Backport workflow-hardening fix (unpinned-uses) to 5 release branches

Abierto Apto para principiantes
  • ¿Algo no está bien?
#19,634 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
82/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Tranquilo
Stack tecnológico
github-actions, yaml
Área
ci-cd, security

Línea de trabajo

Inspecciona .github/workflows/revised-its.yml en las ramas de release 33.0.0, 34.0.0, 32.0.1, 31.0.2 y 32.0.0, empezando por el paso de filtrado y el commit de la rama predeterminada f3fe1773ee275007df68bc31c2131c68ed906045. Aplica los cambios de pinning indicados para cada rama y luego ejecuta zizmor y actionlint; se considera terminado cuando se hayan eliminado los hallazgos de unpinned-uses sin introducir nuevos hallazgos.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

The default branch already hardened .github/workflows/revised-its.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)
  • unpinned-uses — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:

Affected release branches (5)
  • 33.0.0 (still present as of HEAD a3135039)
  • 34.0.0 (still present as of HEAD caa27688)
  • 32.0.1 (still present as of HEAD d40b81fe)
  • 31.0.2 (still present as of HEAD bdd298e9)
  • 32.0.0 (still present as of HEAD 10542a76)
Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

33.0.0 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:
34.0.0 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:
32.0.1 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:
31.0.2 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:
32.0.0 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:

Happy to open pull requests instead if that's preferred.

Lenguaje dominante
Java
Estrellas
14.1k
Forks
3.8k
Merge medio
2 d 6 h
PR fusionados (30 d)
234

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de apache/druid

Todos los issues de apache/druid

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.