Repository navigation
gradle/wrapper-validation-action has wildcard and SHA entry #355
Description
From actions.yml:
gradle/wrapper-validation-action:
'*':
expires_at: 2050-01-01
keep: true
f9c9c575b8b21b6485636a91ffecd10e558c62f6:
tag: v3.5.0
expires_at: 2050-01-01Not sure this makes much sense to have the specific entry, if there's a wildcard entry. However, @raboof mentioned that wildcards should be removed.
Activity
raboof commentedon Nov 7, 2025
Are there any ASF repo's that still use other tags than f9c9c575b8b21b6485636a91ffecd10e558c62f6?
Indeed I think the goal is to remove the wildcard entries (per https://infra.apache.org/github-actions-policy.html)
snazy commentedon Nov 7, 2025
🤷
snazy commentedon Nov 7, 2025
But I suspect it's fine to remove the wildcard for that action, it's been replaced by another one
raboof commentedon Nov 7, 2025
A few it seems. That goes against https://infra.apache.org/github-actions-policy.html but it seems somewhat rude to just break their workflows even if they're noncompliant. I'm not sure infra has any particular plan on how to start enforcing this rule. maybe we should create some issue tracker issues?
Usage of gradle/wrapper-validation-action:
Repositories:
apache/beam
apache/calcite-avatica
apache/fineract-credit-scorecard
apache/groovy-geb
apache/jmeter
apache/samza
apache/solr
Search links:
https://github.com/search?q=repo%3Aapache%2fbeam%20gradle%2Fwrapper-validation-action&type=code
https://github.com/search?q=repo%3Aapache%2fcalcite-avatica%20gradle%2Fwrapper-validation-action&type=code
https://github.com/search?q=repo%3Aapache%2ffineract-credit-scorecard%20gradle%2Fwrapper-validation-action&type=code
https://github.com/search?q=repo%3Aapache%2fgroovy-geb%20gradle%2Fwrapper-validation-action&type=code
https://github.com/search?q=repo%3Aapache%2fjmeter%20gradle%2Fwrapper-validation-action&type=code
https://github.com/search?q=repo%3Aapache%2fsamza%20gradle%2Fwrapper-validation-action&type=code
https://github.com/search?q=repo%3Aapache%2fsolr%20gradle%2Fwrapper-validation-action&type=code
snazy commentedon Nov 10, 2025
Agree, it would be quite rude to break those projects.
It seems possible to remove the need for this action (the corresponding repo is in archived state), as it verifies the binary
gradle-wrapper.jarin the source repo. Went ahead and created a demo repository here illustrating the usage of Gradle without having to have the binarygradle-wrapper.jarin the source tree.raboof commentedon Nov 10, 2025
Looks neat! I wonder what the best way to promote this approach to projects would be... perhaps we should just create a few PRs to get further feedback?
snazy commentedon Nov 11, 2025
Yep!
First PR is up for review.
potiuk commentedon Jul 12, 2026
Resolved. The standalone
gradle/wrapper-validation-action(which carried both a wildcard and a SHA-pinned entry) is no longer inactions.yml. Gradle folded wrapper validation into thegradle/actionsmonorepo, and this repo now listsgradle/actions/wrapper-validationSHA-pinned only (no wildcard), alongsidegradle/actions/setup-gradleandgradle/actions/dependency-submission. No wildcard/SHA duplication remains, so closing.