Skip to content

[Cherry-pick to branch-1.3] [MINOR] fix(ci): Pin pnpm/action-setup to an ASF-allowlisted SHA (#12899) - #12905

Merged
jerryshao merged 1 commit into
branch-1.3from
cherry-pick-5d150b18-to-branch-1.3
Sep 4, 2026
Merged

jerryshao merged 1 commit into
branch-1.3from
cherry-pick-5d150b18-to-branch-1.3

Conversation

@github-actions

@github-actions github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown

Cherry-pick Information:

  • Original commit: 5d150b1
  • Target branch: branch-1.3
  • Status: ✅ Clean cherry-pick (no conflicts)

)

### What changes were proposed in this pull request?

Pin `pnpm/action-setup` in `web-ui-tests.yml` to the ASF-allowlisted
commit SHA for `v6.0.10`, instead of the moving `v4` tag.

### Why are the changes needed?

`apache/infrastructure-actions` tightened its allowlist for
`pnpm/action-setup` from a wildcard (`'*': keep: true`) to a single
pinned SHA (`0977fd99725f1db4007ccb2928dbb4e90d06cc86`, tag `v6.0.10`):
apache/infrastructure-actions@db90620.
As a result, `asf-allowlist-check` now fails on every workflow run that
still references `pnpm/action-setup@v4`. `v6.0.10`'s `action.yml` keeps
the same `version` input used here, so this is a drop-in replacement.

### Does this PR introduce any user-facing change?

No.

### How was this patch tested?

N/A — CI-only change.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01SpCQ2tawE67Ur1X4nyKsV1

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
@github-actions github-actions Bot added the cherry-pick Automatically opened cherry-pick PR label Sep 4, 2026
@github-actions
github-actions Bot requested a review from jerryshao September 4, 2026 03:10
@jerryshao
jerryshao merged commit feb7531 into branch-1.3 Sep 4, 2026
37 checks passed
@jerryshao
jerryshao deleted the cherry-pick-5d150b18-to-branch-1.3 branch September 4, 2026 06:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cherry-pick Automatically opened cherry-pick PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants