dongjoon-hyun opened a new pull request, #977: URL: https://github.com/apache/spark-kubernetes-operator/pull/977
### What changes were proposed in this pull request? This PR aims to update the following GitHub Actions to their latest approved versions before the current SHAs expire, and to pin `medyagh/setup-minikube` to a commit SHA instead of a tag. | Action | Before | After | |---|---|---| | `gradle/actions/setup-gradle` | v6.3.0 (`9c971963bec38e04b3d30dcc455b5382be2fdbfb`), expires on 2026-12-26 | [v6.4.0](https://github.com/gradle/actions/releases/tag/v6.4.0) (2026-09-28) (`3f5f9adaf7d9fecd50b5935e54106014257a94e6`) | | `burnett01/rsync-deployments` | 9.0.1 (`155b6d6c1219ab2224c20c58d423a3f1b850395f`), expires on 2027-01-09 | [9.0.2](https://github.com/Burnett01/rsync-deployments/releases/tag/9.0.2) (2026-10-14) (`2cbb5ed94b73d111d07a40b071b1c7d3c0272435`) | | `medyagh/setup-minikube` | `v0.0.21` (tag) | [v0.0.21](https://github.com/medyagh/setup-minikube/releases/tag/v0.0.21) (2025-12-14) (`e9e035a86bbc3caea26a450bd4dbf9d0c453682e`) | All SHAs are checked against [actions.yml](https://github.com/apache/infrastructure-actions/blob/039fd349d6281381d4e7856b4e48fc4cf41c6be3/actions.yml) of `apache/infrastructure-actions` at `039fd34` (2026-10-21). - [`gradle/actions/setup-gradle`](https://github.com/apache/infrastructure-actions/blob/039fd349d6281381d4e7856b4e48fc4cf41c6be3/actions.yml#L530-L543): The new SHA is the current approved version without `expires_at`. It is the commit of the annotated `v6.4.0` tag. - [`burnett01/rsync-deployments`](https://github.com/apache/infrastructure-actions/blob/039fd349d6281381d4e7856b4e48fc4cf41c6be3/actions.yml#L159-L167): The new SHA is the current approved version without `expires_at`. - [`medyagh/setup-minikube`](https://github.com/apache/infrastructure-actions/blob/039fd349d6281381d4e7856b4e48fc4cf41c6be3/actions.yml#L811-L813): It is approved with a wildcard (`'*'` with `keep: true`), so the tag reference is accepted. However, the [ASF GitHub Actions Policy](https://infra.apache.org/github-actions-policy.html) says "You MUST pin all external actions to the specific git hash (SHA1)". The new SHA is the commit of the `v0.0.21` tag, which is still the latest release, so the action code is unchanged. - The `docker/*` actions are already pinned to the latest approved SHAs without `expires_at`. The `actions/*` and `apache/*` actions are not subject to the approved list and are already at their latest versions. ### Why are the changes needed? The daily `remove_expired` job of `apache/infrastructure-actions` removes SHAs from the approved list once their `expires_at` dates pass. After that, the CI jobs using the old SHAs will fail because the actions are no longer allowed. There is no breaking change for this repository. - `setup-gradle` v6.4.0 only adds a new `external` option to `cache-provider` in `action.yml`, so `cache-provider: basic` still works. The new Gradle signing key in the release notes does not matter here because `gradle/verification-metadata.xml` does not verify signatures and the dependency graph is not enabled. - `rsync-deployments` 9.0.2 only updates its Docker image to Alpine 3.24.2 and rsync 3.5.1. `action.yml` is unchanged, so the inputs used by `publish_snapshot_chart.yml` are unchanged. ### Does this PR introduce _any_ user-facing change? No. This only changes CI workflows. ### How was this patch tested? - Checked that all workflow files are parsed by `yq`, and that every `uses:` outside `actions/*`, `github/*`, and `apache/*` is pinned to a 40-character SHA in [approved_patterns.yml](https://github.com/apache/infrastructure-actions/blob/039fd349d6281381d4e7856b4e48fc4cf41c6be3/approved_patterns.yml). - Checked the new SHAs against the upstream tags with `git ls-remote`. - Pass the CIs. `publish_snapshot_chart.yml` runs only by schedule or `workflow_dispatch`, so `rsync-deployments` 9.0.2 will be exercised by the next nightly snapshot chart publishing. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Opus 5.5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
