mirror of
https://github.com/owncloud/ocis.git
synced 2026-10-23 23:29:02 +03:00
aab12d018e
Tagging v9.0.0-rc.1 produced a startup_failure: the workflow was rejected before any job ran. owncloud pins Actions to an org allowlist (owncloud/admin:actions-allowlist.yml, allowed_actions: selected with sha_pinning_required), and three pins in this file are not on it: docker/setup-buildx-action @f87e5991 v4.4.1 (allowlist has v4.0.0) docker/login-action @dbcb8138 v4.6.0 (allowlist has v4.1.0) docker/build-push-action @c3c9e263 v7.4.0 (allowlist has v7.0.0) Allowlist validation happens at parse time, so it does not care that all three only appear in jobs already marked `if: false`. Rather than pin them back, drop the jobs. Building, scanning and publishing the production image moved to owncloud-docker/ocis, which is why these were disabled in the first place; the image Trivy scan now runs there on every PR. That leaves nothing to maintain here and removes all three offending pins. Removes docker-build, docker-scan (dead too: it needs docker-build), docker-manifest and docker-readme. Nothing outside that subgraph depended on them, so the `docker_repos` and `is_production` outputs, the PRODUCTION_RELEASE_TAGS / DOCKER_REPO_ROLLING / DOCKER_REPO_PRODUCTION env vars and the REPOS computation go with them. is_prerelease stays, as create-github-release still reads it. The filesystem scan in security-scan-trivy is untouched. Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>