You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@grails.apache.org by "jamesfredley (via GitHub)" <gi...@apache.org> on 2026/05/28 18:59:30 UTC
[PR] ci: audit and update GitHub Actions to ASF-approved versions [grails-core]
jamesfredley opened a new pull request, #15690:
URL: https://github.com/apache/grails-core/pull/15690
## What
Audit of every GitHub Action used in the repository against the [ASF approved actions allow-list](https://github.com/apache/infrastructure-actions/blob/main/actions.yml), updating each to its current approved version.
## Why
The primary driver is `setup-gradle`:
- The `v5.0.0` SHA in use across most workflows was **never on the ASF allow-list**.
- The `v5.0.2` SHA used in the release workflows **expires from the allow-list on 2026-06-20**.
- `gradle/actions` `v6.0.0` moved caching into a proprietary `enhanced` provider governed by [Gradle's commercial Terms of Use](https://gradle.com/legal/terms-of-use/). `v6.1.0` reintroduced an MIT-licensed `basic` cache provider built on `@actions/cache`.
Standardizing on the approved **`v6.1.0`** SHA with **`cache-provider: basic`** gets us onto a supported, allow-list-approved version while keeping caching MIT-licensed. Each `cache-provider` line carries an inline comment documenting the MIT-vs-proprietary distinction.
## Changes
`setup-gradle` -> `v6.1.0` (approved SHA) + `cache-provider: basic` across all workflows.
Other actions bumped to their current ASF-approved versions:
| Action | Version |
|--------|---------|
| `actions/checkout` | `v6.0.2` |
| `actions/setup-java` | `v5.2.0` (standardized from mixed v4/v5) |
| `actions/cache` | `v5.0.5` |
| `actions/download-artifact` | `v8.0.1` (compatible with `upload-artifact` v7.0.1) |
| `actions/upload-artifact` | SHA-pinned to `v7.0.1` consistently |
| `github/codeql-action` | `v4.36.0` |
| `release-drafter/release-drafter` | `v7.3.1` SHA |
| `softprops/action-gh-release` | `v3.0.0` SHA |
| `nick-fields/retry` | `v4.0.0` SHA |
The `grails-forge` GitHub workflow templates received the same `setup-gradle` + `checkout`/`setup-java` updates so generated applications also default to the MIT-licensed cache provider, and `PlainGithubWorkflowSpec` was extended to assert the generated content.
## Verification
- Zero stale `gradle/actions` SHAs remain; all references on `v6.1.0`.
- All 16 workflow YAML files parse cleanly.
- `grails-forge` `PlainGithubWorkflowSpec` passes (4/4, across JDK 17/21/25); rocker templates and test classes compile.
This targets `7.0.x` and is intended to be merged forward to the other active branches.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: audit and update GitHub Actions to ASF-approved versions [grails-core]
Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.
jdaugherty commented on PR #15690:
URL: https://github.com/apache/grails-core/pull/15690#issuecomment-4567436832
Why did checks not run against this branch since it's targeting 7.0?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: audit and update GitHub Actions to ASF-approved versions [grails-core]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on PR #15690:
URL: https://github.com/apache/grails-core/pull/15690#issuecomment-4567491531
@jdaugherty GitHub bug, running now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: audit and update GitHub Actions to ASF-approved versions [grails-core]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley closed pull request #15690: ci: audit and update GitHub Actions to ASF-approved versions
URL: https://github.com/apache/grails-core/pull/15690
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: audit and update GitHub Actions to ASF-approved versions [grails-core]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley merged PR #15690:
URL: https://github.com/apache/grails-core/pull/15690
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: audit and update GitHub Actions to ASF-approved versions [grails-core]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on PR #15690:
URL: https://github.com/apache/grails-core/pull/15690#issuecomment-4570865144
merging since CI is partially broken due to SHA changes on authorized list.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: audit and update GitHub Actions to ASF-approved versions [grails-core]
Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.
testlens-app[bot] commented on PR #15690:
URL: https://github.com/apache/grails-core/pull/15690#issuecomment-4567860080
## ✅ All tests passed ✅
🏷️ Commit: f0c5ae4256bb3d64552a20885c687d2cae109a71
▶️ Tests: 21207 executed
⚪️ Checks: 33/33 completed
---
_Learn more about TestLens at [testlens.app](https://testlens.app)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org