You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by ja...@apache.org on 2026/03/31 17:07:56 UTC
(grails-spring-security) branch pin-workflow-actions-to-approved-hashes created (now 12b0b70a0)
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a change to branch pin-workflow-actions-to-approved-hashes
in repository https://gitbox.apache.org/repos/asf/grails-spring-security.git
at 12b0b70a0 Pin GitHub Actions to Apache-approved commit hashes
This branch includes the following new commits:
new 12b0b70a0 Pin GitHub Actions to Apache-approved commit hashes
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(grails-spring-security) 01/01: Pin GitHub Actions to Apache-approved commit hashes
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a commit to branch pin-workflow-actions-to-approved-hashes
in repository https://gitbox.apache.org/repos/asf/grails-spring-security.git
commit 12b0b70a0bd6d68622fadbaaf7db9152b7d1c6a2
Author: James Fredley <ja...@users.noreply.github.com>
AuthorDate: Tue Mar 31 13:07:03 2026 -0400
Pin GitHub Actions to Apache-approved commit hashes
Replace version tags with pinned commit hashes from apache/infrastructure-actions approved_patterns.yml for supply chain security compliance.
- gradle/actions/setup-gradle@v4 -> @017a9eff (v4.4.2) in gradle.yml, rat.yml
- gradle/actions/setup-gradle@v5 -> @07231958 (v5.0.2) in release.yml
- release-drafter/release-drafter@v6 -> @6a93d829 (v6.4.0) in release-notes.yml
- softprops/action-gh-release@v2 -> @153bb8e0 (v2.6.1) in release.yml
Assisted-by: Claude Code <Cl...@Claude.ai>
---
.github/workflows/gradle.yml | 6 +++---
.github/workflows/rat.yml | 2 +-
.github/workflows/release-notes.yml | 2 +-
.github/workflows/release.yml | 12 ++++++------
4 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index dd8a97d6c..fceffa189 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -40,7 +40,7 @@ jobs:
java-version: 17
distribution: liberica
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v4
+ uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
- name: "🏃♂️ Run Tests"
@@ -67,7 +67,7 @@ jobs:
java-version: 17
distribution: liberica
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v4
+ uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
- name: "🏃♂️ Run Different Config Functional Tests"
@@ -93,7 +93,7 @@ jobs:
java-version: 17
distribution: liberica
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v4
+ uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
- name: "📤 Publish Snapshot artifacts"
diff --git a/.github/workflows/rat.yml b/.github/workflows/rat.yml
index 45e9b3f44..d121faeca 100644
--- a/.github/workflows/rat.yml
+++ b/.github/workflows/rat.yml
@@ -38,7 +38,7 @@ jobs:
distribution: liberica
java-version: 17
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v4
+ uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
- name: "🧐 Apache License - Release Audit Tool"
diff --git a/.github/workflows/release-notes.yml b/.github/workflows/release-notes.yml
index eb956509a..5406729fa 100644
--- a/.github/workflows/release-notes.yml
+++ b/.github/workflows/release-notes.yml
@@ -39,6 +39,6 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: "📝 Update Release Draft"
- uses: release-drafter/release-drafter@v6
+ uses: release-drafter/release-drafter@6a93d829887aa2e0748befe2e808c66c0ec6e4c7 # v6.4.0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 212a73330..5551cd6c7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -71,7 +71,7 @@ jobs:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v5
+ uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
with:
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
- name: "⚙️ Run pre-release"
@@ -116,7 +116,7 @@ jobs:
- name: "📅 Generate build date file"
run: echo "$SOURCE_DATE_EPOCH" >> build/BUILD_DATE.txt
- name: "📤 Upload build date, checksums and published artifacts files"
- uses: softprops/action-gh-release@v2
+ uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
with:
tag_name: ${{ env.TAG }}
files: |
@@ -202,7 +202,7 @@ jobs:
> "apache-${REPO_NAME}-${VERSION}-src.zip.sha512"
cat "./apache-${REPO_NAME}-${VERSION}-src.zip.sha512"
- name: "🚀 Upload ZIP and Signature to GitHub Release"
- uses: softprops/action-gh-release@v2
+ uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
with:
tag_name: ${{ env.TAG }}
files: |
@@ -310,7 +310,7 @@ jobs:
cd dev-repo
svn info "$VERSION" > "DIST_SVN_REVISION.txt"
- name: "📤 Upload the Distribution SVN revision file"
- uses: softprops/action-gh-release@v2
+ uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
with:
tag_name: ${{ env.TAG }}
files: dev-repo/DIST_SVN_REVISION.txt
@@ -431,7 +431,7 @@ jobs:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v5
+ uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
with:
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
- name: "🔨 Build Documentation"
@@ -466,7 +466,7 @@ jobs:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
- name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v5
+ uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
with:
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
- name: "⚙️ Run post-release"