Pin apache/infrastructure-actions to its released tags

[potiuk]

apache/infrastructure-actions#1032 added tag-based, per-action releases to that repository — each action is now tagged under its own prefix (allowlist-check/vX.Y.Z, save/vX.Y.Z, restore/vX.Y.Z, plus moving …/v1 majors). Its recommended consumption is a SHA pin carrying the tag as a comment, which is what Dependabot needs to offer bumps.

Our pins predate that. All 16 stash/save and stash/restore uses sat on 49df447b, a commit with no version behind it, and allowlist-check was pinned to 4e9c961f with a bare # main comment — i.e. tracking whatever main happened to be at the time it was written.

This moves all 17 pins to 61dcea11f19e2bbe1263f14d72235e8da17d3ad0, the commit the initial v1.0.0 tags of all three actions point at, and names the tag in the comment:

uses: apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # restore/v1.0.0
uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # save/v1.0.0
uses: apache/infrastructure-actions/allowlist-check@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # allowlist-check/v1.0.0

61dcea11 is 686 commits ahead of the pin it replaces, tipped by the release-automation commit itself:

$ gh api repos/apache/infrastructure-actions/compare/49df447b...61dcea11
status: ahead, ahead_by: 686, behind_by: 0
  ...
  Add tag-based, per-action releases (closes #1007) (#1032)

The zizmor suppression goes away

.github/zizmor.yml suppressed ref-version-mismatch for asf-allowlist-check.yml, because a # main comment can never resolve to the commit it names. A real tag can, so the suppression is deleted and that workflow is audited like every other one.

Verified rather than assumed — zizmor resolves the prefixed tags correctly. With the suppression removed:

$ zizmor .github/workflows/asf-allowlist-check.yml \
         .github/actions/prepare_single_ci_image/action.yml \
         .github/actions/prepare_breeze_and_image/action.yml
No findings to report. Good job. (2 suppressed)

and, as a control that the audit really was running rather than silently skipping, the same pin with a deliberately bogus tag is still caught:

warning[ref-version-mismatch]: action's hash pin has mismatched or missing version comment
  - uses: apache/infrastructure-actions/stash/save@61dcea11…  # save/v9.9.9
                                                                ^^^^^^^^^^^ points to unknown ref

zizmor reads tags from the git refs API and peels annotated tags, so save/v1.0.0 resolves to 61dcea11… — exactly the pinned commit.

Line-length exemptions

Nine pins needed # yamllint disable-line rule:line-length. A 40-character SHA plus the action path already runs to ~100 columns, so any trailing comment crosses the 110 limit. These lines passed before only because yamllint's allow-non-breakable-words exempts a line that is a single unbreakable token — adding the comment introduces a space and forfeits that. Keeping the comment on the same line is deliberate: Dependabot only reads it there.

Unrelated, but noticed while verifying

zizmor picks its suggested tag with max_by_key(|t| t.name.len()) over every tag at the commit, with no awareness of which action inside the repo is used. For this monorepo that means a stash/save pin is told it "is pointed to by tag allowlist-check/v1.0.0" — a sibling action's version — and that is offered as an auto-fix. Nothing in this PR depends on it, but do not accept that particular auto-fix if you see it.

---

Was generative AI tooling used to co-author this PR?

• Yes — Claude Code (Opus 5)

Generated-by: Claude Code (Opus 5) following the guidelines