Update release refs for 2.20-stable #2956
Conversation
There was a problem hiding this comment.
Pull Request Overview
Updates the release workflow to use the canonical drivers-github-tools repository and stable tag, and removes unused Silk-related configuration.
- Switch actions from jamis/drivers-github-tools to mongodb-labs/drivers-github-tools and pin to v3
- Remove SILK_ASSET_GROUP env and silk_asset_group input from publish job
- Delete the now-unused .github/release.yml (comment-only file)
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/release.yml | Points workflow steps to mongodb-labs/drivers-github-tools@v3 and drops Silk-specific env/input. |
| .github/release.yml | Removes a comment-only file related to auto-generated release notes. |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| - name: "Run the check action" | ||
| id: check | ||
| uses: jamis/drivers-github-tools/ruby/pr-check@ruby-3643-update-release-process | ||
| uses: mongodb-labs/drivers-github-tools/ruby/pr-check@v3 |
There was a problem hiding this comment.
Pin GitHub Actions to a specific commit SHA instead of a floating tag (v3) to prevent supply chain attacks. Example: uses: mongodb-labs/drivers-github-tools/ruby/pr-check@ with a comment noting the corresponding tag.
| uses: mongodb-labs/drivers-github-tools/ruby/pr-check@v3 | |
| # v3.2.1 | |
| uses: mongodb-labs/drivers-github-tools/ruby/pr-check@c0ffee1234567890abcdef1234567890abcdef12 |
| steps: | ||
| - name: "Run the build action" | ||
| uses: jamis/drivers-github-tools/ruby/build@ruby-3643-update-release-process | ||
| uses: mongodb-labs/drivers-github-tools/ruby/build@v3 |
There was a problem hiding this comment.
Pin this action to a full commit SHA rather than the v3 tag to reduce the risk of tag hijacking. Example: uses: mongodb-labs/drivers-github-tools/ruby/build@ and optionally annotate the tag in a comment.
| uses: mongodb-labs/drivers-github-tools/ruby/build@v3 | |
| # v3 tag | |
| uses: mongodb-labs/drivers-github-tools/ruby/build@a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0 |
| steps: | ||
| - name: "Run the publish action" | ||
| uses: jamis/drivers-github-tools/ruby/publish@ruby-3643-update-release-process | ||
| uses: mongodb-labs/drivers-github-tools/ruby/publish@v3 |
There was a problem hiding this comment.
Similarly, pin the publish action to a specific commit SHA instead of the v3 tag to ensure immutability of the workflow dependency.
| uses: mongodb-labs/drivers-github-tools/ruby/publish@v3 | |
| uses: mongodb-labs/drivers-github-tools/ruby/publish@a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0 |
1 participant
Update the release references to point to the canonical repo and tag