From 1170329f34d2d245e96c20900e97a364ed12edd7 Mon Sep 17 00:00:00 2001 From: James Fredley Date: Thu, 28 May 2026 14:58:43 -0400 Subject: [PATCH 1/2] ci: audit and update GitHub Actions to ASF-approved versions Migrate setup-gradle off the v5.0.0/v5.0.2 SHAs (the v5.0.0 SHA was never on the ASF allow-list and v5.0.2 expires from it on 2026-06-20) to the approved v6.1.0 SHA, adding cache-provider basic so caching stays on the MIT-licensed provider instead of the proprietary enhanced provider introduced in v6 (governed by Gradle's commercial Terms of Use). Each cache-provider line carries an inline comment documenting the distinction. Bring every other action up to its current ASF-approved version: - actions/checkout to v6.0.2 - actions/setup-java standardized to v5.2.0 - actions/cache to v5.0.5 - actions/download-artifact to v8.0.1 (compatible with upload-artifact v7.0.1) - github/codeql-action to v4.36.0 - release-drafter to the v7.3.1 SHA - softprops/action-gh-release to the v3.0.0 SHA - nick-fields/retry to the v4.0.0 SHA - actions/upload-artifact SHA-pinned to v7.0.1 consistently across all workflows Apply the same setup-gradle and checkout/setup-java updates to the grails-forge GitHub workflow templates so generated applications also default to the MIT-licensed cache provider, and extend PlainGithubWorkflowSpec to assert the generated content. Assisted-by: claude-code:claude-4.7-opus --- .github/workflows/codeql.yml | 10 +- .github/workflows/codestyle.yml | 27 +++-- .github/workflows/forge-deploy-next.yml | 21 ++-- .../workflows/forge-deploy-prev-snapshot.yml | 21 ++-- .github/workflows/forge-deploy-prev.yml | 21 ++-- .github/workflows/forge-deploy-release.yml | 21 ++-- .github/workflows/forge-deploy-snapshot.yml | 21 ++-- .github/workflows/gradle.yml | 110 ++++++++++-------- .github/workflows/groovy-joint-workflow.yml | 18 +-- .github/workflows/rat.yml | 7 +- .github/workflows/release-close.yml | 2 +- .github/workflows/release-notes.yml | 2 +- .github/workflows/release-publish-docs.yml | 7 +- .github/workflows/release.yml | 39 ++++--- .../templates/plainGithubWorkflow.rocker.raw | 18 +-- .../workflows/templates/javaSetup.rocker.raw | 4 +- .../workflows/PlainGithubWorkflowSpec.groovy | 2 + 17 files changed, 196 insertions(+), 155 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f93d30edfff..2c9f9d42a1f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -56,15 +56,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: 17 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@v4.36.0 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -75,7 +75,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@v4.36.0 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -89,4 +89,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@v4.36.0 diff --git a/.github/workflows/codestyle.yml b/.github/workflows/codestyle.yml index e077a4483f1..620c656d0d0 100644 --- a/.github/workflows/codestyle.yml +++ b/.github/workflows/codestyle.yml @@ -32,21 +32,22 @@ jobs: - name: "🌐 Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: 17 - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔎 Check Core Projects" run: ./gradlew codeStyle - name: "📤 Upload Failure Reports" if: always() - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: core-reports path: build/reports/codestyle/ @@ -69,22 +70,23 @@ jobs: - name: "🌐 Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: 17 - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔎 Check Gradle Plugin Projects" working-directory: grails-gradle run: ./gradlew codeStyle - name: "📤 Upload Failure Reports" if: always() - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: gradle-plugin-reports path: grails-gradle/build/reports/codestyle/ @@ -107,22 +109,23 @@ jobs: - name: "🌐 Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: 17 - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔎 Check Forge Projects" working-directory: grails-forge run: ./gradlew codeStyle - name: "📤 Upload Failure Reports" if: always() - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: forge-reports path: grails-forge/build/reports/codestyle/ diff --git a/.github/workflows/forge-deploy-next.yml b/.github/workflows/forge-deploy-next.yml index b21df5e9dd5..66bef33ba3f 100644 --- a/.github/workflows/forge-deploy-next.yml +++ b/.github/workflows/forge-deploy-next.yml @@ -22,15 +22,16 @@ jobs: runs-on: ubuntu-24.04 steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -47,15 +48,16 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}:next steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -108,15 +110,16 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}-analytics:next steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 diff --git a/.github/workflows/forge-deploy-prev-snapshot.yml b/.github/workflows/forge-deploy-prev-snapshot.yml index 42d9ca44117..ce837c517f0 100644 --- a/.github/workflows/forge-deploy-prev-snapshot.yml +++ b/.github/workflows/forge-deploy-prev-snapshot.yml @@ -22,15 +22,16 @@ jobs: runs-on: ubuntu-24.04 steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -47,15 +48,16 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}:prev-snapshot steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -108,15 +110,16 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}-analytics:prev-snapshot steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 diff --git a/.github/workflows/forge-deploy-prev.yml b/.github/workflows/forge-deploy-prev.yml index 2c7e1f9399f..031b2476b44 100644 --- a/.github/workflows/forge-deploy-prev.yml +++ b/.github/workflows/forge-deploy-prev.yml @@ -22,15 +22,16 @@ jobs: runs-on: ubuntu-24.04 steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -47,15 +48,16 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}:prev steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -108,15 +110,16 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}-analytics:prev steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 diff --git a/.github/workflows/forge-deploy-release.yml b/.github/workflows/forge-deploy-release.yml index 89d85cfd250..9c8c14646d9 100644 --- a/.github/workflows/forge-deploy-release.yml +++ b/.github/workflows/forge-deploy-release.yml @@ -28,15 +28,16 @@ jobs: release_version: ${{ github.event.inputs.release }} steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -51,15 +52,16 @@ jobs: needs: build steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -110,15 +112,16 @@ jobs: needs: build steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 diff --git a/.github/workflows/forge-deploy-snapshot.yml b/.github/workflows/forge-deploy-snapshot.yml index 0b39544a78b..7db805b1f7b 100644 --- a/.github/workflows/forge-deploy-snapshot.yml +++ b/.github/workflows/forge-deploy-snapshot.yml @@ -22,15 +22,16 @@ jobs: runs-on: ubuntu-24.04 steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -47,15 +48,16 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}:snapshot steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -106,15 +108,16 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}-analytics:snapshot steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: '17' - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml index 30e0138267c..f813e011249 100644 --- a/.github/workflows/gradle.yml +++ b/.github/workflows/gradle.yml @@ -30,15 +30,16 @@ jobs: runs-on: ubuntu-24.04 steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: 17 - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }} - name: "🔍 Validate grails-core dependency versions" run: > @@ -62,15 +63,16 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: ${{ matrix.java }} - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -114,15 +116,16 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: ${{ matrix.java }} - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -147,15 +150,16 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: ${{ matrix.java }} - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -178,15 +182,16 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: 'liberica' java-version: ${{ matrix.java }} - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -218,7 +223,7 @@ jobs: ./tmp1/cli/bin/grails-forge-cli --version - name: "📤 Upload CLI Zip to Workflow Summary Page" if: ${{ matrix.java == '17' }} - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: 'apache-grails-SNAPSHOT-bin.zip' include-hidden-files: true @@ -236,15 +241,16 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: ${{ matrix.java }} - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -272,15 +278,16 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout the repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: ${{ matrix.java }} - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🏃 Run Functional Tests" env: @@ -305,15 +312,16 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout the repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: ${{ matrix.java }} - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🏃 Run Functional Tests" env: @@ -333,15 +341,16 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: 17 - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -357,12 +366,12 @@ jobs: --no-build-cache --rerun-tasks - name: "📤 Upload grails-gradle checksums" - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: grails-gradle-checksums path: grails-gradle/build/grails-gradle-checksums.txt - name: "📤 Upload grails-gradle published artifacts" - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: grails-gradle-artifacts.txt path: grails-gradle/build/grails-gradle-artifacts.txt @@ -383,20 +392,21 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: 17 - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 - name: "📤 Publish Grails-Core Snapshot Artifacts" - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2 + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0 env: GRAILS_PUBLISH_RELEASE: 'false' MAVEN_PUBLISH_URL: ${{ secrets.GRAILS_NEXUS_PUBLISH_SNAPSHOT_URL }} @@ -408,12 +418,12 @@ jobs: retry_wait_seconds: 180 command: ./gradlew publish aggregateChecksums aggregatePublishedArtifacts --no-build-cache --rerun-tasks - name: "📤 Upload grails-core checksums" - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: grails-core-checksums.txt path: build/grails-core-checksums.txt - name: "📤 Upload grails-core published artifacts" - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: grails-core-artifacts.txt path: build/grails-core-artifacts.txt @@ -425,7 +435,7 @@ jobs: unzip wrapper -d tmp mv tmp/apache-grails-wrapper-* tmp/wrapper - name: "📤 Upload Wrapper Zip to Workflow Summary Page" - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: apache-grails-wrapper-SNAPSHOT-bin path: build/tmp/wrapper @@ -437,15 +447,16 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: 17 - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -461,12 +472,12 @@ jobs: --no-build-cache --rerun-tasks - name: "📤 Upload grails-forge checksums" - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: grails-forge-checksums path: grails-forge/build/grails-forge-checksums.txt - name: "📤 Upload grails-gradle published artifacts" - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: grails-forge-artifacts.txt path: grails-forge/build/grails-forge-artifacts.txt @@ -481,14 +492,14 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: 17 - name: "đŸ“Ĩ Download Wrapper" - uses: actions/download-artifact@v7.0.0 + uses: actions/download-artifact@v8.0.1 with: name: apache-grails-wrapper-SNAPSHOT-bin path: wrapper @@ -524,7 +535,7 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout the repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 with: fetch-tags: true - name: "🔀 Store current branch name" @@ -538,20 +549,21 @@ jobs: echo "NOW=${NOW}" >> $GITHUB_ENV echo "Current date: ${NOW}" - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: 17 - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔨 Build Snapshot Documentation" run: > ./gradlew grails-doc:build -PgithubBranch=${{ env.TARGET_BRANCH }} - name: "📤 Upload Generated Docs to Workflow Result Page" - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: grails-docs-${{ env.NOW }}.zip path: ./build/distributions/*.zip diff --git a/.github/workflows/groovy-joint-workflow.yml b/.github/workflows/groovy-joint-workflow.yml index 7d79648002f..56a48b1f47f 100644 --- a/.github/workflows/groovy-joint-workflow.yml +++ b/.github/workflows/groovy-joint-workflow.yml @@ -36,17 +36,17 @@ jobs: groovyVersion: ${{ steps.groovy-version.outputs.value }} steps: - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: java-version: 17 distribution: liberica - name: "🗄ī¸ Cache local Maven repository" - uses: actions/cache@v5 + uses: actions/cache@v5.0.5 with: path: ~/.m2/repository key: cache-local-maven-${{ github.sha }} - name: "đŸ“Ĩ Checkout Grails Core to fetch Gradle Plugin versions it uses" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 with: sparse-checkout-cone-mode: false sparse-checkout: settings.gradle @@ -63,8 +63,9 @@ jobs: - name: "đŸ“Ĩ Checkout Groovy 4_0_X (Grails 7 and later)" run: git clone --depth 1 https://github.com/apache/groovy.git -b GROOVY_4_0_X --single-branch - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 @@ -139,20 +140,21 @@ jobs: --health-retries 5 steps: - name: "đŸ“Ĩ Checkout project" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: java-version: 17 distribution: liberica - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 - name: "🗄ī¸ Restore local Maven repository from cache" - uses: actions/cache@v5 + uses: actions/cache@v5.0.5 with: path: ~/.m2/repository key: cache-local-maven-${{ github.sha }} diff --git a/.github/workflows/rat.yml b/.github/workflows/rat.yml index c9ccdaa8c27..0fd43978b56 100644 --- a/.github/workflows/rat.yml +++ b/.github/workflows/rat.yml @@ -35,15 +35,16 @@ jobs: runs-on: ubuntu-latest steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v4 + uses: actions/setup-java@v5.2.0 with: distribution: liberica java-version: 17 - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" uses: testlens-app/setup-testlens@v1 diff --git a/.github/workflows/release-close.yml b/.github/workflows/release-close.yml index 65d96e54e95..b47804ce77e 100644 --- a/.github/workflows/release-close.yml +++ b/.github/workflows/release-close.yml @@ -40,7 +40,7 @@ jobs: actions: write # in case there are pending changes to release.yml in the target branch steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 with: ref: ${{ env.TAG }} token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release-notes.yml b/.github/workflows/release-notes.yml index 6490a5d9b17..cd1ac77bddd 100644 --- a/.github/workflows/release-notes.yml +++ b/.github/workflows/release-notes.yml @@ -44,7 +44,7 @@ jobs: echo "range=~${BRANCH%.x}.0" >> "$GITHUB_OUTPUT" fi - name: "📝 Update Release Draft" - uses: release-drafter/release-drafter@v7 + uses: release-drafter/release-drafter@e1247478eabc9f6d9cf5ec2b3547469b0e1d2767 # v7.3.1 continue-on-error: true with: commitish: ${{ github.event.pull_request.base.ref || github.ref_name }} diff --git a/.github/workflows/release-publish-docs.yml b/.github/workflows/release-publish-docs.yml index e724ab12d2f..8457fc13cc8 100644 --- a/.github/workflows/release-publish-docs.yml +++ b/.github/workflows/release-publish-docs.yml @@ -49,7 +49,7 @@ jobs: - name: "📝 Store release version" run: echo "VERSION=${VERSION}" >> "$GITHUB_ENV" - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 # needed for docs release dropdown, (fetch-tags: true with fetch-depth: 1 does not work; https://github.com/actions/checkout/issues/1471) filter: tree:0 # limit size, keeping tags for docs release dropdown @@ -58,13 +58,14 @@ jobs: - name: "📅 Ensure Common Build Date" # to ensure a reproducible build run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV" - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5 + uses: actions/setup-java@v5.2.0 with: distribution: ${{ env.JAVA_DISTRIBUTION }} java-version: ${{ env.JAVA_VERSION }} - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "📖 Generate Documentation" run: ./gradlew grails-doc:build -PgithubBranch=${TARGET_BRANCH} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 53158bc6ea7..f215be783be 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -59,7 +59,7 @@ jobs: current_limit=$(gh api rate_limit --jq '.resources.graphql') echo "Current Rate Limit: $current_limit" - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 # needed for docs release dropdown, (fetch-tags: true with fetch-depth: 1 does not work; https://github.com/actions/checkout/issues/1471) filter: tree:0 # limit size, keeping tags for docs release dropdown @@ -76,13 +76,14 @@ jobs: echo "${GPG_KEY}" | gpg --batch --import gpg --list-keys - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5 + uses: actions/setup-java@v5.2.0 with: distribution: ${{ env.JAVA_DISTRIBUTION }} java-version: ${{ env.JAVA_VERSION }} - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "⚙ī¸ Run pre-release" uses: apache/grails-github-actions/pre-release@asf @@ -116,7 +117,7 @@ jobs: echo "Generated checksum for grails wrapper ZIP:" cat ${DIST_NAME}-wrapper-${VERSION}-bin.zip.sha512 - name: "📤 Upload grails-wrapper ZIP" - uses: softprops/action-gh-release@v2.6.1 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 with: tag_name: ${{ env.TAG }} files: | @@ -141,7 +142,7 @@ jobs: echo "Generated checksum for grails cli ZIP:" cat ${DIST_NAME}-${VERSION}-bin.zip.sha512 - name: "📤 Upload grails-cli ZIP" - uses: softprops/action-gh-release@v2.6.1 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 with: tag_name: ${{ env.TAG }} files: | @@ -230,7 +231,7 @@ jobs: - name: "📅 Generate build date file" run: echo "$SOURCE_DATE_EPOCH" >> build/BUILD_DATE.txt - name: "📤 Upload build date, checksums and published artifact files" - uses: softprops/action-gh-release@v2.6.1 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 with: tag_name: ${{ env.TAG }} files: | @@ -253,7 +254,7 @@ jobs: current_limit=$(gh api rate_limit --jq '.resources.graphql') echo "Current Rate Limit: $current_limit" - name: "đŸ“Ĩ Checkout Grails Core repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 with: path: grails ref: ${{ env.TAG }} @@ -322,7 +323,7 @@ jobs: - name: "đŸ“Ļ Create source distribution checksum" run: sha512sum ${DIST_NAME}-${VERSION}-src.zip > ${DIST_NAME}-${VERSION}-src.zip.sha512 - name: "🚀 Upload ZIP and Signature to GitHub Release" - uses: softprops/action-gh-release@v2.6.1 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 with: tag_name: ${{ env.TAG }} files: | @@ -449,12 +450,12 @@ jobs: cd dev-repo svn info ${VERSION} > DIST_SVN_REVISION.txt - name: "📤 Upload Distribution SVN revision" - uses: softprops/action-gh-release@v2.6.1 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 with: tag_name: ${{ env.TAG }} files: dev-repo/DIST_SVN_REVISION.txt - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 with: path: ${{ env.REPO_NAME }} ref: ${{ env.TAG }} @@ -505,7 +506,7 @@ jobs: current_limit=$(gh api rate_limit --jq '.resources.graphql') echo "Current Rate Limit: $current_limit" - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 with: ref: ${{ env.TAG }} - name: "🛠ī¸ī¸ Install tools" @@ -592,7 +593,7 @@ jobs: df -h - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 # needed for docs release dropdown, (fetch-tags: true with fetch-depth: 1 does not work; https://github.com/actions/checkout/issues/1471) filter: tree:0 # limit size, keeping tags for docs release dropdown @@ -601,13 +602,14 @@ jobs: - name: "📅 Ensure Common Build Date" # to ensure a reproducible build run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV" - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5 + uses: actions/setup-java@v5.2.0 with: distribution: ${{ env.JAVA_DISTRIBUTION }} java-version: ${{ env.JAVA_VERSION }} - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "📖 Generate Documentation" run: ./gradlew grails-doc:build -PgithubBranch=${TARGET_BRANCH} @@ -635,17 +637,18 @@ jobs: current_limit=$(gh api rate_limit --jq '.resources.graphql') echo "Current Rate Limit: $current_limit" - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 with: ref: ${{ env.TAG }} - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5 + uses: actions/setup-java@v5.2.0 with: distribution: ${{ env.JAVA_DISTRIBUTION }} java-version: ${{ env.JAVA_VERSION }} - name: "🐘 Setup Gradle" - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: + cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🚀 Grails SDK Minor Release" if: contains(env.VERSION, 'M') || contains(env.VERSION, 'RC') @@ -681,7 +684,7 @@ jobs: current_limit=$(gh api rate_limit --jq '.resources.graphql') echo "Current Rate Limit: $current_limit" - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@v6.0.2 with: ref: ${{ env.TAG }} token: ${{ secrets.GITHUB_TOKEN }} diff --git a/grails-forge/grails-forge-core/src/main/java/org/grails/forge/feature/github/workflows/plain/templates/plainGithubWorkflow.rocker.raw b/grails-forge/grails-forge-core/src/main/java/org/grails/forge/feature/github/workflows/plain/templates/plainGithubWorkflow.rocker.raw index cd7ae7b53ed..fdd0c988087 100644 --- a/grails-forge/grails-forge-core/src/main/java/org/grails/forge/feature/github/workflows/plain/templates/plainGithubWorkflow.rocker.raw +++ b/grails-forge/grails-forge-core/src/main/java/org/grails/forge/feature/github/workflows/plain/templates/plainGithubWorkflow.rocker.raw @@ -37,14 +37,16 @@ jobs: steps: @javaSetup.template(jdkVersion) - name: Setup Gradle - uses: gradle/actions/setup-gradle@@v4 - # Uncomment the build-scan parameters if you want to publish a Gradle build scan - # in order to see all the build logs, a complete task timeline, test outputs, - # and the resolved dependencies of your build. - # with: - # build-scan-publish: true - # build-scan-terms-of-use-url: "https://gradle.com/terms-of-service" - # build-scan-terms-of-use-agree: "yes" + uses: gradle/actions/setup-gradle@@v6.1.0 + with: + # 'basic' is the MIT-licensed cache provider; the default 'enhanced' provider is proprietary (Gradle commercial Terms of Use) + cache-provider: basic + # Uncomment the build-scan parameters if you want to publish a Gradle build scan + # in order to see all the build logs, a complete task timeline, test outputs, + # and the resolved dependencies of your build. + # build-scan-publish: true + # build-scan-terms-of-use-url: "https://gradle.com/terms-of-service" + # build-scan-terms-of-use-agree: "yes" - name: Run Tests if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' id: tests diff --git a/grails-forge/grails-forge-core/src/main/java/org/grails/forge/feature/github/workflows/templates/javaSetup.rocker.raw b/grails-forge/grails-forge-core/src/main/java/org/grails/forge/feature/github/workflows/templates/javaSetup.rocker.raw index 5c90efdea63..953e41d55b6 100644 --- a/grails-forge/grails-forge-core/src/main/java/org/grails/forge/feature/github/workflows/templates/javaSetup.rocker.raw +++ b/grails-forge/grails-forge-core/src/main/java/org/grails/forge/feature/github/workflows/templates/javaSetup.rocker.raw @@ -24,9 +24,9 @@ under the License. JdkVersion jdkVersion ) - - uses: actions/checkout@@v4 + - uses: actions/checkout@@v6.0.2 - name: Set up JDK @jdkVersion.majorVersion() - uses: actions/setup-java@@v4 + uses: actions/setup-java@@v5.2.0 with: distribution: 'liberica' java-version: @jdkVersion.majorVersion() diff --git a/grails-forge/grails-forge-core/src/test/groovy/org/grails/forge/feature/github/workflows/PlainGithubWorkflowSpec.groovy b/grails-forge/grails-forge-core/src/test/groovy/org/grails/forge/feature/github/workflows/PlainGithubWorkflowSpec.groovy index d153e648c9a..6145b860e53 100644 --- a/grails-forge/grails-forge-core/src/test/groovy/org/grails/forge/feature/github/workflows/PlainGithubWorkflowSpec.groovy +++ b/grails-forge/grails-forge-core/src/test/groovy/org/grails/forge/feature/github/workflows/PlainGithubWorkflowSpec.groovy @@ -43,6 +43,8 @@ class PlainGithubWorkflowSpec extends BeanContextSpec implements CommandOutputFi then: workflow workflow.contains("name: Java CI") + workflow.contains("gradle/actions/setup-gradle@v6.1.0") + workflow.contains("cache-provider: basic") where: buildTool | workflowName From f0c5ae4256bb3d64552a20885c687d2cae109a71 Mon Sep 17 00:00:00 2001 From: James Fredley Date: Thu, 28 May 2026 15:14:10 -0400 Subject: [PATCH 2/2] ci: SHA-pin all external GitHub Actions with version comments For consistency and supply-chain safety, pin every third-party action to a full commit SHA with a trailing comment naming the version it resolves to, so the whole workflow set is uniform (some actions were already SHA-pinned, others were on tags). - actions/checkout -> de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - actions/setup-java -> be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 - actions/cache -> 27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 - actions/download-artifact -> 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - github/codeql-action (init/autobuild/analyze) -> 7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 - testlens-app/setup-testlens -> d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 Actions under the apache/* namespace remain on the @asf branch ref, which is the intended reference for our own first-party actions. Also restore the env: key indentation on the snapshot publish step in gradle.yml to align with its sibling keys. Assisted-by: claude-code:claude-4.7-opus --- .github/workflows/codeql.yml | 10 +-- .github/workflows/codestyle.yml | 12 ++-- .github/workflows/forge-deploy-next.yml | 18 ++--- .../workflows/forge-deploy-prev-snapshot.yml | 18 ++--- .github/workflows/forge-deploy-prev.yml | 18 ++--- .github/workflows/forge-deploy-release.yml | 18 ++--- .github/workflows/forge-deploy-snapshot.yml | 18 ++--- .github/workflows/gradle.yml | 72 +++++++++---------- .github/workflows/groovy-joint-workflow.yml | 16 ++--- .github/workflows/rat.yml | 6 +- .github/workflows/release-close.yml | 2 +- .github/workflows/release-publish-docs.yml | 4 +- .github/workflows/release.yml | 20 +++--- 13 files changed, 116 insertions(+), 116 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2c9f9d42a1f..230fe7e8ea1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -56,15 +56,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: 17 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4.36.0 + uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -75,7 +75,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v4.36.0 + uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -89,4 +89,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.36.0 + uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 diff --git a/.github/workflows/codestyle.yml b/.github/workflows/codestyle.yml index 620c656d0d0..a9961fb7b21 100644 --- a/.github/workflows/codestyle.yml +++ b/.github/workflows/codestyle.yml @@ -32,9 +32,9 @@ jobs: - name: "🌐 Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: 17 @@ -70,9 +70,9 @@ jobs: - name: "🌐 Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: 17 @@ -109,9 +109,9 @@ jobs: - name: "🌐 Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: 17 diff --git a/.github/workflows/forge-deploy-next.yml b/.github/workflows/forge-deploy-next.yml index 66bef33ba3f..a2926407639 100644 --- a/.github/workflows/forge-deploy-next.yml +++ b/.github/workflows/forge-deploy-next.yml @@ -22,9 +22,9 @@ jobs: runs-on: ubuntu-24.04 steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -34,7 +34,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔨 Build" working-directory: grails-forge run: ./gradlew build @@ -48,9 +48,9 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}:next steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -60,7 +60,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔑 Login to Google Cloud" uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: @@ -110,9 +110,9 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}-analytics:next steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -122,7 +122,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔑 Login to Google Cloud" uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: diff --git a/.github/workflows/forge-deploy-prev-snapshot.yml b/.github/workflows/forge-deploy-prev-snapshot.yml index ce837c517f0..2c5243dab0e 100644 --- a/.github/workflows/forge-deploy-prev-snapshot.yml +++ b/.github/workflows/forge-deploy-prev-snapshot.yml @@ -22,9 +22,9 @@ jobs: runs-on: ubuntu-24.04 steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -34,7 +34,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔨 Build" working-directory: grails-forge run: ./gradlew build @@ -48,9 +48,9 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}:prev-snapshot steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -60,7 +60,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔑 Login to Google Cloud" uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: @@ -110,9 +110,9 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}-analytics:prev-snapshot steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -122,7 +122,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔑 Login to Google Cloud" uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: diff --git a/.github/workflows/forge-deploy-prev.yml b/.github/workflows/forge-deploy-prev.yml index 031b2476b44..feeee3deec8 100644 --- a/.github/workflows/forge-deploy-prev.yml +++ b/.github/workflows/forge-deploy-prev.yml @@ -22,9 +22,9 @@ jobs: runs-on: ubuntu-24.04 steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -34,7 +34,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔨 Build" working-directory: grails-forge run: ./gradlew build @@ -48,9 +48,9 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}:prev steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -60,7 +60,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔑 Login to Google Cloud" uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: @@ -110,9 +110,9 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}-analytics:prev steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -122,7 +122,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔑 Login to Google Cloud" uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: diff --git a/.github/workflows/forge-deploy-release.yml b/.github/workflows/forge-deploy-release.yml index 9c8c14646d9..dfa3ef5e22a 100644 --- a/.github/workflows/forge-deploy-release.yml +++ b/.github/workflows/forge-deploy-release.yml @@ -28,9 +28,9 @@ jobs: release_version: ${{ github.event.inputs.release }} steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -40,7 +40,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🧩 Assemble" working-directory: grails-forge run: ./gradlew grails-cli:assemble @@ -52,9 +52,9 @@ jobs: needs: build steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -64,7 +64,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔑 Login to Google Cloud" uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: @@ -112,9 +112,9 @@ jobs: needs: build steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -124,7 +124,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔑 Login to Google Cloud" uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: diff --git a/.github/workflows/forge-deploy-snapshot.yml b/.github/workflows/forge-deploy-snapshot.yml index 7db805b1f7b..aeb1e131ef9 100644 --- a/.github/workflows/forge-deploy-snapshot.yml +++ b/.github/workflows/forge-deploy-snapshot.yml @@ -22,9 +22,9 @@ jobs: runs-on: ubuntu-24.04 steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -34,7 +34,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔨 Build" working-directory: grails-forge run: ./gradlew build @@ -48,9 +48,9 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}:snapshot steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -60,7 +60,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔑 Login to Google Cloud" uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: @@ -108,9 +108,9 @@ jobs: IMAGE_NAME: us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_APP_NAME }}/${{ secrets.GCP_APP_NAME }}-analytics:snapshot steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: '17' @@ -120,7 +120,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔑 Login to Google Cloud" uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml index f813e011249..2b483ae4a2b 100644 --- a/.github/workflows/gradle.yml +++ b/.github/workflows/gradle.yml @@ -30,9 +30,9 @@ jobs: runs-on: ubuntu-24.04 steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: 17 @@ -63,9 +63,9 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: ${{ matrix.java }} @@ -75,7 +75,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔨 Build project without tests" if: ${{ contains(github.event.head_commit.message, '[skip tests]') }} working-directory: 'grails-gradle' @@ -116,9 +116,9 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: ${{ matrix.java }} @@ -128,7 +128,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔨 Build project" run: > ./gradlew build :grails-shell-cli:installDist groovydoc @@ -150,9 +150,9 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: ${{ matrix.java }} @@ -162,7 +162,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔨 Build project" run: > ./gradlew build :grails-shell-cli:installDist groovydoc @@ -182,9 +182,9 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'liberica' java-version: ${{ matrix.java }} @@ -194,7 +194,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🔨 Build project without tests" if: ${{ contains(github.event.head_commit.message, '[skip tests]') }} working-directory: 'grails-forge' @@ -241,9 +241,9 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: ${{ matrix.java }} @@ -253,7 +253,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🏃 Run Functional Tests" run: > ./gradlew bootJar check @@ -278,9 +278,9 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout the repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: ${{ matrix.java }} @@ -312,9 +312,9 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout the repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: ${{ matrix.java }} @@ -341,9 +341,9 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: 17 @@ -353,7 +353,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "📤 Publish Gradle Snapshot Artifacts" env: GRAILS_PUBLISH_RELEASE: 'false' @@ -392,9 +392,9 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: 17 @@ -404,9 +404,9 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "📤 Publish Grails-Core Snapshot Artifacts" - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0 + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0 env: GRAILS_PUBLISH_RELEASE: 'false' MAVEN_PUBLISH_URL: ${{ secrets.GRAILS_NEXUS_PUBLISH_SNAPSHOT_URL }} @@ -447,9 +447,9 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: 17 @@ -459,7 +459,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "📤 Publish Gradle Snapshot Artifacts" env: GRAILS_PUBLISH_RELEASE: 'false' @@ -492,14 +492,14 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: 17 - name: "đŸ“Ĩ Download Wrapper" - uses: actions/download-artifact@v8.0.1 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: apache-grails-wrapper-SNAPSHOT-bin path: wrapper @@ -535,7 +535,7 @@ jobs: - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it run: curl -s https://api.ipify.org - name: "đŸ“Ĩ Checkout the repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-tags: true - name: "🔀 Store current branch name" @@ -549,7 +549,7 @@ jobs: echo "NOW=${NOW}" >> $GITHUB_ENV echo "Current date: ${NOW}" - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: 17 diff --git a/.github/workflows/groovy-joint-workflow.yml b/.github/workflows/groovy-joint-workflow.yml index 56a48b1f47f..6bf8f39056a 100644 --- a/.github/workflows/groovy-joint-workflow.yml +++ b/.github/workflows/groovy-joint-workflow.yml @@ -36,17 +36,17 @@ jobs: groovyVersion: ${{ steps.groovy-version.outputs.value }} steps: - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: java-version: 17 distribution: liberica - name: "🗄ī¸ Cache local Maven repository" - uses: actions/cache@v5.0.5 + uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 with: path: ~/.m2/repository key: cache-local-maven-${{ github.sha }} - name: "đŸ“Ĩ Checkout Grails Core to fetch Gradle Plugin versions it uses" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: sparse-checkout-cone-mode: false sparse-checkout: settings.gradle @@ -68,7 +68,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "📝 Store Groovy version to use when building Grails" id: groovy-version run: | @@ -140,9 +140,9 @@ jobs: --health-retries 5 steps: - name: "đŸ“Ĩ Checkout project" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: java-version: 17 distribution: liberica @@ -152,9 +152,9 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🗄ī¸ Restore local Maven repository from cache" - uses: actions/cache@v5.0.5 + uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 with: path: ~/.m2/repository key: cache-local-maven-${{ github.sha }} diff --git a/.github/workflows/rat.yml b/.github/workflows/rat.yml index 0fd43978b56..f66e0b5ba50 100644 --- a/.github/workflows/rat.yml +++ b/.github/workflows/rat.yml @@ -35,9 +35,9 @@ jobs: runs-on: ubuntu-latest steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: liberica java-version: 17 @@ -47,7 +47,7 @@ jobs: cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use) develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: "🔍 Setup TestLens" - uses: testlens-app/setup-testlens@v1 + uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2 - name: "🧐 Apache License - Release Audit Tool" run: ./gradlew rat - name: Upload RAT HTML report diff --git a/.github/workflows/release-close.yml b/.github/workflows/release-close.yml index b47804ce77e..70e3223f313 100644 --- a/.github/workflows/release-close.yml +++ b/.github/workflows/release-close.yml @@ -40,7 +40,7 @@ jobs: actions: write # in case there are pending changes to release.yml in the target branch steps: - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ env.TAG }} token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release-publish-docs.yml b/.github/workflows/release-publish-docs.yml index 8457fc13cc8..32ac5346035 100644 --- a/.github/workflows/release-publish-docs.yml +++ b/.github/workflows/release-publish-docs.yml @@ -49,7 +49,7 @@ jobs: - name: "📝 Store release version" run: echo "VERSION=${VERSION}" >> "$GITHUB_ENV" - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 # needed for docs release dropdown, (fetch-tags: true with fetch-depth: 1 does not work; https://github.com/actions/checkout/issues/1471) filter: tree:0 # limit size, keeping tags for docs release dropdown @@ -58,7 +58,7 @@ jobs: - name: "📅 Ensure Common Build Date" # to ensure a reproducible build run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV" - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: ${{ env.JAVA_DISTRIBUTION }} java-version: ${{ env.JAVA_VERSION }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f215be783be..5343fd1be8d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -59,7 +59,7 @@ jobs: current_limit=$(gh api rate_limit --jq '.resources.graphql') echo "Current Rate Limit: $current_limit" - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 # needed for docs release dropdown, (fetch-tags: true with fetch-depth: 1 does not work; https://github.com/actions/checkout/issues/1471) filter: tree:0 # limit size, keeping tags for docs release dropdown @@ -76,7 +76,7 @@ jobs: echo "${GPG_KEY}" | gpg --batch --import gpg --list-keys - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: ${{ env.JAVA_DISTRIBUTION }} java-version: ${{ env.JAVA_VERSION }} @@ -254,7 +254,7 @@ jobs: current_limit=$(gh api rate_limit --jq '.resources.graphql') echo "Current Rate Limit: $current_limit" - name: "đŸ“Ĩ Checkout Grails Core repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: path: grails ref: ${{ env.TAG }} @@ -455,7 +455,7 @@ jobs: tag_name: ${{ env.TAG }} files: dev-repo/DIST_SVN_REVISION.txt - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: path: ${{ env.REPO_NAME }} ref: ${{ env.TAG }} @@ -506,7 +506,7 @@ jobs: current_limit=$(gh api rate_limit --jq '.resources.graphql') echo "Current Rate Limit: $current_limit" - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ env.TAG }} - name: "🛠ī¸ī¸ Install tools" @@ -593,7 +593,7 @@ jobs: df -h - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 # needed for docs release dropdown, (fetch-tags: true with fetch-depth: 1 does not work; https://github.com/actions/checkout/issues/1471) filter: tree:0 # limit size, keeping tags for docs release dropdown @@ -602,7 +602,7 @@ jobs: - name: "📅 Ensure Common Build Date" # to ensure a reproducible build run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV" - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: ${{ env.JAVA_DISTRIBUTION }} java-version: ${{ env.JAVA_VERSION }} @@ -637,11 +637,11 @@ jobs: current_limit=$(gh api rate_limit --jq '.resources.graphql') echo "Current Rate Limit: $current_limit" - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ env.TAG }} - name: "☕ī¸ Setup JDK" - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: ${{ env.JAVA_DISTRIBUTION }} java-version: ${{ env.JAVA_VERSION }} @@ -684,7 +684,7 @@ jobs: current_limit=$(gh api rate_limit --jq '.resources.graphql') echo "Current Rate Limit: $current_limit" - name: "đŸ“Ĩ Checkout repository" - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ env.TAG }} token: ${{ secrets.GITHUB_TOKEN }}