P-Peaceful opened a new pull request, #4089: URL: https://github.com/apache/hertzbeat/pull/4089
## Related PR PR: #4088 ## What's changed? <!-- Describe Your PR Here --> ASF policy requires all third-party GitHub Actions to be pinned to a commit SHA and approved via the ASF infrastructure allowlist. This change aligns the workflow with the approved patterns defined in: https://github.com/apache/infrastructure-actions ``` yaml docker/build-push-action: d08e5c354a6adb9ed34480a06d141179aa583294: tag: v7.0.0 graalvm/setup-graalvm: f744c72a42b1995d7b0cbc314bde4bace7ac1fe1: tag: v1.5.0 DavidAnson/markdownlint-cli2-action: 07035fd053f7be764496c0f8d8f9f41f98305101: tag: v22.0.0 docker/setup-qemu-action: ce360397dd3f832beb865e1373c09c0e9f86d70a: tag: v4.0.0 docker/setup-buildx-action: 4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd: tag: v4.0.0 docker/login-action: b45d80f862d83dbcd57f89517bcf500b2ab88fb2: tag: v4.0.0 ``` ## Future Work ASF infrastructure is introducing mechanisms for managing and validating GitHub Actions versions (e.g., Dependabot integration and allowlist checks): https://github.com/apache/infrastructure-actions/pull/486 After this PR is merged, we can consider aligning with the ASF-recommended approach by: - Enabling Dependabot for GitHub Actions updates - Adding pre-check validation to ensure action SHAs are in the ASF allowlist This PR focuses only on bringing the current workflows into compliance. ## Checklist - [x] I have read the [Contributing Guide](https://hertzbeat.apache.org/docs/community/code_style_and_quality_guide) - [ ] I have written the necessary doc or comment. - [ ] I have added the necessary unit tests and all cases have passed. ## Add or update API - [ ] I have added the necessary [e2e tests](https://github.com/apache/hertzbeat/tree/master/e2e) and all cases have passed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
