jdaugherty opened a new pull request, #437: URL: https://github.com/apache/grails-intellij-plugin/pull/437
Ports grails-core's `validateActions` check so every `uses:` entry in `.github/workflows` is checked against the ASF approved-actions policy ([apache/infrastructure-actions](https://github.com/apache/infrastructure-actions)). ## Policy - `actions/*`, `github/*` and `apache/*` are auto-approved; local `./` actions and `docker://` images are skipped. - Anything else must be allowed at any version (`@*`) or pinned to a full SHA on `approved_patterns.yml`. - A trailing `# vX.Y.Z` comment that is missing or disagrees with the tag ASF recorded in `actions.yml` gives a warning only. ## Changes - `ValidateActionsTask` (build-logic helper class) and the `org.apache.grails.intellij.build.validate-actions` convention plugin, applied at the root. Like grails-core, it is not hooked into `check` because it fetches the list from ASF. - New `validate-actions.yml` workflow: runs on pushes to `main` and on PRs that touch workflows or the task, plus weekly (Mon 06:00 UTC) to catch a pinned SHA being delisted. Actions are SHA-pinned and the JDK is read from `.sdkmanrc`, matching the existing workflows. - `AGENTS.md` (Quick Reference + Critical Rule 12) and `build-logic/README.md` updated. ## Differences from grails-core - The two ASF list URLs are task properties (defaulting to ASF), so the task can be tested offline. - `docker://` references are skipped before the `@` split. grails-core reports a digest-pinned image (`docker://img@sha256:…`) as an unapproved action. - Tests added (grails-core has none): 10 Gradle TestKit tests on the plugin's JUnit 4 + AssertJ stack, with the configuration cache on. Because build-logic is an included build, the root `check` now depends on `:build-logic:check`, so these tests and `validatePlugins` run in the regular CI build. ## Verification - `./gradlew validateActions`: all 8 workflow files compliant, no warnings. - `./gradlew :build-logic:check`: 10/10 tests pass. Restoring grails-core's original `docker://` ordering makes `compliantWorkflowsPass` fail. - `./gradlew rat` passes; `./gradlew check --dry-run` shows `:build-logic:test` and `:build-logic:validatePlugins` in the graph. - The plugin test suite was not re-run locally; no plugin code changed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
