ci: pin apache/rocketmq-test-tool to a full commit SHA - #15504
Open
kobihikri wants to merge 1 commit into
Open
Conversation
pr-e2e-test.yml references apache/rocketmq-test-tool via the mutable @java-dev branch across the e2e steps, which run with repository/registry secrets in scope. Pin to the commit @java-dev resolves to so a change to that branch can't run in the credentialed jobs without a conscious bump. Behaviour unchanged.
|
|
|
Thanks for your this PR. 🙏 感谢您提交的PR。 🙏 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pin
apache/rocketmq-test-toolinpr-e2e-test.ymlfrom the mutable@java-devbranch to the commit it currently resolves to (all 8 usages).Why
The e2e jobs run with repository/registry secrets in scope, and this third-party action is referenced by
@java-dev— a moving development branch, so the exact code that runs alongside those secrets can change at any time without any change in this repository. Pinning to a full commit SHA means a change to that branch can't run in the credentialed jobs until someone consciously bumps the pin and reviews it. Behaviour is unchanged (8089a99is the current tip ofjava-dev).I used AI assistance to help identify this and draft the change; I verified every line against the live workflow myself and take responsibility for it.