Skip to content

ci: pin GitHub Actions to server SHAs#564

Closed
mpartipilo wants to merge 1 commit intomainfrom
ci/pin-actions-to-sha
Closed

ci: pin GitHub Actions to server SHAs#564
mpartipilo wants to merge 1 commit intomainfrom
ci/pin-actions-to-sha

Conversation

@mpartipilo
Copy link
Copy Markdown
Contributor

@mpartipilo mpartipilo commented Apr 19, 2026

Summary

  • Pin all uses: refs in GitHub Actions workflows to the same commit SHAs used by weaviate/weaviate, so this client stays in lockstep with the server
  • Preserve the tag (e.g. # v6) as a trailing comment for readability

Context

Initial consolidation pass. Going forward, GitHub's repo-level "Require actions to be pinned to a full-length commit SHA" policy (shipped 2025-08-15) will enforce SHA pinning at execution time for every workflow — so no custom linter is needed in this repo.

Test plan

  • CI workflows run and pass on this branch

🤖 Generated with Claude Code

Align all uses: refs to the immutable commit SHAs used by
weaviate/weaviate. Major versions bumped where necessary:
checkout v6, docker/login v4, upload-artifact v7,
download-artifact v8, cache v5. Tags preserved as comments.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@mpartipilo mpartipilo requested a review from a team as a code owner April 19, 2026 13:49
Copy link
Copy Markdown

@orca-security-eu orca-security-eu Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Orca Security Scan Summary

Status Check Issues by priority
Passed Passed Infrastructure as Code high 0   medium 0   low 0   info 0 View in Orca
Passed Passed SAST high 0   medium 0   low 0   info 0 View in Orca
Passed Passed Secrets high 0   medium 0   low 0   info 0 View in Orca
Passed Passed Vulnerabilities high 0   medium 0   low 0   info 0 View in Orca

with:
distribution: "zulu"
java-version: "17"
java-version: "21"
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this change necessary? Our promise is that the Java client can work with JDK 17 upwards, I think it'd be good to use that version for tests.

@mpartipilo
Copy link
Copy Markdown
Contributor Author

Consolidated into #563 — the original PR branch was reset to match this narrowed scope, so keeping two PRs open adds no value. Closing.

@mpartipilo mpartipilo closed this Apr 20, 2026
@mpartipilo mpartipilo deleted the ci/pin-actions-to-sha branch April 20, 2026 12:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants