Migrate to Gradle 9.5.1 and Java 25 #2630
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,14 @@ | ||
| name: PR Build | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} | ||
| cancel-in-progress: true | ||
|
|
||
| on: pull_request | ||
|
|
||
| jobs: | ||
| call_workflow: | ||
| name: Run PR Build Workflow | ||
| if: ${{ github.repository_owner == 'ballerina-platform' }} | ||
| uses: ballerina-platform/ballerina-library/.github/workflows/pull-request-build-template.yml@java-25-migration | ||
| secrets: inherit | ||
|
Comment on lines
+13
to
14
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Find reusable workflow calls that are mutable and/or inherit all secrets.
rg -nP '^\s*uses:\s*[^#\n]+@([A-Za-z0-9._/-]+)\s*$|^\s*secrets:\s*inherit\s*$' .github/workflows
# Expected after fix:
# - `uses:` for external/reusable workflows pinned to full SHAs
# - no unconditional `secrets: inherit` unless explicitly justifiedRepository: ballerina-platform/module-ballerina-http Length of output: 3349 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/pull-request.yml"
echo "== File: $FILE =="
nl -ba "$FILE" | sed -n '1,80p'Repository: ballerina-platform/module-ballerina-http Length of output: 192 🌐 Web query:
💡 Result: In a GitHub Actions workflow that calls a reusable workflow, Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/pull-request.yml"
echo "== $FILE (lines 8-22) =="
awk 'NR>=8 && NR<=22 {printf "%d:%s\n", NR, $0}' "$FILE"Repository: ballerina-platform/module-ballerina-http Length of output: 412 🌐 Web query:
💡 Result: I couldn’t locate the specific file path you mentioned (ballerina-platform/ballerina-library pull-request-build-template.yml java-25-migration secrets inherit). What I can confirm from authoritative sources is the following relevant parts: 1) How Citations:
Pin the reusable workflow ref to an immutable commit SHA and avoid 🔐 Suggested hardening- uses: ballerina-platform/ballerina-library/.github/workflows/pull-request-build-template.yml@java-25-migration
- secrets: inherit
+ uses: ballerina-platform/ballerina-library/.github/workflows/pull-request-build-template.yml@<full_commit_sha>
+ secrets:
+ REQUIRED_SECRET_NAME: ${{ secrets.REQUIRED_SECRET_NAME }}🧰 Tools🪛 zizmor (1.25.2)[error] 13-13: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) [warning] 13-13: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow (secrets-inherit) 🤖 Prompt for AI Agents |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: ballerina-platform/module-ballerina-http
Length of output: 2936
Pin reusable workflow reference in
build-with-bal-test-graalvm.ymlto a commit SHA./.github/workflows/build-with-bal-test-graalvm.ymlline 43 references a reusable workflow with the mutable ref@java-25-migration—use the full commit SHA instead to keep CI behavior deterministic.🔒 Suggested fix
🧰 Tools
🪛 zizmor (1.25.2)
[error] 43-43: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents