Comments (12)
The v1 is from Nov 21, 2022, wtf. Using in our workflows a commit sha or a branch name doesn't feel very comfortable. Why creating a new release to establish a new version point for users is a discussion? It is currently the standard in actions and composites usage, they are easier to identify, to use, to document... everything.
I don't think anyone is against a release, the maintainer just hasn't done one so far but the current state is usable. You are also making the commit sha pinning sound overdramatic.. GitHub explicitly recommends it in their security guide, and you can easily just drop a comment next to the sha saying that it's the commit sha for tag x or the node 20 update commit...
Making a fork with with a separate release to just be able to pin to a tag is just way too much.
Pin actions to a full length commit SHA
from action-gh-release.
Closing the loop on this issue this issue along with a number of other now merged prs addressing other features and bugs are included in a new v2 tag
from action-gh-release.
A temporary solution is suggested in #406 (comment), but I'm not sure if the proper action of tagging a new release would be taken soon.
btw you should anyway pin by commit sha instead of version tag, see https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash. There is also some official GitHub doc on this..
from action-gh-release.
I see in this repo that it already update to node20. Meanwhile waiting for official release from the owner repository, we can fork this repository then change it with own.
E.g.
# official softprops/action-gh-release@v1 # our fork {yourusername}/{fork-of-repository-name}@{ref} # example of our fork kresnasatya/action-gh-release@main
But why …? Just use the commit sha
from action-gh-release.
#406 solved the deprecation issue, reported already in #404. This issue here is just a duplicate - only because the new tag has not been made. I believe reading thread in #406 will help understand the current context and situation of maintenance.
We should just be patient, and using commit sha for action is definitely a good practice, recommended by Github as mentioned just above.
from action-gh-release.
The v1 is from Nov 21, 2022, wtf. Using in our workflows a commit sha or a branch name doesn't feel very comfortable. Why creating a new release to establish a new version point for users is a discussion? It is currently the standard in actions and composites usage, they are easier to identify, to use, to document... everything.
from action-gh-release.
@softprops thank you for the work!
from action-gh-release.
This is also happening to me. Is there a newer updated fork of this repo that anyone is using? Not sure if this repo is getting updated anymore.
from action-gh-release.
The migration seems to have already been merged in #406 a week ago, but somehow the new version is not tagged. A temporary solution is suggested in #406 (comment), but I'm not sure if the proper action of tagging a new release would be taken soon.
from action-gh-release.
@softprops sorry to bother but would be possible to have a new version tagged with node20 change?
from action-gh-release.
I see in this repo that it already update to node20. Meanwhile waiting for official release from the owner repository, we can fork this repository then change it with own.
E.g.
# official
softprops/action-gh-release@v1
# our fork
{yourusername}/{fork-of-repository-name}@{ref}
# example of our fork
kresnasatya/action-gh-release@main
from action-gh-release.
I see in this repo that it already update to node20. Meanwhile waiting for official release from the owner repository, we can fork this repository then change it with own.
E.g.# official softprops/action-gh-release@v1 # our fork {yourusername}/{fork-of-repository-name}@{ref} # example of our fork kresnasatya/action-gh-release@main
But why …? Just use the commit sha
Yes, it's possible to use commit sha too. I just give another option beside commit sha.
from action-gh-release.
Related Issues (20)
- GitHub release failed with status: 403 HOT 2
- Encrypt my device HOT 1
- Add parameter "allow_update" to control reuse of existing tag_name HOT 2
- GitHub error 403 undefined HOT 8
- Is this action affected by the CVE-2023-45133 vulnerability
- Uploading artifacts to existing tag/release HOT 3
- Replace Node.js 16 with Node.js 20 HOT 2
- tag_name missing from with, and so I get "⚠️ GitHub Releases requires a tag" error HOT 2
- Specify or auto-detect asset content type, especially for images
- Fail to create release using non-latest commit isa with "GitHub release failed with status: 403" HOT 5
- Node.js 16 actions are deprecated HOT 2
- Unable to overwrite an existing draft release
- Run successful, Release and tag created, but Missing Files HOT 7
- current version does not match any files issue, previous version is okay HOT 4
- make_latest missing in action.yml HOT 2
- v2.0.4 released but not set as latest version HOT 1
- ⚠️ GitHub release failed with status: 422 undefined HOT 6
- files Add array type support HOT 1
- GitHub release failed related to file DexMetadata (.dm) in Android with status: Not Found
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from action-gh-release.