You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@grails.apache.org by "jamesfredley (via GitHub)" <gi...@apache.org> on 2026/08/28 15:32:49 UTC
[PR] fix: pin Forge AWS credentials action to ASF allowlist SHA [grails-core]
jamesfredley opened a new pull request, #16242:
URL: https://github.com/apache/grails-core/pull/16242
## Description
Pin `aws-actions/configure-aws-credentials` to the ASF-approved SHA `e7f100cf4c008499ea8adda475de1042d6975c7b` (v6.2.0) from [approved_patterns.yml](https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml).
The v5.1.0 pin caused Forge AWS workflow startup failure. Document the allowlist in `AGENTS.md`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: pin Forge AWS credentials action to ASF allowlist SHA [grails-core]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #16242:
URL: https://github.com/apache/grails-core/pull/16242#issuecomment-5455071624
## [Codecov](https://app.codecov.io/gh/apache/grails-core/pull/16242?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 54.1498%. Comparing base ([`fd8de78`](https://app.codecov.io/gh/apache/grails-core/commit/fd8de78c0ace64e0401b9ddf844c4ecddeee1734?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`698ff28`](https://app.codecov.io/gh/apache/grails-core/commit/698ff28cbddfaa517c13b8025ac08acfdb8f303d?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 2 commits behind head on 8.0.x.
<details><summary>Additional details and impacted files</summary>
[](https://app.codecov.io/gh/apache/grails-core/pull/16242?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
```diff
@@ Coverage Diff @@
## 8.0.x #16242 +/- ##
==================================================
+ Coverage 54.1488% 54.1498% +0.0010%
- Complexity 20257 20260 +3
==================================================
Files 2098 2098
Lines 100920 100920
Branches 17898 17898
==================================================
+ Hits 54647 54648 +1
Misses 38484 38484
+ Partials 7789 7788 -1
```
[see 1 file with indirect coverage changes](https://app.codecov.io/gh/apache/grails-core/pull/16242/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: pin Forge AWS credentials action to ASF allowlist SHA [grails-core]
Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.
testlens-app[bot] commented on PR #16242:
URL: https://github.com/apache/grails-core/pull/16242#issuecomment-5454988617
## π¨ TestLens detected 1 failed test π¨
Here is what you can do:
1) Inspect the test failures carefully.
2) If you are convinced that some of the tests are flaky, you can mute them below.
3) Finally, trigger a rerun by checking the rerun checkbox.
### Test Summary
#### [CI / Functional Tests \(Java 25, indy\=false\)](https://github.com/apache/grails-core/actions/runs/33185665528/job/98897899659?pr=16242) > :grails-test-examples-scaffolding:integrationTest
| Test | Runs | Flakiness |
|---|---|--:|
| UserControllerSpec > User list | β | [2% π‘](https://github.com/apache/grails-core/issues/16030) |
π·οΈ Commit: 698ff28cbddfaa517c13b8025ac08acfdb8f303d
βΆοΈ Tests: 25538 executed
π‘ Checks: 43/79 completed
### Test Failures
<details>
<summary><strong>UserControllerSpec > User list</strong> (:grails-test-examples-scaffolding:integrationTest in <a href="https://github.com/apache/grails-core/actions/runs/33185665528/job/98897899659?pr=16242">CI / Functional Tests (Java 25, indy=false)</a>)</summary>
```
geb.waiting.WaitTimeoutException: condition did not pass in 30 seconds (failed with exception)
at geb.waiting.Wait.waitFor(Wait.groovy:128)
at geb.waiting.DefaultWaitingSupport.doWaitFor(DefaultWaitingSupport.groovy:55)
at geb.waiting.DefaultWaitingSupport.waitFor(DefaultWaitingSupport.groovy:41)
at geb.Page.waitFor(Page.groovy:120)
at com.example.pages.LoginPage.login(LoginPage.groovy:39)
at com.example.UserControllerSpec.User list(UserControllerSpec.groovy:48)
Caused by: Assertion failed:
title != pageTitle && $('input', name: 'username').empty
| | | |
| | | false
| | 'Please sign in'
| false
'Please sign in'
at com.example.pages.LoginPage.login_closure1(LoginPage.groovy:39)
at com.example.pages.LoginPage.login_closure1(LoginPage.groovy)
at geb.waiting.Wait.waitFor(Wait.groovy:117)
... 5 more
```
</details>
### Rerun Controls
> [!NOTE]
> Checks are currently running using the configuration below.
Select tests to mute in this pull request:
π² UserControllerSpec > User list <!-- uniqueId=[engine:spock]/[spec:com.example.UserControllerSpec]/[feature:$spock_feature_1_0] -->
Reuse successful test results:
π² β»οΈ Only rerun the tests that failed or were muted before
Click the checkbox to trigger a rerun:
π² **Rerun jobs**
---
_Learn more about TestLens at [testlens.app/docs](https://testlens.app/docs/features/pr-comment/)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: pin Forge AWS credentials action to ASF allowlist SHA [grails-core]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #16242:
URL: https://github.com/apache/grails-core/pull/16242#discussion_r3881979043
##########
AGENTS.md:
##########
@@ -239,6 +240,21 @@ class MyService { }
| Build docs | `./gradlew :grails-doc:publishGuide -x aggregateGroovydoc` |
| Debug | `./gradlew bootRun --debug-jvm` |
+## GitHub Actions
+
+Apache GitHub Actions policy blocks third-party actions unless they are on the organization allowlist. A workflow that uses an unlisted `uses:` SHA fails at **startup** before any job runs.
+
+The allowlist source of truth is:
+
+https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml
Review Comment:
This is a bare URL in the middle of prose; consider converting it to a Markdown link (e.g., `[approved_patterns.yml](...)`) for consistency with the rest of the doc and easier readability.
##########
AGENTS.md:
##########
@@ -239,6 +240,21 @@ class MyService { }
| Build docs | `./gradlew :grails-doc:publishGuide -x aggregateGroovydoc` |
| Debug | `./gradlew bootRun --debug-jvm` |
+## GitHub Actions
+
+Apache GitHub Actions policy blocks third-party actions unless they are on the organization allowlist. A workflow that uses an unlisted `uses:` SHA fails at **startup** before any job runs.
+
+The allowlist source of truth is:
+
+https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml
+
+Rules:
+
+- Pin every third-party action to a **full commit SHA** that appears in that file, with a trailing `# version` comment.
+- `actions/*`, `github/*`, and `apache/*` are allowed by namespace. Still SHA-pin them for supply-chain consistency.
+- Do not use a newer SHA, tag, or major version until it is on the allowlist. If you need a new pin, open a PR against `apache/infrastructure-actions` (`actions.yml`, not the generated `approved_patterns.yml`).
+- Before adding or bumping a `uses:` line, search `approved_patterns.yml` for that action and copy an approved SHA.
Review Comment:
These two bullets read as slightly contradictory: the first implies the SHA must appear in `approved_patterns.yml`, while the second says some namespaces are allowed by namespace (so their SHAs may not be in `approved_patterns.yml`). Consider rewording to explicitly distinguish (a) third-party actions that must use an allowlisted SHA from `approved_patterns.yml` vs (b) namespace-allowed actions that should still be SHA-pinned even if the SHA isnβt listed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: pin Forge AWS credentials action to ASF allowlist SHA [grails-core]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley merged PR #16242:
URL: https://github.com/apache/grails-core/pull/16242
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org