You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@eventmesh.apache.org by xi...@apache.org on 2026/09/11 15:45:19 UTC
(eventmesh-dashboard) branch main updated: fix: pin third-party GitHub Actions to ASF-approved SHAs (#224)
This is an automated email from the ASF dual-hosted git repository.
Pil0tXia pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/eventmesh-dashboard.git
The following commit(s) were added to refs/heads/main by this push:
new b534b99c fix: pin third-party GitHub Actions to ASF-approved SHAs (#224)
b534b99c is described below
commit b534b99c2d5e2ad4f529ec61fad0076bdffaab6b
Author: Pil0tXia <xi...@apache.org>
AuthorDate: Fri Sep 11 23:45:13 2026 +0800
fix: pin third-party GitHub Actions to ASF-approved SHAs (#224)
* fix: pin third-party GitHub Actions to ASF-approved SHAs
* fix: pin CI EventMesh runtime to v1.12.0
---
.github/workflows/auto-dependabot.yml | 2 +-
.github/workflows/ci.yml | 4 ++--
.github/workflows/docker.yml | 6 +++---
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/.github/workflows/auto-dependabot.yml b/.github/workflows/auto-dependabot.yml
index 512a43f6..168e4301 100644
--- a/.github/workflows/auto-dependabot.yml
+++ b/.github/workflows/auto-dependabot.yml
@@ -31,7 +31,7 @@ jobs:
steps:
- name: Dependabot metadata
id: metadata
- uses: dependabot/fetch-metadata@v2
+ uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 380563f8..c296abd9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -66,10 +66,10 @@ jobs:
unzip nacos-server-2.3.2.zip
wget https://dist.apache.org/repos/dist/release/rocketmq/4.9.8/rocketmq-all-4.9.8-bin-release.zip
unzip rocketmq-all-4.9.8-bin-release.zip
- git clone https://github.com/apache/eventmesh.git
+ git clone --depth 1 --branch v1.12.0 https://github.com/apache/eventmesh.git
- name: Setup Gradle
- uses: gradle/actions/setup-gradle@v3
+ uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
- name: Set up JDK 11
uses: actions/setup-java@v4
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 2f36afd9..0d195552 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -29,19 +29,19 @@ jobs:
- name: Checkout repository
uses: actions/checkout@v4
- name: Login to DockerHub
- uses: docker/login-action@v3
+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
username: ${{ secrets.DOCKERHUB_USER }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Docker meta
id: meta
- uses: docker/metadata-action@v5
+ uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
with:
images: |
apache/eventmesh-dashboard
- name: Build and push
- uses: docker/build-push-action@v5
+ uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
push: true
tags: ${{ steps.meta.outputs.tags }}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@eventmesh.apache.org
For additional commands, e-mail: commits-help@eventmesh.apache.org