You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by ja...@apache.org on 2026/05/29 17:09:27 UTC
(grails-gradle-publish) branch ci/setup-gradle-v6-basic-cache created (now 7473da9)
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a change to branch ci/setup-gradle-v6-basic-cache
in repository https://gitbox.apache.org/repos/asf/grails-gradle-publish.git
at 7473da9 ci: audit and update GitHub Actions to ASF-approved versions
This branch includes the following new commits:
new 7473da9 ci: audit and update GitHub Actions to ASF-approved versions
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(grails-gradle-publish) 01/01: ci: audit and update GitHub Actions to ASF-approved versions
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a commit to branch ci/setup-gradle-v6-basic-cache
in repository https://gitbox.apache.org/repos/asf/grails-gradle-publish.git
commit 7473da902da79122f2a0b67def2212079d5ca5a8
Author: James Fredley <ja...@users.noreply.github.com>
AuthorDate: Fri May 29 13:09:21 2026 -0400
ci: audit and update GitHub Actions to ASF-approved versions
Pin every external GitHub Action to a full commit SHA from the ASF
approved actions allow-list, with a trailing comment naming the version
it resolves to. Mirrors the grails-core audit in apache/grails-core#15690.
- actions/checkout -> de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (was 34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1, 93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1)
- actions/setup-java -> be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 (was c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0)
- actions/upload-artifact -> 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 (was ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2)
- release-drafter/release-drafter -> e1247478eabc9f6d9cf5ec2b3547469b0e1d2767 # v7.3.1 (was 6a93d829887aa2e0748befe2e808c66c0ec6e4c7 # v6.4.0)
- softprops/action-gh-release -> b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 (was 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2)
Add cache-provider: basic to all 5 setup-gradle steps so caching
stays on the MIT-licensed provider rather than the proprietary enhanced
provider introduced in gradle/actions v6 (Gradle commercial Terms of Use).
First-party apache/grails-github-actions/* and local ./.github/actions/*
references are intentionally left unchanged.
Assisted-by: claude-code:claude-4.8-opus
---
.github/workflows/ci.yaml | 14 ++++++++------
.github/workflows/rat.yaml | 7 ++++---
.github/workflows/release-notes.yml | 2 +-
.github/workflows/release.yaml | 20 +++++++++++---------
4 files changed, 24 insertions(+), 19 deletions(-)
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 470a76b..209509e 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -38,15 +38,16 @@ jobs:
- name: "🌐 Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "☕️ Setup JDK"
- uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+ uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🐘 Setup Gradle"
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
with:
+ cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
- name: "🔨 Build Project (without tests)"
if: ${{ contains(github.event.head_commit.message, '[skip tests]') }}
@@ -71,15 +72,16 @@ jobs:
- name: "🌐 Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "☕️ Setup JDK"
- uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+ uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: liberica
java-version: 17
- name: "🐘 Setup Gradle"
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
with:
+ cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
- name: "📤 Publish Snapshot Artifacts"
env:
@@ -93,12 +95,12 @@ jobs:
--rerun-tasks
-Dorg.gradle.internal.publish.checksums.insecure=true
- name: "📤 Upload checksums"
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: CHECKSUMS.txt
path: build/CHECKSUMS.txt
- name: "📤 Upload published artifacts"
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: PUBLISHED_ARTIFACTS.txt
path: build/PUBLISHED_ARTIFACTS.txt
diff --git a/.github/workflows/rat.yaml b/.github/workflows/rat.yaml
index dc059c0..061cb2b 100644
--- a/.github/workflows/rat.yaml
+++ b/.github/workflows/rat.yaml
@@ -29,21 +29,22 @@ jobs:
runs-on: ubuntu-24.04
steps:
- name: "📥 Checkout repository"
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "☕️ Setup JDK"
- uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+ uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: liberica
java-version: 17
- name: "🐘 Setup Gradle"
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
with:
+ cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
- name: "🧐 Apache License - Release Audit Tool"
run: ./gradlew rat
- name: "📤 Upload RAT HTML report"
if: always()
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: rat-report
path: build/reports/rat/index.html
diff --git a/.github/workflows/release-notes.yml b/.github/workflows/release-notes.yml
index 926264f..1d5c2e7 100644
--- a/.github/workflows/release-notes.yml
+++ b/.github/workflows/release-notes.yml
@@ -39,6 +39,6 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: "📝 Update Release Draft"
- uses: release-drafter/release-drafter@6a93d829887aa2e0748befe2e808c66c0ec6e4c7 # v6.4.0
+ uses: release-drafter/release-drafter@e1247478eabc9f6d9cf5ec2b3547469b0e1d2767 # v7.3.1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c1b96d9..f0d9a70 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -48,7 +48,7 @@ jobs:
- name: "🌐 Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
run: curl -s https://api.ipify.org
- name: "📥 Checkout repository"
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ env.TAG }}
token: ${{ secrets.GITHUB_TOKEN }} # This should not be needed as ${{ github.token }} is the default, but there have been issues with it.
@@ -70,6 +70,7 @@ jobs:
- name: "🐘 Setup Gradle"
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
with:
+ cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
- name: "⚙️ Run pre-release"
uses: apache/grails-github-actions/pre-release@asf
@@ -117,7 +118,7 @@ jobs:
- name: "📅 Generate build date file"
run: echo "$SOURCE_DATE_EPOCH" >> build/BUILD_DATE.txt
- name: "📤 Upload build date, checksums and published artifacts files"
- uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+ uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
with:
tag_name: ${{ env.TAG }}
files: |
@@ -134,7 +135,7 @@ jobs:
- name: "📝 Establish release version"
run: echo "VERSION=${TAG#v}" >> "$GITHUB_ENV"
- name: "📥 Checkout repository"
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
path: grails-publish
ref: ${{ env.TAG }}
@@ -196,7 +197,7 @@ jobs:
- name: "📦 Create source distribution checksum"
run: sha512sum ${DIST_NAME}-${VERSION}-src.zip > ${DIST_NAME}-${VERSION}-src.zip.sha512
- name: "🚀 Upload ZIP and Signature to GitHub Release"
- uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+ uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
with:
tag_name: ${{ env.TAG }}
files: |
@@ -304,12 +305,12 @@ jobs:
cd dev-repo
svn info ${VERSION} > DIST_SVN_REVISION.txt
- name: "📤 Upload Distribution SVN revision"
- uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+ uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
with:
tag_name: ${{ env.TAG }}
files: dev-repo/DIST_SVN_REVISION.txt
- name: "📥 Checkout repository"
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
path: ${{ env.REPO_NAME }}
ref: ${{ env.TAG }}
@@ -356,7 +357,7 @@ jobs:
- name: "🛠️ Install tools"
run: sudo apt-get install -y gettext-base
- name: "📥 Checkout repository"
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ env.TAG }}
- name: "🗳 MANUAL - Confirm Grails PMC Vote succeeded"
@@ -412,7 +413,7 @@ jobs:
- name: "📝 Establish release version"
run: echo "VERSION=${TAG#v}" >> "$GITHUB_ENV"
- name: "📥 Checkout repository"
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ env.TAG }}
token: ${{ secrets.GITHUB_TOKEN }} # This should not be needed as ${{ github.token }} is the default, but there have been issues with it.
@@ -426,6 +427,7 @@ jobs:
- name: "🐘 Setup Gradle"
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
with:
+ cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
- name: "📖 Generate Documentation"
run: ./gradlew grails-publish:groovydoc
@@ -450,7 +452,7 @@ jobs:
- name: "🛠️ Install tools"
run: sudo apt-get install -y gettext-base
- name: "📥 Checkout repository"
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ env.TAG }}
token: ${{ secrets.GITHUB_TOKEN }} # This should not be needed as ${{ github.token }} is the default, but there have been issues with it.