You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ratis.apache.org by "adoroszlai (via GitHub)" <gi...@apache.org> on 2026/10/16 07:43:24 UTC
[PR] RATIS-2756. Pin first-party actions to a major version tag [ratis-thirdparty]
adoroszlai opened a new pull request, #217:
URL: https://github.com/apache/ratis-thirdparty/pull/217
## What changes were proposed in this pull request?
> The [GitHub Actions Policy](github-actions-policy.html) requires a specific git hash only for **external** actions; actions in the `apache/*`, `github/*` and `actions/*` namespaces may be used without that restriction. Pinning those to a major version tag rather than to a hash lets a patch or minor release arrive without a pull request, which removes a large share of the Dependabot traffic a project sees. External actions still **MUST** be pinned to a specific git hash. ([source](https://infra.apache.org/services.html#gha-mitigations))
- This PR updates workflows to pin `actions/*` and `apache/*` by major version instead of SHA, as recommended by Apache Infra above. `github/*` actions are not used here.
- Configure zizmor to allow such pinning.
- Make sure zizmor workflow is triggered by changes in zizmor config.
- Switch `zizmor` workflow to `ubuntu-24.04` (see RATIS-2757, but included in this PR because in `ratis-thirdparty` this is the only action affected).
https://issues.apache.org/jira/browse/RATIS-2756
## How was this patch tested?
CI: https://github.com/adoroszlai/ratis-thirdparty/actions/runs/38867186086
allowlist-check: https://github.com/adoroszlai/ratis-thirdparty/actions/runs/38867186040
zizmor: https://github.com/adoroszlai/ratis-thirdparty/actions/runs/38867186030
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ratis.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RATIS-2756. Pin first-party actions to a major version tag [ratis-thirdparty]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai merged PR #217:
URL: https://github.com/apache/ratis-thirdparty/pull/217
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ratis.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RATIS-2756. Pin first-party actions to a major version tag [ratis-thirdparty]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #217:
URL: https://github.com/apache/ratis-thirdparty/pull/217#issuecomment-6212527447
Thanks @amaliujia for the review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ratis.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org