From 5349ca866ab04aa11cfd8caa46255facbfb15228 Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Sun, 9 Aug 2026 10:06:22 +0800 Subject: [PATCH] actions.yml: drop stale stable tag on dtolnay/rust-toolchain Upstream publishes `stable` as a rolling branch and force-pushes it on each toolchain release. The pinned SHA stopped being an ancestor of that branch, so check_action_tags hard-failed on every PR in the repo, not just ones touching this entry - seven open PRs were red for a reason none of them caused. Without a `tag:` key the checker only verifies the commit exists and emits a warning, which is the accurate statement: the commit is immutable and still valid to pin, it is simply no longer on any ref. Deliberately not bumping to the current `stable` head. That would approve an unreviewed version of the action for every ASF project, which is a version bump needing its own review rather than a CI fix. Also regenerates approved_patterns.yml, which drops zizmor-action v0.5.3 (b1d7e1fb) - its expires_at was today, unrelated to this change. Generated-by: Claude Opus 5 (1M context) via Claude Code --- actions.yml | 8 +++++++- approved_patterns.yml | 1 - 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/actions.yml b/actions.yml index be641ed8..aa1e7a9c 100644 --- a/actions.yml +++ b/actions.yml @@ -486,9 +486,15 @@ dorny/test-reporter: a43b3a5f7366b97d083190328d2c652e1a8b6aa2: tag: v3.0.0 dtolnay/rust-toolchain: + # Deliberately carries no `tag:` annotation. Upstream publishes `stable` as a + # rolling branch that is force-pushed on each toolchain release, so a SHA + # annotated with it stops being an ancestor of that branch and makes + # check_action_tags hard-fail every PR in this repo, not just ones touching + # this entry. The commit itself is immutable and still valid to pin; moving + # to whatever `stable` points at now is a version bump and needs its own + # review rather than being smuggled in as a CI fix. 4cda84d5c5c54efe2404f9d843567869ab1699d4: keep: true - tag: stable easimon/maximize-build-space: '*': keep: true diff --git a/approved_patterns.yml b/approved_patterns.yml index a20b261b..d7e6b61c 100644 --- a/approved_patterns.yml +++ b/approved_patterns.yml @@ -379,7 +379,6 @@ - vapier/coverity-scan-action@2068473c7bdf8c2fb984a6a40ae76ee7facd7a85 - vimtor/action-zip@5f1c4aa587ea41db1110df6a99981dbe19cee310 - vishalsinha21/dynamic-checklist@* -- zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e - zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d - zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa - zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02