You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@trafficserver.apache.org by "shukitchan (via GitHub)" <gi...@apache.org> on 2026/10/05 21:37:43 UTC
[PR] Update CIFuzz actions to specific versions [trafficserver]
shukitchan opened a new pull request, #13796:
URL: https://github.com/apache/trafficserver/pull/13796
This pull request updates several GitHub Actions used in the `.github/workflows/cifuzz.yml` workflow to reference specific versions instead of floating versions like `master` or older major versions. This change helps ensure stability and reproducibility in CI runs by locking dependencies to known versions.
**Dependency version pinning and updates:**
* Updated `build_fuzzers` and `run_fuzzers` actions to use a specific commit hash (`8f634126459ac994f47076ee3ba0be6b348d75e2`) instead of `master`, ensuring consistent builds and fuzzing runs.
* Updated `actions/upload-artifact` from `v4` to `v7` for artifact uploads, likely bringing in bug fixes and improvements.
* Updated `github/codeql-action/upload-sarif` from `v2` to `v3` for SARIF uploads, ensuring compatibility with the latest features and security updates.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update CIFuzz actions to specific versions [trafficserver]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #13796:
URL: https://github.com/apache/trafficserver/pull/13796#discussion_r4189229227
##########
.github/workflows/cifuzz.yml:
##########
@@ -11,26 +11,26 @@ jobs:
steps:
- name: Build Fuzzers
id: build
- uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+ uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@8f634126459ac994f47076ee3ba0be6b348d75e2
with:
oss-fuzz-project-name: 'trafficserver'
language: c++
- name: Run Fuzzers
- uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+ uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@8f634126459ac994f47076ee3ba0be6b348d75e2
with:
oss-fuzz-project-name: 'trafficserver'
language: c++
fuzz-seconds: 300
output-sarif: true
- name: Upload Crash
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v7
Review Comment:
`v7` is a movable major-version tag, so this action is still not locked to a known revision as the PR description claims. Pin the tag's current commit (and let Dependabot update it) to make CIFuzz runs reproducible and avoid executing later tag retargets implicitly.
This issue also appears on line 33 of the same file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update CIFuzz actions to specific versions [trafficserver]
Posted by "shukitchan (via GitHub)" <gi...@apache.org>.
shukitchan commented on PR #13796:
URL: https://github.com/apache/trafficserver/pull/13796#issuecomment-6003903733
For now, it only works with hashes for oss-fuzz actions
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update CIFuzz actions to specific versions [trafficserver]
Posted by "shukitchan (via GitHub)" <gi...@apache.org>.
shukitchan commented on PR #13796:
URL: https://github.com/apache/trafficserver/pull/13796#issuecomment-6003893740
Unfortunately it is subjected to ruling of this file - https://github.com/apache/infrastructure-actions/blob/main/actions.yml
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update CIFuzz actions to specific versions [trafficserver]
Posted by "shukitchan (via GitHub)" <gi...@apache.org>.
shukitchan merged PR #13796:
URL: https://github.com/apache/trafficserver/pull/13796
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update CIFuzz actions to specific versions [trafficserver]
Posted by "bryancall (via GitHub)" <gi...@apache.org>.
bryancall commented on PR #13796:
URL: https://github.com/apache/trafficserver/pull/13796#issuecomment-6003816734
@shukitchan please update it to use hashes instead of tags please.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update CIFuzz actions to specific versions [trafficserver]
Posted by "shukitchan (via GitHub)" <gi...@apache.org>.
shukitchan commented on PR #13796:
URL: https://github.com/apache/trafficserver/pull/13796#issuecomment-6003563760
The version is specified in https://github.com/apache/infrastructure-actions/tree/main
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org