adoroszlai opened a new pull request, #11456:
URL: https://github.com/apache/ozone/pull/11456
## What changes were proposed in this pull request?
> The [GitHub Actions Policy](github-actions-policy.html) requires a
specific git hash only for **external** actions; actions in the `apache/*`,
`github/*` and `actions/*` namespaces may be used without that restriction.
Pinning those to a major version tag rather than to a hash lets a patch or
minor release arrive without a pull request, which removes a large share of the
Dependabot traffic a project sees. External actions still **MUST** be pinned to
a specific git hash.
- This PR updates workflows to pin `actions/*` by major version instead of
SHA, as recommended by Apache Infra above.
- `github/*` actions are not used here.
- `apache/*` actions currently [do not
have](https://github.com/apache/infrastructure-actions/issues/1372) up-to-date
major version tag.
- Configure zizmor to allow such pinning.
- Make sure zizmor workflow is triggered by changes in zizmor config.
https://issues.apache.org/jira/browse/HDDS-16816
## How was this patch tested?
CI: https://github.com/adoroszlai/ozone/actions/runs/37925275778
zizmor: https://github.com/adoroszlai/ozone/actions/runs/37925274764
asf-allowlist-check:
https://github.com/adoroszlai/ozone/actions/runs/37925274759
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
