You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by jd...@apache.org on 2026/09/25 14:49:41 UTC
(grails-core) branch ci/unpin-first-party-actions-7.0.x updated (5782d68428 -> 06a0e998a2)
This is an automated email from the ASF dual-hosted git repository.
jdaugherty pushed a change to branch ci/unpin-first-party-actions-7.0.x
in repository https://gitbox.apache.org/repos/asf/grails-core.git
discard 5782d68428 Reference actions/* by major version instead of commit SHA
new 06a0e998a2 Reference actions/* by their latest release tag instead of commit SHA
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (5782d68428)
\
N -- N -- N refs/heads/ci/unpin-first-party-actions-7.0.x (06a0e998a2)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/workflows/codeql.yml | 4 +-
.github/workflows/codestyle.yml | 18 ++---
.github/workflows/forge-deploy-aws.yml | 4 +-
.github/workflows/gradle.yml | 110 ++++++++++++++--------------
.github/workflows/groovy-joint-workflow.yml | 12 +--
.github/workflows/rat.yml | 6 +-
.github/workflows/release-close.yml | 2 +-
.github/workflows/release-publish-docs.yml | 4 +-
.github/workflows/release-verify.yml | 4 +-
.github/workflows/release.yml | 20 ++---
.github/workflows/vulnerability-scan.yml | 10 +--
AGENTS.md | 4 +-
12 files changed, 99 insertions(+), 99 deletions(-)
(grails-core) 01/01: Reference actions/* by their latest release tag instead of commit SHA
Posted by jd...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jdaugherty pushed a commit to branch ci/unpin-first-party-actions-7.0.x
in repository https://gitbox.apache.org/repos/asf/grails-core.git
commit 06a0e998a2d73002a9d4d38368ceb1a10719e086
Author: James Daugherty <jd...@jdresources.net>
AuthorDate: Fri Sep 25 10:43:43 2026 -0400
Reference actions/* by their latest release tag instead of commit SHA
Align 7.0.x with the agreed GitHub Actions reference policy ahead of
the 8.0.x repository-conventions gate (#16025), which rejects commit
SHAs for the actions/* and apache/* namespaces. Without this, every
workflow change merged up from 7.0.x carries a SHA pin that fails the
gate on 8.0.x.
The ASF allows every version in the actions/* namespace, so each
reference moves to the full tag of that action's latest release:
- actions/checkout v6.0.2 -> v7.0.1
- actions/setup-java v5.2.0 -> v6.0.1
- actions/cache v4.3.0 -> v6.1.0
- actions/upload-artifact v7.0.1 (unchanged version)
- actions/download-artifact v8.0.1 (unchanged version)
Every input the workflows pass is still declared by the new versions.
The checkout v7 pull_request_target change does not apply: the only
such job checks out the base branch. Every job runs on GitHub-hosted
runners, which meet the Node 24 runtime requirement.
Third-party actions, including github/*, stay SHA-pinned to
ASF-approved commits. The AGENTS.md GitHub Actions rules are updated
to match.
---
.github/workflows/codeql.yml | 4 +-
.github/workflows/codestyle.yml | 18 ++---
.github/workflows/forge-deploy-aws.yml | 4 +-
.github/workflows/gradle.yml | 110 ++++++++++++++--------------
.github/workflows/groovy-joint-workflow.yml | 12 +--
.github/workflows/rat.yml | 6 +-
.github/workflows/release-close.yml | 2 +-
.github/workflows/release-publish-docs.yml | 4 +-
.github/workflows/release-verify.yml | 4 +-
.github/workflows/release.yml | 20 ++---
.github/workflows/vulnerability-scan.yml | 10 +--
AGENTS.md | 10 +--
12 files changed, 102 insertions(+), 102 deletions(-)
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 230fe7e8ea..bc1430f8c7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -56,9 +56,9 @@ jobs:
steps:
- name: Checkout repository
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
diff --git a/.github/workflows/codestyle.yml b/.github/workflows/codestyle.yml
index 1cf5a0dad4..772ad775f5 100644
--- a/.github/workflows/codestyle.yml
+++ b/.github/workflows/codestyle.yml
@@ -32,9 +32,9 @@ jobs:
- name: "🌐 Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
@@ -47,7 +47,7 @@ jobs:
run: ./gradlew codeStyle
- name: "📤 Upload Failure Reports"
if: always()
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: core-reports
path: build/reports/codestyle/
@@ -70,9 +70,9 @@ jobs:
- name: "🌐 Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
@@ -86,7 +86,7 @@ jobs:
run: ./gradlew codeStyle
- name: "📤 Upload Failure Reports"
if: always()
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: gradle-plugin-reports
path: grails-gradle/build/reports/codestyle/
@@ -109,9 +109,9 @@ jobs:
- name: "🌐 Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
@@ -125,7 +125,7 @@ jobs:
run: ./gradlew codeStyle
- name: "📤 Upload Failure Reports"
if: always()
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: forge-reports
path: grails-forge/build/reports/codestyle/
diff --git a/.github/workflows/forge-deploy-aws.yml b/.github/workflows/forge-deploy-aws.yml
index 8203d5c40f..558492427f 100644
--- a/.github/workflows/forge-deploy-aws.yml
+++ b/.github/workflows/forge-deploy-aws.yml
@@ -59,7 +59,7 @@ jobs:
SLOT: ${{ inputs.slot }}
steps:
- name: "Checkout"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "Read Java version"
id: jdk
@@ -74,7 +74,7 @@ jobs:
printf 'version=%s\n' "${java_version}" >> "${GITHUB_OUTPUT}"
- name: "Setup Corretto"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: corretto
java-version: ${{ steps.jdk.outputs.version }}
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index d75062de52..4ff56f432f 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -30,14 +30,14 @@ jobs:
runs-on: ubuntu-24.04
steps:
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ uses: actions/cache@v6.1.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -74,14 +74,14 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ uses: actions/cache@v6.1.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -138,14 +138,14 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ uses: actions/cache@v6.1.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -183,14 +183,14 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ uses: actions/cache@v6.1.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -226,14 +226,14 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: 'liberica'
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ uses: actions/cache@v6.1.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -278,7 +278,7 @@ jobs:
./tmp1/cli/bin/grails-forge-cli --version
- name: "📤 Upload CLI Zip to Workflow Summary Page"
if: ${{ matrix.java == '17' }}
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: 'apache-grails-SNAPSHOT-bin.zip'
include-hidden-files: true
@@ -296,14 +296,14 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ uses: actions/cache@v6.1.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -334,7 +334,7 @@ jobs:
-PskipRedisTests
- name: "📤 Upload Geb Reports"
if: failure()
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: geb-reports-functional-java${{ matrix.java }}
path: '**/build/geb-reports/'
@@ -351,9 +351,9 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: ${{ matrix.java }}
@@ -389,9 +389,9 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
@@ -424,9 +424,9 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: ${{ matrix.java }}
@@ -459,14 +459,14 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout the repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ uses: actions/cache@v6.1.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -504,14 +504,14 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout the repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ uses: actions/cache@v6.1.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -544,14 +544,14 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ uses: actions/cache@v6.1.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -580,12 +580,12 @@ jobs:
--no-build-cache
--rerun-tasks
- name: "📤 Upload grails-gradle checksums"
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: grails-gradle-checksums
path: grails-gradle/build/grails-gradle-checksums.txt
- name: "📤 Upload grails-gradle published artifacts"
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: grails-gradle-artifacts.txt
path: grails-gradle/build/grails-gradle-artifacts.txt
@@ -609,14 +609,14 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ uses: actions/cache@v6.1.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -646,12 +646,12 @@ jobs:
retry_wait_seconds: 180
command: ./gradlew publish aggregateChecksums aggregatePublishedArtifacts --no-build-cache --rerun-tasks
- name: "📤 Upload grails-core checksums"
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: grails-core-checksums.txt
path: build/grails-core-checksums.txt
- name: "📤 Upload grails-core published artifacts"
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: grails-core-artifacts.txt
path: build/grails-core-artifacts.txt
@@ -663,7 +663,7 @@ jobs:
unzip wrapper -d tmp
mv tmp/apache-grails-wrapper-* tmp/wrapper
- name: "📤 Upload Wrapper Zip to Workflow Summary Page"
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: apache-grails-wrapper-SNAPSHOT-bin
path: build/tmp/wrapper
@@ -675,14 +675,14 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ uses: actions/cache@v6.1.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -711,12 +711,12 @@ jobs:
--no-build-cache
--rerun-tasks
- name: "📤 Upload grails-forge checksums"
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: grails-forge-checksums
path: grails-forge/build/grails-forge-checksums.txt
- name: "📤 Upload grails-gradle published artifacts"
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: grails-forge-artifacts.txt
path: grails-forge/build/grails-forge-artifacts.txt
@@ -731,14 +731,14 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
- name: "📥 Download Wrapper"
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ uses: actions/download-artifact@v8.0.1
with:
name: apache-grails-wrapper-SNAPSHOT-bin
path: wrapper
@@ -774,7 +774,7 @@ jobs:
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout the repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
with:
fetch-tags: true
- name: "🔀 Store current branch name"
@@ -788,12 +788,12 @@ jobs:
echo "NOW=${NOW}" >> $GITHUB_ENV
echo "Current date: ${NOW}"
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ uses: actions/cache@v6.1.0
with:
# Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
# Keyed by branch version so each release branch maintains its own warm cache.
@@ -813,7 +813,7 @@ jobs:
./gradlew grails-doc:build
-PgithubBranch=${{ env.TARGET_BRANCH }}
- name: "📤 Upload Generated Docs to Workflow Result Page"
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: grails-docs-${{ env.NOW }}.zip
path: ./build/distributions/*.zip
diff --git a/.github/workflows/groovy-joint-workflow.yml b/.github/workflows/groovy-joint-workflow.yml
index 6cef1ee35b..6f07dcdca0 100644
--- a/.github/workflows/groovy-joint-workflow.yml
+++ b/.github/workflows/groovy-joint-workflow.yml
@@ -36,12 +36,12 @@ jobs:
groovyVersion: ${{ steps.groovy-version.outputs.value }}
steps:
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
java-version: 17
distribution: liberica
- name: "📥 Checkout Grails Core to fetch Gradle Plugin versions it uses"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
with:
sparse-checkout-cone-mode: false
sparse-checkout: settings.gradle
@@ -120,7 +120,7 @@ jobs:
cd groovy
./gradlew pTML -x groovydoc -x javadoc -x javadocAll -x groovydocAll -x asciidoc -x docGDK
- name: "📤 Share locally built Groovy artifacts with the build_grails job"
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: local-groovy-maven-repo
path: ~/.m2/repository/org/apache/groovy/
@@ -154,9 +154,9 @@ jobs:
df -h
- name: "📥 Checkout project"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
java-version: 17
distribution: liberica
@@ -168,7 +168,7 @@ jobs:
- name: "🔍 Setup TestLens"
uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2
- name: "📥 Fetch the locally built Groovy artifacts"
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ uses: actions/download-artifact@v8.0.1
with:
name: local-groovy-maven-repo
path: ~/.m2/repository/org/apache/groovy
diff --git a/.github/workflows/rat.yml b/.github/workflows/rat.yml
index d653be29a9..46e90f38a4 100644
--- a/.github/workflows/rat.yml
+++ b/.github/workflows/rat.yml
@@ -35,9 +35,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
@@ -52,7 +52,7 @@ jobs:
run: ./gradlew rat
- name: Upload RAT HTML report
if: always()
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ uses: actions/upload-artifact@v7.0.1
with:
name: rat-report
path: build/reports/rat/index.html
diff --git a/.github/workflows/release-close.yml b/.github/workflows/release-close.yml
index e8b6628668..f2818d7c27 100644
--- a/.github/workflows/release-close.yml
+++ b/.github/workflows/release-close.yml
@@ -40,7 +40,7 @@ jobs:
actions: write # in case there are pending changes to release.yml in the target branch
steps:
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
with:
ref: ${{ env.TAG }}
token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release-publish-docs.yml b/.github/workflows/release-publish-docs.yml
index 727500c108..807f239aac 100644
--- a/.github/workflows/release-publish-docs.yml
+++ b/.github/workflows/release-publish-docs.yml
@@ -49,7 +49,7 @@ jobs:
- name: "📝 Store release version"
run: echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
with:
fetch-depth: 0 # needed for docs release dropdown, (fetch-tags: true with fetch-depth: 1 does not work; https://github.com/actions/checkout/issues/1471)
filter: tree:0 # limit size, keeping tags for docs release dropdown
@@ -58,7 +58,7 @@ jobs:
- name: "📅 Ensure Common Build Date" # to ensure a reproducible build
run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
diff --git a/.github/workflows/release-verify.yml b/.github/workflows/release-verify.yml
index cf78f5da28..1ce2ee9f05 100644
--- a/.github/workflows/release-verify.yml
+++ b/.github/workflows/release-verify.yml
@@ -42,7 +42,7 @@ jobs:
# the source is checked out at 'project' and verification runs from a
# sibling 'grails-verify' scratch directory
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
with:
path: project
- name: "☕️ Determine Java version from .sdkmanrc"
@@ -67,7 +67,7 @@ jobs:
echo "java-version=${JAVA_VERSION}" >> "${GITHUB_OUTPUT}"
echo "java-distribution=${JAVA_DISTRIBUTION}" >> "${GITHUB_OUTPUT}"
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: ${{ steps.sdkmanrc.outputs.java-distribution }}
java-version: ${{ steps.sdkmanrc.outputs.java-version }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f26edf24fc..5ab271eef2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -59,7 +59,7 @@ jobs:
current_limit=$(gh api rate_limit --jq '.resources.graphql')
echo "Current Rate Limit: $current_limit"
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
with:
fetch-depth: 0 # needed for docs release dropdown, (fetch-tags: true with fetch-depth: 1 does not work; https://github.com/actions/checkout/issues/1471)
filter: tree:0 # limit size, keeping tags for docs release dropdown
@@ -76,7 +76,7 @@ jobs:
echo "${GPG_KEY}" | gpg --batch --import
gpg --list-keys
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
@@ -254,7 +254,7 @@ jobs:
current_limit=$(gh api rate_limit --jq '.resources.graphql')
echo "Current Rate Limit: $current_limit"
- name: "📥 Checkout Grails Core repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
with:
path: grails
ref: ${{ env.TAG }}
@@ -455,7 +455,7 @@ jobs:
tag_name: ${{ env.TAG }}
files: dev-repo/DIST_SVN_REVISION.txt
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
with:
path: ${{ env.REPO_NAME }}
ref: ${{ env.TAG }}
@@ -506,7 +506,7 @@ jobs:
current_limit=$(gh api rate_limit --jq '.resources.graphql')
echo "Current Rate Limit: $current_limit"
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
with:
ref: ${{ env.TAG }}
- name: "🛠️️ Install tools"
@@ -588,7 +588,7 @@ jobs:
df -h
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
with:
fetch-depth: 0 # needed for docs release dropdown, (fetch-tags: true with fetch-depth: 1 does not work; https://github.com/actions/checkout/issues/1471)
filter: tree:0 # limit size, keeping tags for docs release dropdown
@@ -597,7 +597,7 @@ jobs:
- name: "📅 Ensure Common Build Date" # to ensure a reproducible build
run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
@@ -632,11 +632,11 @@ jobs:
current_limit=$(gh api rate_limit --jq '.resources.graphql')
echo "Current Rate Limit: $current_limit"
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
with:
ref: ${{ env.TAG }}
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
@@ -679,7 +679,7 @@ jobs:
current_limit=$(gh api rate_limit --jq '.resources.graphql')
echo "Current Rate Limit: $current_limit"
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
with:
ref: ${{ env.TAG }}
token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/vulnerability-scan.yml b/.github/workflows/vulnerability-scan.yml
index dad6c6a8f9..b5a715a283 100644
--- a/.github/workflows/vulnerability-scan.yml
+++ b/.github/workflows/vulnerability-scan.yml
@@ -44,9 +44,9 @@ jobs:
contents: read
steps:
- name: "📥 Checkout repository"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
@@ -83,9 +83,9 @@ jobs:
pull-requests: write
steps:
- name: "📥 Checkout pull request"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "☕️ Setup JDK"
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@v6.0.1
with:
distribution: liberica
java-version: 17
@@ -137,7 +137,7 @@ jobs:
steps:
# Checks out the base branch, not the pull request; nothing from the fork is executed.
- name: "📥 Checkout base branch"
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@v7.0.1
- name: "📋 Build Notice"
run: |
{
diff --git a/AGENTS.md b/AGENTS.md
index 02dd976900..4cb8a00a97 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -52,7 +52,7 @@ export GRADLE_OPTS="-Xms2G -Xmx5G"
9. **Test via public APIs** - Tests must exercise behavior through the same APIs an end user calls; never invoke internal implementations, package-private methods, or bypass the public surface directly
10. **Always review and extend tests** - Review existing unit and functional tests before making changes; every code change must include new or enhanced tests that cover the affected behavior
11. **The BOM must manage the latest version** - `validateDependencyVersions` enforces that the BOM (`dependencies.gradle`) manages a version `>=` every transitively-resolved version. When it fails, **bump the version in `dependencies.gradle`** so the BOM wins — never silence it with `allowedBomOverrides` or an exclusion unless there is an explicit, documented conflict or an agreed-upon workaround. See [Dependency Management](#dependency-management).
-12. **GitHub Actions must use ASF-approved pins** - Every third-party action SHA must appear in the ASF allowlist. See [GitHub Actions](#github-actions).
+12. **GitHub Actions must use ASF-approved references** - Every third-party action SHA must appear in the ASF allowlist; `actions/*` use the full tag of their latest release and `apache/*` use version or branch references, never SHAs. See [GitHub Actions](#github-actions).
## Available Skills
@@ -235,10 +235,10 @@ https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml
Rules:
-- Pin every third-party action to a **full commit SHA** that appears in that file, with a trailing `# version` comment.
-- `actions/*`, `github/*`, and `apache/*` are allowed by namespace. Still SHA-pin them for supply-chain consistency.
-- Do not use a newer SHA, tag, or major version until it is on the allowlist. If you need a new pin, open a PR against `apache/infrastructure-actions` (`actions.yml`, not the generated `approved_patterns.yml`).
-- Before adding or bumping a `uses:` line, search `approved_patterns.yml` for that action and copy an approved SHA.
+- Pin every third-party action, including `github/*`, to a **full commit SHA** that appears in that file, with a trailing `# version` comment.
+- `actions/*` and `apache/*` (including our own `apache/grails-github-actions`) are allowed by namespace, so every version is approved. Reference `actions/*` by the full tag of the latest release (for example `actions/checkout@v7.0.1`, not `@v7`), and our own actions by branch (for example `apache/grails-github-actions/pre-release@asf`). Never pin either by SHA.
+- Do not use a newer third-party SHA, tag, or major version until it is on the allowlist. If you need a new pin, open a PR against `apache/infrastructure-actions` (`actions.yml`, not the generated `approved_patterns.yml`).
+- Before adding or bumping a third-party `uses:` line, search `approved_patterns.yml` for that action and copy an approved SHA.
## Branch Naming (Auto-Labels PRs)