You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by sb...@apache.org on 2026/09/03 16:24:08 UTC
(grails-core) branch ci/asf-approved-action-pins created (now ecb4a4d31e)
This is an automated email from the ASF dual-hosted git repository.
sbglasius pushed a change to branch ci/asf-approved-action-pins
in repository https://gitbox.apache.org/repos/asf/grails-core.git
at ecb4a4d31e ci: pin every action to an ASF-approved SHA
This branch includes the following new commits:
new ecb4a4d31e ci: pin every action to an ASF-approved SHA
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(grails-core) 01/01: ci: pin every action to an ASF-approved SHA
Posted by sb...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
sbglasius pushed a commit to branch ci/asf-approved-action-pins
in repository https://gitbox.apache.org/repos/asf/grails-core.git
commit ecb4a4d31effc8a6e718992d995f4a35097a7590
Author: Søren Berg Glasius <so...@glasius.dk>
AuthorDate: Thu Sep 3 18:23:50 2026 +0200
ci: pin every action to an ASF-approved SHA
`gradle/actions/setup-gradle@50e97c2` (v6.1.0) is not on the ASF
allowlist, so every workflow that used it — CI, Code Style, End to End,
Coverage, RAT, Vulnerability Scan, the Groovy canary and the release
workflows — failed at startup before any job ran:
The action gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e
is not allowed in apache/grails-core because all actions must be
from a repository owned by your enterprise, created by GitHub, or
match one of the patterns: ...
Move it to `9c971963` (v6.3.0), the current approved entry with no
expiry date. v6.1.1 is also approved but expires 2026-09-05.
Also, so the same class of failure does not come back:
- `aws-actions/configure-aws-credentials` → v6.2.3 (`e6de0542`). The
v6.2.0 pin it replaces expires from the allowlist on 2026-09-20.
- SHA-pin the three floating `actions/*` refs left in
`vulnerability-scan.yml` and the twelve `actions/cache@v4` refs in
`gradle.yml`, matching the versions already used everywhere else in
the repo. These are allowed by namespace, so they were not breaking
anything, but CLAUDE.md asks for SHA pins for supply-chain
consistency.
`apache/grails-github-actions/*@asf` is left on the branch ref
deliberately — it is the ASF-owned, intentionally floating pin.
Approved SHAs verified against
https://github.com/apache/infrastructure-actions/blob/main/actions.yml
---
.github/workflows/codestyle.yml | 6 ++--
.github/workflows/forge-deploy-aws.yml | 4 +--
.github/workflows/gradle.yml | 54 ++++++++++++++---------------
.github/workflows/groovy-joint-workflow.yml | 4 +--
.github/workflows/rat.yml | 2 +-
.github/workflows/release-publish-docs.yml | 2 +-
.github/workflows/release-verify.yml | 2 +-
.github/workflows/release.yml | 6 ++--
.github/workflows/vulnerability-scan.yml | 14 ++++----
9 files changed, 47 insertions(+), 47 deletions(-)
diff --git a/.github/workflows/codestyle.yml b/.github/workflows/codestyle.yml
index a9961fb7b2..1cf5a0dad4 100644
--- a/.github/workflows/codestyle.yml
+++ b/.github/workflows/codestyle.yml
@@ -39,7 +39,7 @@ jobs:
distribution: liberica
java-version: 17
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -77,7 +77,7 @@ jobs:
distribution: liberica
java-version: 17
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -116,7 +116,7 @@ jobs:
distribution: liberica
java-version: 17
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
diff --git a/.github/workflows/forge-deploy-aws.yml b/.github/workflows/forge-deploy-aws.yml
index 8ad949cab3..8203d5c40f 100644
--- a/.github/workflows/forge-deploy-aws.yml
+++ b/.github/workflows/forge-deploy-aws.yml
@@ -80,7 +80,7 @@ jobs:
java-version: ${{ steps.jdk.outputs.version }}
- name: "Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-provider: basic
@@ -114,7 +114,7 @@ jobs:
run: ./gradlew grails-forge-web-netty:awsElasticBeanstalk
- name: "Configure AWS credentials through OIDC"
- uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+ uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ env.DEPLOY_ROLE_ARN }}
aws-region: us-east-1
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index fd01aa78d3..d75062de52 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -37,7 +37,7 @@ jobs:
distribution: liberica
java-version: 17
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -48,7 +48,7 @@ jobs:
restore-keys: |
gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
@@ -81,7 +81,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -92,7 +92,7 @@ jobs:
restore-keys: |
gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -145,7 +145,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -156,7 +156,7 @@ jobs:
restore-keys: |
gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -190,7 +190,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -201,7 +201,7 @@ jobs:
restore-keys: |
gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -233,7 +233,7 @@ jobs:
distribution: 'liberica'
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -244,7 +244,7 @@ jobs:
restore-keys: |
gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -303,7 +303,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -314,7 +314,7 @@ jobs:
restore-keys: |
gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -358,7 +358,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -396,7 +396,7 @@ jobs:
distribution: liberica
java-version: 17
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -431,7 +431,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -466,7 +466,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -477,7 +477,7 @@ jobs:
restore-keys: |
gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -511,7 +511,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -522,7 +522,7 @@ jobs:
restore-keys: |
gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -551,7 +551,7 @@ jobs:
distribution: liberica
java-version: 17
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -562,7 +562,7 @@ jobs:
restore-keys: |
gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -616,7 +616,7 @@ jobs:
distribution: liberica
java-version: 17
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -627,7 +627,7 @@ jobs:
restore-keys: |
gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -682,7 +682,7 @@ jobs:
distribution: liberica
java-version: 17
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -693,7 +693,7 @@ jobs:
restore-keys: |
gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -793,7 +793,7 @@ jobs:
distribution: liberica
java-version: 17
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -804,7 +804,7 @@ jobs:
restore-keys: |
gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
diff --git a/.github/workflows/groovy-joint-workflow.yml b/.github/workflows/groovy-joint-workflow.yml
index 7544dfa469..6cef1ee35b 100644
--- a/.github/workflows/groovy-joint-workflow.yml
+++ b/.github/workflows/groovy-joint-workflow.yml
@@ -58,7 +58,7 @@ jobs:
- name: "📥 Checkout Groovy 4_0_X (Grails 7 and later)"
run: git clone --depth 1 https://github.com/apache/groovy.git -b GROOVY_4_0_X --single-branch
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-disabled: true # this workflow rebuilds Groovy each run; a Gradle home cache is not useful here
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -161,7 +161,7 @@ jobs:
java-version: 17
distribution: liberica
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-disabled: true # this workflow rebuilds Groovy each run; a Gradle home cache is not useful here
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
diff --git a/.github/workflows/rat.yml b/.github/workflows/rat.yml
index f66e0b5ba5..d653be29a9 100644
--- a/.github/workflows/rat.yml
+++ b/.github/workflows/rat.yml
@@ -42,7 +42,7 @@ jobs:
distribution: liberica
java-version: 17
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
diff --git a/.github/workflows/release-publish-docs.yml b/.github/workflows/release-publish-docs.yml
index 32ac534603..727500c108 100644
--- a/.github/workflows/release-publish-docs.yml
+++ b/.github/workflows/release-publish-docs.yml
@@ -63,7 +63,7 @@ jobs:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
diff --git a/.github/workflows/release-verify.yml b/.github/workflows/release-verify.yml
index e2e7f5a172..cf78f5da28 100644
--- a/.github/workflows/release-verify.yml
+++ b/.github/workflows/release-verify.yml
@@ -72,7 +72,7 @@ jobs:
distribution: ${{ steps.sdkmanrc.outputs.java-distribution }}
java-version: ${{ steps.sdkmanrc.outputs.java-version }}
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
# verification must run against a pristine environment, never cached state
cache-disabled: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8b83aef0e2..f26edf24fc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -81,7 +81,7 @@ jobs:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -602,7 +602,7 @@ jobs:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -641,7 +641,7 @@ jobs:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
diff --git a/.github/workflows/vulnerability-scan.yml b/.github/workflows/vulnerability-scan.yml
index 7195dc86b8..dad6c6a8f9 100644
--- a/.github/workflows/vulnerability-scan.yml
+++ b/.github/workflows/vulnerability-scan.yml
@@ -44,14 +44,14 @@ jobs:
contents: read
steps:
- name: "📥 Checkout repository"
- uses: actions/checkout@v6
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "☕️ Setup JDK"
- uses: actions/setup-java@v4
+ uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: liberica
java-version: 17
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
- name: "🔍 Run OSS Index Vulnerability Scan"
@@ -83,14 +83,14 @@ jobs:
pull-requests: write
steps:
- name: "📥 Checkout pull request"
- uses: actions/checkout@v6
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "☕️ Setup JDK"
- uses: actions/setup-java@v4
+ uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: liberica
java-version: 17
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+ uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
with:
develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
- name: "🔍 Run OSS Index Vulnerability Scan"
@@ -137,7 +137,7 @@ jobs:
steps:
# Checks out the base branch, not the pull request; nothing from the fork is executed.
- name: "📥 Checkout base branch"
- uses: actions/checkout@v6
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "📋 Build Notice"
run: |
{