You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@spark.apache.org by "Yicong-Huang (via GitHub)" <gi...@apache.org> on 2026/03/27 18:44:29 UTC
[PR] [SPARK-56260][INFRA] Pin third-party GitHub Actions to commit SHA [spark]
Yicong-Huang opened a new pull request, #55066:
URL: https://github.com/apache/spark/pull/55066
### What changes were proposed in this pull request?
Pin all third-party GitHub Actions in CI workflows to specific commit SHA versions instead of mutable version tags. A version comment is added alongside each SHA for maintainability.
Actions pinned:
| Action | Before | Pinned SHA | Apache Allowlist |
|---|---|---|---|
| `bufbuild/buf-setup-action` | `@v1` | `a47c93e0...` | `*: keep: true` |
| `bufbuild/buf-lint-action` | `@v1` | `06f9dd82...` | `*: keep: true` |
| `bufbuild/buf-breaking-action` | `@v1` | `c57b3d84...` | `*: keep: true` |
| `codecov/codecov-action` | `@v5` | `75cd1169...` | `*: keep: true` |
| `medyagh/setup-minikube` | `@v0.0.21` | `e9e035a8...` | `*: keep: true` |
| `r-lib/actions/setup-r` | `@v2` | `6f6e5bc6...` | `*: keep: true` |
| `ruby/setup-ruby` | `@v1` | `4dc28cf1...` | `*: keep: true` |
| `test-summary/action` | `@v2` | `31493c76...` | `*: keep: true` |
All actions are verified to be on the [Apache infrastructure-actions allowlist](https://github.com/apache/infrastructure-actions/blob/main/actions.yml).
### Why are the changes needed?
Pinning actions to commit SHAs is a [security best practice recommended by GitHub](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions) to prevent supply chain attacks via compromised action tags.
### Does this PR introduce _any_ user-facing change?
No
### How was this patch tested?
No functional changes - only CI workflow action references are updated.
### Was this patch authored or co-authored using generative AI tooling?
No
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-56260][INFRA] Pin third-party GitHub Actions to commit SHA [spark]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang commented on PR #55066:
URL: https://github.com/apache/spark/pull/55066#issuecomment-4158777142
@dongjoon-hyun sorry to ping you again on this PR, but do you think we can merge this one? Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-56260][INFRA] Pin third-party GitHub Actions to commit SHA [spark]
Posted by "cloud-fan (via GitHub)" <gi...@apache.org>.
cloud-fan commented on PR #55066:
URL: https://github.com/apache/spark/pull/55066#issuecomment-4174098776
thanks, merging to master!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-56260][INFRA] Pin third-party GitHub Actions to commit SHA [spark]
Posted by "cloud-fan (via GitHub)" <gi...@apache.org>.
cloud-fan closed pull request #55066: [SPARK-56260][INFRA] Pin third-party GitHub Actions to commit SHA
URL: https://github.com/apache/spark/pull/55066
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org