From b23163a33e433a4ec1558ede12c6022169a56ebc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Volkan=20Yaz=C4=B1c=C4=B1?= Date: Thu, 21 Dec 2023 13:57:18 +0100 Subject: [PATCH] Switch `logging-parent` refs in CI to tags dependabot is not able to update `logging-parent` GHA workflow references that use hashes[1][2]. Switching to tags is safe, since `rel/`-prefixed tags are protected by INFRA. [1] dependabot/dependabot-core#8654 [2] dependabot/dependabot-core#6269 --- .github/workflows/build.yaml | 2 +- .github/workflows/merge-dependabot.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index fc54b7e..a9732e2 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -37,6 +37,6 @@ jobs: build: if: github.actor != 'dependabot[bot]' - uses: apache/logging-parent/.github/workflows/build-reusable.yaml@e45457c683302242be5e8e7c3c33edf8f0e0ec0e # 10.4.0 + uses: apache/logging-parent/.github/workflows/build-reusable.yaml@rel/10.5.0 with: java-version: 21 diff --git a/.github/workflows/merge-dependabot.yaml b/.github/workflows/merge-dependabot.yaml index b73773d..09d9ce4 100644 --- a/.github/workflows/merge-dependabot.yaml +++ b/.github/workflows/merge-dependabot.yaml @@ -30,13 +30,13 @@ jobs: build: if: github.repository == 'apache/logging-log4j-samples' && github.event_name == 'pull_request_target' && github.actor == 'dependabot[bot]' - uses: apache/logging-parent/.github/workflows/build-reusable.yaml@merge-dependabot + uses: apache/logging-parent/.github/workflows/build-reusable.yaml@rel/10.5.0 with: java-version: 21 merge-dependabot: needs: build - uses: apache/logging-parent/.github/workflows/merge-dependabot-reusable.yaml@merge-dependabot + uses: apache/logging-parent/.github/workflows/merge-dependabot-reusable.yaml@rel/10.5.0 permissions: contents: write # to push changelog commits pull-requests: write # to close the PR