Backport workflow-hardening fix (unpinned-uses) to 5 release branches

Aperta Adatta ai principianti
  • Qualcosa non va?
#19,634 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
82/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Tranquilla
Stack tecnologico
github-actions, yaml
Ambito
ci-cd, security

Direzione di ricerca

Ispeziona .github/workflows/revised-its.yml nei rami di release 33.0.0, 34.0.0, 32.0.1, 31.0.2 e 32.0.0, iniziando dal passaggio di filtro e dal commit del ramo predefinito f3fe1773ee275007df68bc31c2131c68ed906045. Applica le modifiche di pinning elencate per ciascun ramo, quindi esegui zizmor e actionlint; il lavoro è completato quando i finding relativi a unpinned-uses sono stati eliminati senza introdurre nuovi finding.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

The default branch already hardened .github/workflows/revised-its.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)
  • unpinned-uses — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:

Affected release branches (5)
  • 33.0.0 (still present as of HEAD a3135039)
  • 34.0.0 (still present as of HEAD caa27688)
  • 32.0.1 (still present as of HEAD d40b81fe)
  • 31.0.2 (still present as of HEAD bdd298e9)
  • 32.0.0 (still present as of HEAD 10542a76)
Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

33.0.0 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:
34.0.0 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:
32.0.1 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:
31.0.2 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:
32.0.0 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:

Happy to open pull requests instead if that's preferred.

Lingua principale
Java
Stelle
14.1k
Fork
3.8k
Merge medio
2g 4h
PR unite (30g)
250

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di apache/druid

Tutte le issue di apache/druid

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.