Switch logging-parent refs in CI from hashes to tags

dependabot is not able to update `logging-parent` GHA workflow references that use hashes[1][2]. Switching to tags is safe, since `rel/`-prefixed tags are protected by INFRA. [1] dependabot/dependabot-core#8654 [2] dependabot/dependabot-core#6269
apache · Dec 21, 2023 · 675cb96 · 675cb96
1 parent 736bc4b
commit 675cb96
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -38,14 +38,14 @@ jobs:
 
   build:
     if: github.actor != 'dependabot[bot]'
-    uses: apache/logging-parent/.github/workflows/build-reusable.yaml@e45457c683302242be5e8e7c3c33edf8f0e0ec0e # 10.4.0
+    uses: apache/logging-parent/.github/workflows/build-reusable.yaml@rel/10.5.0
     with:
       site-enabled: true
 
   deploy-snapshot:
     needs: build
     if: github.repository == 'apache/logging-log4j-tools' && github.ref_name == 'main'
-    uses: apache/logging-parent/.github/workflows/deploy-snapshot-reusable.yaml@e45457c683302242be5e8e7c3c33edf8f0e0ec0e # 10.4.0
+    uses: apache/logging-parent/.github/workflows/deploy-snapshot-reusable.yaml@rel/10.5.0
     # Secrets for deployments
     secrets:
       NEXUS_USER: ${{ secrets.NEXUS_USER }}
@@ -54,7 +54,7 @@ jobs:
   deploy-release:
     needs: build
     if: github.repository == 'apache/logging-log4j-tools' && startsWith(github.ref_name, 'release/')
-    uses: apache/logging-parent/.github/workflows/deploy-release-reusable.yaml@e45457c683302242be5e8e7c3c33edf8f0e0ec0e # 10.4.0
+    uses: apache/logging-parent/.github/workflows/deploy-release-reusable.yaml@rel/10.5.0
     # Secrets for deployments
     secrets:
       GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }}

diff --git a/.github/workflows/merge-dependabot.yaml b/.github/workflows/merge-dependabot.yaml
@@ -30,11 +30,11 @@ jobs:
 
   build:
     if: github.repository == 'apache/logging-log4j-tools' && github.event_name == 'pull_request_target' && github.actor == 'dependabot[bot]'
-    uses: apache/logging-parent/.github/workflows/build-reusable.yaml@e45457c683302242be5e8e7c3c33edf8f0e0ec0e # 10.4.0
+    uses: apache/logging-parent/.github/workflows/build-reusable.yaml@rel/10.5.0
 
   merge-dependabot:
     needs: build
-    uses: apache/logging-parent/.github/workflows/merge-dependabot-reusable.yaml@e45457c683302242be5e8e7c3c33edf8f0e0ec0e # 10.4.0
+    uses: apache/logging-parent/.github/workflows/merge-dependabot-reusable.yaml@rel/10.5.0
     permissions:
       contents: write                                     # to push changelog commits
       pull-requests: write                                # to close the PR