ppkarwasz opened a new pull request, #407: URL: https://github.com/apache/logging-log4j-samples/pull/407
This PR reduces the maintenance burden of our GitHub Actions workflows: - **Pin `actions/*` to major version tags** instead of SHAs. First-party actions are trusted, and major tags remove the need for frequent pin-bump PRs. Dependabot now ignores minor and patch updates for `actions/*` (with a 7-day cooldown), while third-party actions remain pinned by hash and receive all updates. - **Replace `graalvm/setup-graalvm` with `actions/setup-java`** using the `graalvm` distribution. - **Replace `gradle/actions/setup-gradle` with the `cache: gradle` option** of `actions/setup-java`. Note: this also removes the Develocity build scan injection. - **Replace the manual Android emulator setup with `ReactiveCircus/android-emulator-runner`** (now allow-listed in the ASF organization), pinned by hash. This drops about 60 lines of `sdkmanager`/`avdmanager`/`adb` scripting; the action manages the AVD lifecycle, boot waiting, and teardown itself. The `Enable KVM` step is kept, as the action still requires it on GitHub-hosted runners. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
