From 3766cf07b457bf33ec012e3688d66babb1c4a512 Mon Sep 17 00:00:00 2001 From: Chris Povirk Date: Mon, 10 Aug 2026 13:18:04 -0400 Subject: [PATCH 1/3] Use `cancel-in-progress` instead of `styfle/cancel-workflow-action`. Compare https://github.com/google/guava/pull/8542. Aside from the reasons listed there, I wonder if this would have avoided a flaky(?) failure that I saw today on https://github.com/google/google-java-format/pull/1441: ``` Run styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 with: access_token: *** ignore_sha: false all_but_latest: false force_cancel: false { eventName: 'pull_request', sha: 'ca5f660437c7f1489d511540cf8c6d047ea0edcf', headSha: 'a160145b17ff487adfa4519b087472e3d328088d', branch: 'zizdep', owner: 'google', repo: 'google-java-format', GITHUB_RUN_ID: '31412633123' } Found token: yes Error: self-signed certificate; if the root CA is installed locally, try running Node.js with --use-system-ca ``` --- .github/workflows/ci.yml | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 83b8786af..e29c9b5d2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,6 +25,11 @@ on: permissions: contents: read +# Cancel in-progress runs for pull requests, but not for master branch pushes +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + jobs: test-OpenJDK: name: "JDK ${{ matrix.java }} on ${{ matrix.os }}" @@ -49,10 +54,6 @@ jobs: runs-on: ${{ matrix.os }} continue-on-error: ${{ matrix.experimental }} steps: - - name: Cancel previous - uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 - with: - access_token: ${{ github.token }} - name: "Check out repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: @@ -89,10 +90,6 @@ jobs: runs-on: ${{ matrix.os }} continue-on-error: true steps: - - name: Cancel previous - uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 - with: - access_token: ${{ github.token }} - name: "Check out repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: From d76691ba47297b550fc9db016afdef445ebdfc8a Mon Sep 17 00:00:00 2001 From: Chris Povirk Date: Mon, 10 Aug 2026 13:23:46 -0400 Subject: [PATCH 2/3] Update version comments to `vX.Y.Z` tags. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When we use `vX` instead, `zizmor` complains about values like `0def53c0fd8534bc13416c9469f5be45265824fd # v1`: That commit was `v1.6.3`, which `v1` presumably _used_ to point to (so it _was_ fine), but now `v1` points to `v1.6.4`, which is a different commit. (I wonder if out-of-sync comments still ever [prevent Dependabot from updating them](https://github.com/dependabot/dependabot-core/issues/13197#issuecomment-3357374469)—though the case here seems different than that one.) Current [warning](https://docs.zizmor.sh/audits/#ref-version-mismatch): ``` ref-version-mismatch Check warning: ref-version-mismatch ci.yml:98: action's hash pin has mismatched or missing version comment: points to commit 5298d94fb55a ``` --- .github/workflows/ci.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e29c9b5d2..c10ad14b1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -55,12 +55,12 @@ jobs: continue-on-error: ${{ matrix.experimental }} steps: - name: "Check out repository" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: "Set up JDK ${{ matrix.java }} from jdk.java.net" if: ${{ matrix.java == 'EA' }} - uses: oracle-actions/setup-java@ec7274acdd237c7fe61395ed2edda22d756b5afe # v1 + uses: oracle-actions/setup-java@fff43251af9936a0e6a4d5d0946e14f1680e9b6b # v1.5.0 with: website: jdk.java.net release: ${{ matrix.java }} @@ -91,11 +91,11 @@ jobs: continue-on-error: true steps: - name: "Check out repository" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: "Set up GraalVM ${{ matrix.java }}" - uses: graalvm/setup-graalvm@0def53c0fd8534bc13416c9469f5be45265824fd # v1 + uses: graalvm/setup-graalvm@5298d94fb55a4f185c602eeac5de1b553882abe2 # v1.6.4 with: java-version: "25" distribution: "graalvm-community" @@ -117,7 +117,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "Check out repository" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: "Set up JDK 21" From fa9c306e9431a9f6d0ab0612b3435be0a0ab7d92 Mon Sep 17 00:00:00 2001 From: Chris Povirk Date: Mon, 10 Aug 2026 13:56:31 -0400 Subject: [PATCH 3/3] Update version comments to `vX.Y.Z` tags in `release.yml`, too. --- .github/workflows/release.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bfa38106c..47346bffe 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: contents: write steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -107,11 +107,11 @@ jobs: EXTENSION: ${{ matrix.os == 'windows-latest' && '.exe' || '' }} steps: - name: "Check out repository" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: "Set up GraalVM" - uses: graalvm/setup-graalvm@0def53c0fd8534bc13416c9469f5be45265824fd # v1 + uses: graalvm/setup-graalvm@5298d94fb55a4f185c602eeac5de1b553882abe2 # v1.6.4 with: java-version: "25" distribution: "graalvm-community"