You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iceberg.apache.org by et...@apache.org on 2026/04/17 11:19:12 UTC
(iceberg) branch main updated: Build: set zizmor min-severity and min-confidence to medium (#16001)
This is an automated email from the ASF dual-hosted git repository.
etudenhoefner pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/iceberg.git
The following commit(s) were added to refs/heads/main by this push:
new ecbe8a84b1 Build: set zizmor min-severity and min-confidence to medium (#16001)
ecbe8a84b1 is described below
commit ecbe8a84b1897015bdaf0e7c3fdcbb8575aa9971
Author: Kevin Liu <ke...@users.noreply.github.com>
AuthorDate: Fri Apr 17 04:19:06 2026 -0700
Build: set zizmor min-severity and min-confidence to medium (#16001)
---
.github/workflows/api-binary-compatibility.yml | 2 +-
.github/workflows/delta-conversion-ci.yml | 4 ++--
.github/workflows/flink-ci.yml | 2 +-
.github/workflows/hive-ci.yml | 2 +-
.github/workflows/java-ci.yml | 8 ++++----
.github/workflows/jmh-benchmarks.yml | 2 +-
.github/workflows/kafka-connect-ci.yml | 2 +-
.github/workflows/publish-iceberg-rest-fixture-docker.yml | 2 +-
.github/workflows/publish-snapshot.yml | 2 +-
.github/workflows/recurring-jmh-benchmarks.yml | 2 +-
.github/workflows/spark-ci.yml | 2 +-
.github/workflows/zizmor.yml | 2 ++
12 files changed, 17 insertions(+), 15 deletions(-)
diff --git a/.github/workflows/api-binary-compatibility.yml b/.github/workflows/api-binary-compatibility.yml
index d91ba210ab..8ad0ebd26f 100644
--- a/.github/workflows/api-binary-compatibility.yml
+++ b/.github/workflows/api-binary-compatibility.yml
@@ -59,7 +59,7 @@ jobs:
with:
distribution: zulu
java-version: 17
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- run: |
echo "Using the old version tag, as per git describe, of $(git describe)";
- run: ./gradlew revapi --rerun-tasks
diff --git a/.github/workflows/delta-conversion-ci.yml b/.github/workflows/delta-conversion-ci.yml
index aac791ab8b..82442ac041 100644
--- a/.github/workflows/delta-conversion-ci.yml
+++ b/.github/workflows/delta-conversion-ci.yml
@@ -87,7 +87,7 @@ jobs:
with:
distribution: zulu
java-version: ${{ matrix.jvm }}
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
- run: ./gradlew -DsparkVersions=3.5 -DscalaVersion=2.12 -DkafkaVersions= -DflinkVersions= :iceberg-delta-lake:check -Pquick=true -x javadoc
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -113,7 +113,7 @@ jobs:
with:
distribution: zulu
java-version: ${{ matrix.jvm }}
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
- run: ./gradlew -DsparkVersions=3.5 -DscalaVersion=2.13 -DkafkaVersions= -DflinkVersions= :iceberg-delta-lake:check -Pquick=true -x javadoc
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/.github/workflows/flink-ci.yml b/.github/workflows/flink-ci.yml
index 3f346b2184..5479503179 100644
--- a/.github/workflows/flink-ci.yml
+++ b/.github/workflows/flink-ci.yml
@@ -91,7 +91,7 @@ jobs:
with:
distribution: zulu
java-version: ${{ matrix.jvm }}
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
- run: ./gradlew -DsparkVersions= -DkafkaVersions= -DflinkVersions=${{ matrix.flink }} :iceberg-flink:iceberg-flink-${{ matrix.flink }}:check :iceberg-flink:iceberg-flink-runtime-${{ matrix.flink }}:check -Pquick=true -x javadoc -DtestParallelism=auto
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/.github/workflows/hive-ci.yml b/.github/workflows/hive-ci.yml
index 3f9adf2dee..084ce9f4fc 100644
--- a/.github/workflows/hive-ci.yml
+++ b/.github/workflows/hive-ci.yml
@@ -88,7 +88,7 @@ jobs:
with:
distribution: zulu
java-version: ${{ matrix.jvm }}
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
- run: ./gradlew -DsparkVersions= -DflinkVersions= -DkafkaVersions= -Pquick=true :iceberg-mr:check -x javadoc
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml
index 5cc8b198a1..fbcabdb2f3 100644
--- a/.github/workflows/java-ci.yml
+++ b/.github/workflows/java-ci.yml
@@ -83,7 +83,7 @@ jobs:
with:
distribution: zulu
java-version: ${{ matrix.jvm }}
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
- run: ./gradlew check -DsparkVersions= -DflinkVersions= -DkafkaVersions= -Pquick=true -x javadoc
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -107,7 +107,7 @@ jobs:
with:
distribution: zulu
java-version: ${{ matrix.jvm }}
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- run: ./gradlew -DallModules build -x test -x javadoc -x integrationTest
build-javadoc:
@@ -124,7 +124,7 @@ jobs:
with:
distribution: zulu
java-version: ${{ matrix.jvm }}
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- run: ./gradlew -Pquick=true javadoc
check-runtime-deps:
@@ -137,5 +137,5 @@ jobs:
with:
distribution: zulu
java-version: 17
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- run: ./gradlew checkAllRuntimeDeps -q
diff --git a/.github/workflows/jmh-benchmarks.yml b/.github/workflows/jmh-benchmarks.yml
index 9b01352d9a..6dbd3a6958 100644
--- a/.github/workflows/jmh-benchmarks.yml
+++ b/.github/workflows/jmh-benchmarks.yml
@@ -103,7 +103,7 @@ jobs:
with:
distribution: zulu
java-version: 17
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
- name: Run Benchmark
diff --git a/.github/workflows/kafka-connect-ci.yml b/.github/workflows/kafka-connect-ci.yml
index c0490fd698..7eaa042990 100644
--- a/.github/workflows/kafka-connect-ci.yml
+++ b/.github/workflows/kafka-connect-ci.yml
@@ -88,7 +88,7 @@ jobs:
with:
distribution: zulu
java-version: ${{ matrix.jvm }}
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
- run: |
./gradlew -DsparkVersions= -DflinkVersions= -DkafkaVersions=3 \
diff --git a/.github/workflows/publish-iceberg-rest-fixture-docker.yml b/.github/workflows/publish-iceberg-rest-fixture-docker.yml
index 8691a67e29..6976e11ac4 100644
--- a/.github/workflows/publish-iceberg-rest-fixture-docker.yml
+++ b/.github/workflows/publish-iceberg-rest-fixture-docker.yml
@@ -48,7 +48,7 @@ jobs:
with:
distribution: zulu
java-version: 21
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- name: Build Iceberg Open API project
run: ./gradlew :iceberg-open-api:shadowJar
- name: Login to Docker Hub
diff --git a/.github/workflows/publish-snapshot.yml b/.github/workflows/publish-snapshot.yml
index dac63bb9fa..1cbe5c7062 100644
--- a/.github/workflows/publish-snapshot.yml
+++ b/.github/workflows/publish-snapshot.yml
@@ -43,7 +43,7 @@ jobs:
with:
distribution: zulu
java-version: 17
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- env:
NEXUS_USER: ${{ secrets.NEXUS_USER }}
NEXUS_PW: ${{ secrets.NEXUS_PW }}
diff --git a/.github/workflows/recurring-jmh-benchmarks.yml b/.github/workflows/recurring-jmh-benchmarks.yml
index 4ca9007462..da2e7d6032 100644
--- a/.github/workflows/recurring-jmh-benchmarks.yml
+++ b/.github/workflows/recurring-jmh-benchmarks.yml
@@ -58,7 +58,7 @@ jobs:
with:
distribution: zulu
java-version: 17
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
- name: Run Benchmark
diff --git a/.github/workflows/spark-ci.yml b/.github/workflows/spark-ci.yml
index fd55efba97..e9d77308f5 100644
--- a/.github/workflows/spark-ci.yml
+++ b/.github/workflows/spark-ci.yml
@@ -98,7 +98,7 @@ jobs:
with:
distribution: zulu
java-version: ${{ matrix.jvm }}
- - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+ - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
- uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
with:
tool-cache: false
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 313835fcbe..02d49c5473 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -42,3 +42,5 @@ jobs:
uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
with:
advanced-security: false
+ min-severity: medium
+ min-confidence: medium