
gradle/rat-root-config.gradle:
##########
@@ -20,6 +20,9 @@ apply plugin: 'org.nosphere.apache.rat'
tasks.named('rat') {
def allExcludes = [
'.asf.yaml', // ASF metadata for github integration excluded from
src zip
+ '.omo/**', // local agent work state excluded from src zip
+ '.claude/**', '.clinerules', '.cursorrules', '.windsurfrules', //
local agent configuration excluded from src zip
Review Comment:
Addressed in `7a0aceb5ff`. Local agent state (`.omo/`) and standard
worktrees (`.worktrees/`) are gitignored; agent guidance files remain tracked
symlinks so they ship with source for development.
##########
.github/workflows/vulnerability-scan.yml:
##########
@@ -36,9 +36,9 @@ jobs:
contents: read
steps:
- name: "📥 Checkout repository"
- uses: actions/checkout@v6
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/release.yml:
##########
@@ -690,7 +698,7 @@ jobs:
# Runs on the JDK 21 pin, where settings.gradle auto-prunes the
Micronaut island.
run: ./gradlew grails-doc:build -PgithubBranch=${TARGET_BRANCH}
- name: "🚀 Publish to GitHub Pages"
- uses: apache/grails-github-actions/deploy-github-pages@asf
+ uses:
apache/grails-github-actions/deploy-github-pages@fe90f651c47c5230cdd70b6fee0e0d250fea30ac
# asf
Review Comment:
Addressed in `7a0aceb5ff`. First-party `actions/*` and
`apache/grails-github-actions/*` are back on version/branch refs (no SHA pins).
`RepositoryConventionsTask` exempts those namespaces from the 40-hex rule.
##########
.github/workflows/release.yml:
##########
@@ -765,7 +773,7 @@ jobs:
ref: ${{ env.TAG }}
token: ${{ secrets.GITHUB_TOKEN }}
- name: "⚙️ Run post-release"
- uses: apache/grails-github-actions/post-release@asf
+ uses:
apache/grails-github-actions/post-release@fe90f651c47c5230cdd70b6fee0e0d250fea30ac
# asf
Review Comment:
Addressed in `7a0aceb5ff`. First-party `actions/*` and
`apache/grails-github-actions/*` are back on version/branch refs (no SHA pins).
`RepositoryConventionsTask` exempts those namespaces from the 40-hex rule.
##########
.github/workflows/release.yml:
##########
@@ -373,11 +374,18 @@ jobs:
find . -depth \( -type f -o -type d \) -exec touch -d
"@${SOURCE_DATE_EPOCH}" {} +
- name: "📦 Create source distribution ZIP"
run: >
- zip -r
+ zip -yr
${DIST_NAME}-${VERSION}-src.zip
grails
-x 'grails/.git/*'
-x 'grails/.github/*'
+ -x 'grails/.omo/*'
Review Comment:
Addressed in `7a0aceb5ff`. Local agent state (`.omo/`) and standard
worktrees (`.worktrees/`) are gitignored; agent guidance files remain tracked
symlinks so they ship with source for development.
##########
.github/workflows/release.yml:
##########
@@ -373,11 +374,18 @@ jobs:
find . -depth \( -type f -o -type d \) -exec touch -d
"@${SOURCE_DATE_EPOCH}" {} +
- name: "📦 Create source distribution ZIP"
run: >
- zip -r
+ zip -yr
${DIST_NAME}-${VERSION}-src.zip
grails
-x 'grails/.git/*'
-x 'grails/.github/*'
+ -x 'grails/.omo/*'
+ -x 'grails/.claude/*'
+ -x 'grails/.clinerules'
+ -x 'grails/.cursorrules'
+ -x 'grails/.windsurfrules'
+ -x 'grails/CLAUDE.md'
Review Comment:
Addressed in `7a0aceb5ff`. `CLAUDE.md` (and the other tracked agent guidance
symlinks) ship in the source zip again; RAT still skips them because they
cannot carry a license header as symlinks.
##########
.github/workflows/release.yml:
##########
@@ -247,7 +247,7 @@ jobs:
# downstream checksum/artifact-list combination steps all expect the
# default JDK 21 toolchain. Also keeps any future steps that touch the
# repository's own (non-Micronaut) Gradle config on the documented JDK.
- uses: actions/setup-java@v4
+ uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #
v5.2.0
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/release.yml:
##########
@@ -224,7 +224,7 @@ jobs:
# staged from a JDK 25 runner. This is a NEW reproducibility pin -
# keep $JAVA_VERSION_MICRONAUT synced with the secondary JDK in
# etc/bin/Dockerfile so verifiers can reproduce the resulting JARs.
- uses: actions/setup-java@v4
+ uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #
v5.2.0
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/release.yml:
##########
@@ -87,7 +87,7 @@ jobs:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source
cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle
commercial Terms of Use)
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
- name: "⚙️ Run pre-release"
Review Comment:
Addressed in `7a0aceb5ff`. First-party `actions/*` and
`apache/grails-github-actions/*` are back on version/branch refs (no SHA pins).
`RepositoryConventionsTask` exempts those namespaces from the 40-hex rule.
##########
.github/workflows/release-publish-docs.yml:
##########
@@ -74,7 +74,7 @@ jobs:
# The docs themselves have no code dependency on Micronaut.
run: ./gradlew grails-doc:build -PgithubBranch=${TARGET_BRANCH}
- name: "🚀 Publish to GitHub Pages"
- uses: apache/grails-github-actions/deploy-github-pages@asf
+ uses:
apache/grails-github-actions/deploy-github-pages@fe90f651c47c5230cdd70b6fee0e0d250fea30ac
# asf
Review Comment:
Addressed in `7a0aceb5ff`. First-party `actions/*` and
`apache/grails-github-actions/*` are back on version/branch refs (no SHA pins).
`RepositoryConventionsTask` exempts those namespaces from the 40-hex rule.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
