You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by ja...@apache.org on 2026/08/28 15:32:26 UTC
(grails-core) branch fix/forge-aws-oidc-cli created (now 698ff28cbd)
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a change to branch fix/forge-aws-oidc-cli
in repository https://gitbox.apache.org/repos/asf/grails-core.git
at 698ff28cbd Pin Forge AWS credentials action to an ASF-approved SHA
This branch includes the following new commits:
new 698ff28cbd Pin Forge AWS credentials action to an ASF-approved SHA
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(grails-core) 01/01: Pin Forge AWS credentials action to an ASF-approved SHA
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a commit to branch fix/forge-aws-oidc-cli
in repository https://gitbox.apache.org/repos/asf/grails-core.git
commit 698ff28cbddfaa517c13b8025ac08acfdb8f303d
Author: James Fredley <ja...@users.noreply.github.com>
AuthorDate: Fri Aug 28 11:32:17 2026 -0400
Pin Forge AWS credentials action to an ASF-approved SHA
Use aws-actions/configure-aws-credentials v6.2.0 from
apache/infrastructure-actions approved_patterns.yml. The previous
v5.1.0 pin is not on the allowlist and fails workflow startup.
Document the allowlist in AGENTS.md so future workflow edits copy an
approved SHA instead of a newer unlisted tag.
---
.github/workflows/forge-deploy-aws.yml | 2 +-
AGENTS.md | 16 ++++++++++++++++
2 files changed, 17 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/forge-deploy-aws.yml b/.github/workflows/forge-deploy-aws.yml
index 101e54fcb6..9033033319 100644
--- a/.github/workflows/forge-deploy-aws.yml
+++ b/.github/workflows/forge-deploy-aws.yml
@@ -192,7 +192,7 @@ jobs:
fi
- name: "Configure AWS credentials through OIDC"
- uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
+ uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
with:
role-to-assume: ${{ env.DEPLOY_ROLE_ARN }}
aws-region: ${{ inputs.aws_region }}
diff --git a/AGENTS.md b/AGENTS.md
index c02c288a12..124623d789 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -55,6 +55,7 @@ export GRADLE_OPTS="-Xms2G -Xmx5G"
12. **Clean violations before commit** - Before every automated commit, run `./gradlew clean aggregateViolations :grails-test-report:check --continue` from the root and ensure that `build/reports/violations/CHECKSTYLE_VIOLATIONS.md`, `build/reports/violations/CODENARC_VIOLATIONS.md`, `build/reports/violations/PMD_VIOLATIONS.md`, and `build/reports/violations/SPOTBUGS_VIOLATIONS.md` report no issues. Also review the test result reports under `grails-test-report/build/reports/tests/` and e [...]
13. **Mandatory test coverage** - Any class touched in a commit MUST be covered with tests that verify all behavior. You must run ALL tests in the affected module(s) and ensure they pass before committing.
14. **The BOM must manage the latest version** - `validateDependencyVersions` enforces that the BOM (`dependencies.gradle`) manages a version `>=` every transitively-resolved version. When it fails, **bump the version in `dependencies.gradle`** so the BOM wins — never silence it with `allowedBomOverrides` or an exclusion unless there is an explicit, documented conflict or an agreed-upon workaround. See [Dependency Management](#dependency-management).
+15. **GitHub Actions must use ASF-approved pins** - Every third-party action SHA must appear in the ASF allowlist. See [GitHub Actions](#github-actions).
## Available Skills
@@ -239,6 +240,21 @@ class MyService { }
| Build docs | `./gradlew :grails-doc:publishGuide -x aggregateGroovydoc` |
| Debug | `./gradlew bootRun --debug-jvm` |
+## GitHub Actions
+
+Apache GitHub Actions policy blocks third-party actions unless they are on the organization allowlist. A workflow that uses an unlisted `uses:` SHA fails at **startup** before any job runs.
+
+The allowlist source of truth is:
+
+https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml
+
+Rules:
+
+- Pin every third-party action to a **full commit SHA** that appears in that file, with a trailing `# version` comment.
+- `actions/*`, `github/*`, and `apache/*` are allowed by namespace. Still SHA-pin them for supply-chain consistency.
+- Do not use a newer SHA, tag, or major version until it is on the allowlist. If you need a new pin, open a PR against `apache/infrastructure-actions` (`actions.yml`, not the generated `approved_patterns.yml`).
+- Before adding or bumping a `uses:` line, search `approved_patterns.yml` for that action and copy an approved SHA.
+
## Branch Naming (Auto-Labels PRs)
| Prefix | Label |