Skip to content

Conversation

@kou
Copy link
Member

@kou kou commented Dec 4, 2025

Rationale for this change

Dependabot sometimes failed to update hash.
For example: #48301

The ASF GitHub Actions policy doesn't requiring pinning actions/* actions:

https://infra.apache.org/github-actions-policy.html

External actions

You MAY use all actions internal to the apache/*, github/* and actions/* namespaces without restrictions.

You MUST pin all external actions to the specific git hash (SHA1) of the action that has been reviewed for use by the project. For instance, you MUST pin foobar/baz-action@8843d7f92416211de9ebb963ff4ce28125932878.

We can avoid the Dependabot behavior by removing hash from actions/* actions.

What changes are included in this PR?

  • Remove hash from actions/* actions.
  • Use @vX instead of @vX.Y.Z to reduce Dependabot updates.

Are these changes tested?

Yes.

Are there any user-facing changes?

No.

@github-actions
Copy link

github-actions bot commented Dec 4, 2025

⚠️ GitHub issue #48326 has been automatically assigned in GitHub to PR creator.

@github-actions github-actions bot added the awaiting committer review Awaiting committer review label Dec 4, 2025
@github-actions github-actions bot added awaiting merge Awaiting merge and removed awaiting committer review Awaiting committer review labels Dec 4, 2025
@raulcd raulcd merged commit f7159f2 into apache:main Dec 5, 2025
71 of 84 checks passed
@raulcd raulcd removed the awaiting merge Awaiting merge label Dec 5, 2025
@kou kou deleted the ci-actions-no-hash branch December 5, 2025 14:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants