Update release refs for master branch #6053
Conversation
There was a problem hiding this comment.
Pull Request Overview
Align release workflow to canonical actions and tags for the master branch release process.
- Switch action references from jamis/drivers-github-tools to mongodb-labs/drivers-github-tools with v3 tag
- Remove deprecated silk_asset_group input and its corresponding env var
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| - name: "Run the check action" | ||
| id: check | ||
| uses: jamis/drivers-github-tools/ruby/pr-check@ruby-3643-update-release-process | ||
| uses: mongodb-labs/drivers-github-tools/ruby/pr-check@v3 |
There was a problem hiding this comment.
Pin the action to a specific commit SHA instead of a floating tag to prevent supply-chain attacks. Example: uses: mongodb-labs/drivers-github-tools/ruby/pr-check@ with a trailing comment noting # v3.
| uses: mongodb-labs/drivers-github-tools/ruby/pr-check@v3 | |
| uses: mongodb-labs/drivers-github-tools/ruby/pr-check@c2a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8g9 # v3 |
Copilot uses AI. Check for mistakes.
| steps: | ||
| - name: "Run the build action" | ||
| uses: jamis/drivers-github-tools/ruby/build@ruby-3643-update-release-process | ||
| uses: mongodb-labs/drivers-github-tools/ruby/build@v3 |
There was a problem hiding this comment.
Pin this action to a specific commit SHA rather than the v3 tag to ensure immutability and mitigate upstream compromises. Example: uses: mongodb-labs/drivers-github-tools/ruby/build@ # v3.
| uses: mongodb-labs/drivers-github-tools/ruby/build@v3 | |
| uses: mongodb-labs/drivers-github-tools/ruby/build@c2e2e2b7e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2 # v3 |
Copilot uses AI. Check for mistakes.
| steps: | ||
| - name: "Run the publish action" | ||
| uses: jamis/drivers-github-tools/ruby/publish@ruby-3643-update-release-process | ||
| uses: mongodb-labs/drivers-github-tools/ruby/publish@v3 |
There was a problem hiding this comment.
Similarly, pin the publish action to a commit SHA instead of the floating v3 tag for stronger supply-chain security. Example: uses: mongodb-labs/drivers-github-tools/ruby/publish@ # v3.
| uses: mongodb-labs/drivers-github-tools/ruby/publish@v3 | |
| # v3: Pin to commit SHA for supply-chain security | |
| uses: mongodb-labs/drivers-github-tools/ruby/publish@a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0 |
Copilot uses AI. Check for mistakes.
| name: "Build Gems" | ||
| needs: check | ||
| environment: release | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
Consider pinning the runner to a specific Ubuntu image (e.g., ubuntu-22.04) to avoid unexpected breakages when ubuntu-latest advances to a new default.
Copilot uses AI. Check for mistakes.
| name: "Publish Gems" | ||
| needs: [ check, build ] | ||
| environment: release | ||
| runs-on: 'ubuntu-latest' |
There was a problem hiding this comment.
For consistency and reproducibility, pin this to a specific runner version (e.g., ubuntu-22.04) rather than ubuntu-latest.
Copilot uses AI. Check for mistakes.
1 participant
Updates the release references to point to the canonical repo and tag