You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by mm...@apache.org on 2026/08/29 02:10:15 UTC
(pulsar-client-cpp) branch main updated: [improve][ci] Upgrade GitHub Actions to latest and ASF-approved revisions (#610)
This is an automated email from the ASF dual-hosted git repository.
merlimat pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/pulsar-client-cpp.git
The following commit(s) were added to refs/heads/main by this push:
new 4468ce46 [improve][ci] Upgrade GitHub Actions to latest and ASF-approved revisions (#610)
4468ce46 is described below
commit 4468ce466cef97b855492e0e4a6ce230928041b5
Author: Lari Hotari <lh...@users.noreply.github.com>
AuthorDate: Sat Aug 29 05:10:10 2026 +0300
[improve][ci] Upgrade GitHub Actions to latest and ASF-approved revisions (#610)
Two Docker actions were pinned to SHAs that are not on the ASF
org-wide allowlist:
docker/setup-buildx-action@4d04d5d9
docker/setup-qemu-action@ce360397
A workflow referencing a non-allowlisted action fails with a bare
"Startup failure": no logs, no notifications, and the PR can look
green because no checks ran. PR #605 hit exactly this — its
"PR validation" run never started, so the build and unit tests did
not execute while CodeQL and Analyze(cpp) still reported success.
Bump both to the latest approved revisions from
apache/infrastructure-actions, and record the tag in a trailing
comment so Dependabot can track them:
docker/setup-buildx-action -> 37fe6310 # v4.3.0
docker/setup-qemu-action -> 96fe6ef7 # v4.2.0
docker/build-push-action 53b7df96 # v7.3.0 (already latest)
Also update the GitHub-owned actions, which the ASF allowlist treats
as implicitly trusted, to their latest majors:
actions/checkout v3, v4 -> v7
actions/cache v3, v4 -> v6
actions/upload-artifact master -> v7
github/codeql-action v3 -> v4
jidicula/clang-format-action v4.11.0 -> v4.18.0 (allowlisted via *)
actions/upload-artifact was tracking @master, an unpinned moving
target. All four call sites already use unique artifact names, so
the v4+ one-artifact-per-name rule is satisfied.
---
.github/workflows/ci-build-binary-artifacts.yaml | 24 ++++++++--------
.github/workflows/ci-pr-validation.yaml | 36 ++++++++++++------------
.github/workflows/codeql-analysis.yml | 6 ++--
3 files changed, 33 insertions(+), 33 deletions(-)
diff --git a/.github/workflows/ci-build-binary-artifacts.yaml b/.github/workflows/ci-build-binary-artifacts.yaml
index 14557c7d..bdd70e99 100644
--- a/.github/workflows/ci-build-binary-artifacts.yaml
+++ b/.github/workflows/ci-build-binary-artifacts.yaml
@@ -47,10 +47,10 @@ jobs:
steps:
- name: checkout
- uses: actions/checkout@v3
+ uses: actions/checkout@v7
- name: Restore vcpkg binary cache
- uses: actions/cache@v4
+ uses: actions/cache@v6
with:
path: ~/.cache/vcpkg/archives
key: vcpkg-linux-${{matrix.pkg.type}}-${{matrix.cpu.platform}}-${{hashFiles('vcpkg.json')}}
@@ -60,10 +60,10 @@ jobs:
- name: Package Pulsar source
run: build-support/generate-source-archive.sh
- - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+ - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
- name: Build dependencies Docker image
- uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
+ uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: ./pkg/${{matrix.pkg.type}}
load: true
@@ -80,7 +80,7 @@ jobs:
run: zip -r ${{matrix.pkg.type}}-${{matrix.cpu.platform}}.zip ${{matrix.pkg.path}}
- name: Upload artifacts
- uses: actions/upload-artifact@master
+ uses: actions/upload-artifact@v7
with:
name: ${{matrix.pkg.type}}-${{matrix.cpu.platform}}
path: ${{matrix.pkg.path}}
@@ -111,10 +111,10 @@ jobs:
steps:
- name: checkout
- uses: actions/checkout@v3
+ uses: actions/checkout@v7
- name: Restore vcpkg and its artifacts.
- uses: actions/cache@v3
+ uses: actions/cache@v6
id: vcpkg-cache
with:
path: |
@@ -166,7 +166,7 @@ jobs:
run: 7z a -tzip pulsar-client-cpp-${{ matrix.triplet }}.zip ${{ env.INSTALL_DIR }}/*
- name: Upload artifacts
- uses: actions/upload-artifact@master
+ uses: actions/upload-artifact@v7
with:
name: ${{ matrix.triplet }}
path: ${{ env.INSTALL_DIR }}
@@ -194,7 +194,7 @@ jobs:
run: 7z a -tzip pulsar-client-cpp-${{ matrix.triplet }}-Debug.zip ${{ env.INSTALL_DIR }}-Debug/*
- name: Upload artifacts (Debug)
- uses: actions/upload-artifact@master
+ uses: actions/upload-artifact@v7
with:
name: ${{ matrix.triplet }}-Debug
path: ${{ env.INSTALL_DIR }}-Debug
@@ -211,13 +211,13 @@ jobs:
steps:
- name: checkout
- uses: actions/checkout@v3
+ uses: actions/checkout@v7
with:
fetch-depth: 0
submodules: recursive
- name: Restore vcpkg binary cache
- uses: actions/cache@v4
+ uses: actions/cache@v6
with:
path: ~/Library/Caches/vcpkg/archives
key: vcpkg-macos-${{ matrix.arch }}-${{ hashFiles('vcpkg.json') }}
@@ -236,7 +236,7 @@ jobs:
cp macos-${{ matrix.arch }}.zip ../../../
- name: Upload artifacts
- uses: actions/upload-artifact@master
+ uses: actions/upload-artifact@v7
with:
name: macos-${{ matrix.arch }}.zip
path: macos-${{ matrix.arch }}.zip
diff --git a/.github/workflows/ci-pr-validation.yaml b/.github/workflows/ci-pr-validation.yaml
index b1d83cc2..bd2ea0c0 100644
--- a/.github/workflows/ci-pr-validation.yaml
+++ b/.github/workflows/ci-pr-validation.yaml
@@ -33,9 +33,9 @@ jobs:
name: Formatting Check
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v7
- name: Run clang-format style check for C/C++/Protobuf programs.
- uses: jidicula/clang-format-action@v4.11.0
+ uses: jidicula/clang-format-action@v4.18.0
with:
clang-format-version: '11'
exclude-regex: '.*\.(proto|hpp)'
@@ -52,7 +52,7 @@ jobs:
steps:
- name: checkout
- uses: actions/checkout@v3
+ uses: actions/checkout@v7
- name: Install deps (Ubuntu)
if: ${{ startsWith(matrix.os, 'ubuntu') }}
@@ -85,13 +85,13 @@ jobs:
steps:
- name: checkout
- uses: actions/checkout@v3
+ uses: actions/checkout@v7
with:
fetch-depth: 0
submodules: recursive
- name: Restore vcpkg installed cache
- uses: actions/cache@v4
+ uses: actions/cache@v6
id: vcpkg-cache
if: always() && steps.vcpkg-cache.outputs.cache-hit != 'true'
with:
@@ -100,7 +100,7 @@ jobs:
restore-keys: vcpkg-${{ runner.os }}-
- name: Restore vcpkg downloads cache
- uses: actions/cache@v4
+ uses: actions/cache@v6
with:
path: vcpkg/downloads
key: vcpkg-downloads-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}
@@ -136,13 +136,13 @@ jobs:
steps:
- name: checkout
- uses: actions/checkout@v3
+ uses: actions/checkout@v7
with:
fetch-depth: 0
submodules: recursive
- name: Restore vcpkg installed cache
- uses: actions/cache@v4
+ uses: actions/cache@v6
id: vcpkg-cache
if: always() && steps.vcpkg-cache.outputs.cache-hit != 'true'
with:
@@ -153,7 +153,7 @@ jobs:
restore-keys: vcpkg-${{ runner.os }}-
- name: Restore vcpkg downloads cache
- uses: actions/cache@v4
+ uses: actions/cache@v6
with:
path: vcpkg/downloads
key: vcpkg-downloads-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}
@@ -218,7 +218,7 @@ jobs:
steps:
- name: checkout
- uses: actions/checkout@v3
+ uses: actions/checkout@v7
- name: Install deps
run: |
sudo apt-get update -y
@@ -259,12 +259,12 @@ jobs:
arch: '-A Win32'
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v7
with:
submodules: true
- name: Restore vcpkg and its artifacts.
- uses: actions/cache@v4
+ uses: actions/cache@v6
id: vcpkg-cache
if: always() && steps.vcpkg-cache.outputs.cache-hit != 'true'
with:
@@ -392,18 +392,18 @@ jobs:
steps:
- name: checkout
- uses: actions/checkout@v3
+ uses: actions/checkout@v7
- name: Set up QEMU
- uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a
+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
- name: Package Pulsar source
run: build-support/generate-source-archive.sh
- - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+ - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
- name: Build dependencies Docker image
- uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
+ uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: ./pkg/${{matrix.pkg.type}}
load: true
@@ -425,13 +425,13 @@ jobs:
needs: lint
steps:
- name: checkout
- uses: actions/checkout@v3
+ uses: actions/checkout@v7
with:
fetch-depth: 0
submodules: recursive
- name: Restore vcpkg installed cache
- uses: actions/cache@v4
+ uses: actions/cache@v6
id: vcpkg-cache
if: always() && steps.vcpkg-cache.outputs.cache-hit != 'true'
with:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index c877c642..88f9d01a 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -43,14 +43,14 @@ jobs:
steps:
- name: Checkout repository
- uses: actions/checkout@v3
+ uses: actions/checkout@v7
with:
fetch-depth: 0
submodules: recursive
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@v3
+ uses: github/codeql-action/init@v4
with:
languages: ${{ matrix.language }}
@@ -68,6 +68,6 @@ jobs:
cmake --build . -j8
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v3
+ uses: github/codeql-action/analyze@v4
with:
category: "/language:${{matrix.language}}"