Skip to content

ZOOKEEPER-5060: Update GitHub Action versions#2411

Open
PDavid wants to merge 1 commit into
apache:masterfrom
PDavid:ZOOKEEPER-5060-gh-actions-update
Open

ZOOKEEPER-5060: Update GitHub Action versions#2411
PDavid wants to merge 1 commit into
apache:masterfrom
PDavid:ZOOKEEPER-5060-gh-actions-update

Conversation

@PDavid

@PDavid PDavid commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

For example Checkout v7 has a safer fork pull request handling. See: https://github.com/actions/checkout

I pinned GitHub Actions to full commit SHAs which is a security best practice that locks workflows to immutable versions, preventing supply chain attacks where mutable tags (like @v4 or @main) are updated or compromised.

Why Pin to SHA?

  • Immutability: Unlike tags, a 40-character SHA never changes; if a repository is compromised, future commits will have different hashes, protecting your pipeline from running malicious code.
  • Reproducibility: Ensures every workflow run executes the exact same code, eliminating "works on my machine" issues caused by silent tag updates.
  • Security: Mitigates risks associated with tag hijacking or force-pushes that can inject vulnerabilities into trusted action references.

@PDavid

PDavid commented Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

A test failed but it should be unrelated because I only changed the GH Action versions on this branch:

[ERROR]   SnapshotAndRestoreCommandTest.testSnapshotAndRestoreCommand_streaming:168->validateSnapshotMetrics:398 expected: <true> but was: <false>

@PDavid

PDavid commented Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

If you will have some time @anmolnar or @phunt can you please take a look?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant