Jens-G commented on code in PR #3893:
URL: https://github.com/apache/thrift/pull/3893#discussion_r4057270614
##########
.github/workflows/cmake.yml:
##########
@@ -69,3 +69,69 @@ jobs:
name: cmake-LastTest-log
path: cmake_build/Testing/Temporary/LastTest.log
if-no-files-found: warn
+
+ compiler-windows:
+ runs-on: windows-2025
+ timeout-minutes: 60
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
Review Comment:
Done — good catch, and thanks for the review.
Added `# v7.0.1` here, and also to the `actions/checkout` in the existing
`compiler` job just above: it was the only other unannotated pin in the file,
and leaving exactly one uncommented next to a commented one seemed worse than
touching a line that is not strictly mine. Shout if you would rather I left it
alone.
I verified the SHA resolves to `v7.0.1` against the tags API rather than
trusting the comment I was copying.
Related: the security scanner caught two genuinely *wrong* version comments
of mine on #3896 (`setup-dotnet` was v6.0.0 not v5.0.0, `NuGet/login` v1.2.0
not v1.0.0) — both fixed there. My local zizmor had reported clean because it
defaults to offline mode, where `ref-version-mismatch` cannot resolve tags and
never fires. With a token it is clean across all five workflows in this stack
now.
Still unannotated elsewhere, but outside this change so I left them:
`docker.yml` (two `checkout`, one `setup-go`) and `msvc.yml` (one `checkout`).
Happy to send a separate PR for those if you want them tidied.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
