Skip to content

Conversation

@jbonofre
Copy link
Member

@jbonofre jbonofre commented Mar 4, 2025

Upgrade to GitHub actions/cache 4.2.2 as previous versions are deprecated.

@github-actions

This comment has been minimized.

Copy link
Member

@assignUser assignUser left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

-0.5
It is best practice to pin actions to SHA in workflows that run in an elevated context (i.e. not pull_request) and use secrets or have elevated permissions (anything not contents:read). So at least for those I would stick with pinned actions.

I also don't see the downside of pinning things, as I have seen actions/* break on minor updates in the past. Except maybe the work to merge dependabot PRs.

Also to be pedantic this touches more than 2 files which means it's not a minor PR ;

@jbonofre
Copy link
Member Author

jbonofre commented Mar 4, 2025

@assignUser ok. Fair enough. Let me update this PR to fix the cache version which is deprecated (and blocking all PRs right now).

@assignUser
Copy link
Member

Ah I see the deprecation for anything <4.2. I forgot about that, IIRC they wanted to do that last year but pushed it out after some backlash. Somehow the dependabot PR must have been closed which makes it ignore that version. Though I can't find one in the PRs... hm, maybe broken through the transition or something.

@lidavidm
Copy link
Member

lidavidm commented Mar 4, 2025

FWIW, Dependabot appears to understand the pinning convention, so at least it shouldn't be extra work to maintain it (e.g. #635)

@assignUser
Copy link
Member

FWIW, Dependabot appears to understand the pinning convention, so at least it shouldn't be extra work to maintain it (e.g. #635)

Yeah, otherwise it would be a real drain...

@jbonofre jbonofre force-pushed the github-action-version-fix branch from d80e435 to b19d5b0 Compare March 4, 2025 13:38
@jbonofre jbonofre changed the title MINOR: Use the GitHub Action version alias MINOR: Upgrade to GitHub actions/cache 4.2.2 Mar 4, 2025
@jbonofre
Copy link
Member Author

jbonofre commented Mar 4, 2025

@assignUser @lidavidm I updated this PR to upgrade to GitHub actions/cache 4.2.2 (using the SHA1).

@lidavidm lidavidm merged commit 26e14f0 into apache:main Mar 4, 2025
28 checks passed
@lidavidm lidavidm added this to the 18.3.0 milestone Mar 6, 2025
@lidavidm lidavidm removed the enhancement PRs that add or improve features. label Mar 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

chore PRs that make misc changes.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants