Backport workflow-hardening fix (unpinned-uses) to 5 release branches

オープン 初心者向け
  • 何か問題がありますか？
#19,634 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 2 日以内に返信

まだ誰も着手していません。

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
82/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
静か
技術スタック
github-actions, yaml
領域
ci-cd, security

調査の方向性

.github/workflows/revised-its.yml をリリースブランチ 33.0.0、34.0.0、32.0.1、31.0.2、32.0.0 で調査し、まずフィルターステップとデフォルトブランチのコミット f3fe1773ee275007df68bc31c2131c68ed906045 を確認します。ブランチごとに記載された pinning の変更を適用してから、zizmor と actionlint を実行します。unpinned-uses の指摘が解消され、新たな指摘が発生していなければ完了です。

索引モデルが issue の本文から書いたものです。

説明

Summary

The default branch already hardened .github/workflows/revised-its.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)
  • unpinned-uses — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:

Affected release branches (5)
  • 33.0.0 (still present as of HEAD a3135039)
  • 34.0.0 (still present as of HEAD caa27688)
  • 32.0.1 (still present as of HEAD d40b81fe)
  • 31.0.2 (still present as of HEAD bdd298e9)
  • 32.0.0 (still present as of HEAD 10542a76)
Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

33.0.0 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:
34.0.0 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:
32.0.1 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:
31.0.2 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:
32.0.0 — unpinned-uses

File .github/workflows/revised-its.yml; suggested edits:

  • ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA)
--- a/.github/workflows/revised-its.yml
+++ b/.github/workflows/revised-its.yml
@@ -51,7 +51,7 @@
       # the common extension in revised ITs is different from the one in standard ITs
       common-extensions: ${{ steps.filter.outputs.common-extensions }}
     steps:
-      - uses: dorny/[email protected]
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd  # v3.0.0
         if: github.event_name == 'pull_request'
         id: filter
         with:

Happy to open pull requests instead if that's preferred.

主要言語
Java
スター
14.1k
フォーク
3.8k
平均マージ
2日 6時間
マージ済み PR（30日）
234

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

apache/druid のほかの issue

apache/druid の issue をすべて見る

似ている issue

Java の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。