[jira] [Created] (RATIS-2756) Pin first-party actions to a major version tag

["Attila Doroszlai (Jira)" <ji...@apache.org>]

Attila Doroszlai created RATIS-2756:
---------------------------------------

             Summary: Pin first-party actions to a major version tag
                 Key: RATIS-2756
                 URL: https://issues.apache.org/jira/browse/RATIS-2756
             Project: Ratis
          Issue Type: Improvement
          Components: CI
            Reporter: Attila Doroszlai
            Assignee: Attila Doroszlai


bq. The [GitHub Actions Policy|https://infra.apache.org/github-actions-policy.html] requires a specific git hash only for *external* actions; actions in the {{apache/\*}}, {{github/\*}} and {{actions/\*}} namespaces may be used without that restriction. Pinning those to a major version tag rather than to a hash lets a patch or minor release arrive without a pull request, which removes a large share of the Dependabot traffic a project sees. External actions still MUST be pinned to a specific git hash. ([source|https://github.com/apache/infrastructure-website/blob/7eb7ab31a698f51796554aaebeeabd97b22577ee/content/pages/services.md?plain=1#L183])

Pinning to major version also avoids the [bug|https://github.com/dependabot/dependabot-core/issues/15453] that dependabot creates separate pull requests for bumping subactions.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)