ci(release-dmr): pin actions to commit SHAs, drop 3p release action#1000
Merged
Conversation
release-dmr.yml used floating major-version tags (actions/checkout@v4, actions/setup-go@v5, actions/upload-artifact@v4, actions/download-artifact@v4) and the third-party softprops/action-gh-release@v2 action. Org policy requires every action be pinned to a full-length commit SHA, so pushing the dmr-v0.1.0 tag failed immediately with 'actions must be pinned to a full-length commit SHA' before a single build step ran. Pin the four actions to the same commit SHAs already used elsewhere in this repo (release.yml, ci.yml, e2e-test.yml, integration-test.yml) so there is a single already-vetted pin per action instead of introducing new ones. Replace softprops/action-gh-release with a 'gh release create' step, matching the pattern release.yml already uses for the model-runner container image releases, so we don't need to pin/vet a new third-party action just for this workflow.
Contributor
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
doringeman
approved these changes
Jul 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pins the four GitHub Actions used by
release-dmr.ymlto the commitSHAs already vetted/used elsewhere in this repo (
release.yml,ci.yml,e2e-test.yml,integration-test.yml), and replacessoftprops/action-gh-release@v2with agh release createstepmatching the pattern
release.ymlalready uses for the model-runnercontainer image releases.
Why
Pushing the
dmr-v0.1.0tag to trigger the first standalonedmrrelease failed immediately:
release-dmr.ymlwas added referencing floating major-version tagsand a third-party release action, neither of which comply with the
org's action-pinning policy that every other workflow in this repo
already follows. No new action pins are introduced here — each SHA
already appears in an existing, presumably-reviewed workflow.
Testing
actionlint .github/workflows/release-dmr.ymlpasses.dmr-v0.1.0release via workflow_dispatch afterthis merges to confirm the workflow runs end-to-end (see linked run).