Repository navigation
ci: pin goreleaser-action back to allowlisted v7.2.3 - #108
Merged
Merged
Conversation
Dependabot PR #106 bumped goreleaser-action to v7.3.0, but this repo enforces a SHA-pinned allowed-actions policy (sha_pinning_required=true) whose allowlist contains only the v7.2.3 SHA for goreleaser-action. The v7.3.0 SHA is not allowlisted, so the tag-triggered Release workflow fails at startup (startup_failure, no jobs scheduled) and never builds a release. GitHub-owned actions like codeql-action are exempt, which is why that bump was fine. Revert just this line to the vetted, allowlisted SHA so releases work. To adopt v7.3.0 later, add its SHA to the repo's Actions allowlist first, then bump. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Tagging
v1.0.0triggered the Release workflow, which failed at startup (startup_failure, 0 jobs scheduled, no release built).Root cause: this repo enforces a SHA-pinned allowed-actions policy:
allowed_actions: selected,sha_pinning_required: true,github_owned_allowed: truegoreleaser/goreleaser-action@f06c13b…(v7.2.3)Dependabot PR #106 bumped goreleaser-action to v7.3.0 (
a4f02ab…), which is not in the allowlist, so GitHub blocks the run before it starts. (CodeQL's SHA bump in the same PR was fine because GitHub-owned actions are exempt.)Fix
Revert just the goreleaser-action line back to the vetted, allowlisted v7.2.3 SHA. The AWS SDK and codeql-action bumps from #106 are untouched.
To adopt v7.3.0 later, add its SHA to the repo Actions allowlist first, then bump.
🤖 Generated with Claude Code