Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CI/Build] Use commit hash references for github actions #9430

Merged
merged 1 commit into from
Oct 18, 2024
Merged

[CI/Build] Use commit hash references for github actions #9430

merged 1 commit into from
Oct 18, 2024

Conversation

russellb
Copy link
Collaborator

This changes the references to github actions to use commit hashes
instead of tag names. These will be updated automatically by
dependabot.

GitHub recommends this approach as a security best-practice. The
reason is that a bad actor can modify what a tag points to if access
to a repository is compromised. The hash is a more concrete reference.

For more info on this, see "Referencing actions" in this blog post:
https://securitylab.github.com/resources/github-actions-building-blocks/

Signed-off-by: Russell Bryant rbryant@redhat.com

@russellb
[CI/Build] Use commit hash references for github actions
9c9f10a 
This changes the references to github actions to use commit hashes
instead of tag names. These will be updated automatically by
dependabot.

GitHub recommends this approach as a security best-practice. The
reason is that a bad actor can modify what a tag points to if access
to a repository is compromised. The hash is a more concrete reference.

For more info on this, see "Referencing actions" in this blog post:
https://securitylab.github.com/resources/github-actions-building-blocks/

Signed-off-by: Russell Bryant <rbryant@redhat.com>
@github-actions GitHub Actions
Copy link

👋 Hi! Thank you for contributing to the vLLM project.
Just a reminder: PRs would not trigger full CI run by default. Instead, it would only run fastcheck CI which starts running only a small and essential subset of CI tests to quickly catch errors. You can run other CI tests on top of those by going to your fastcheck build on Buildkite UI (linked in the PR checks section) and unblock them. If you do not have permission to unblock, ping simon-mo or khluu to add you in our Buildkite org.

Once the PR is approved and ready to go, your PR reviewer(s) can run CI to test the changes comprehensively before merging.

To run CI, PR reviewers can do one of these:

  • Add ready label to the PR
  • Enable auto-merge.

🚀

@DarkLight1337
Copy link
Member

DarkLight1337 commented Oct 17, 2024 •
edited
Loading

How does this interact with #1217? Can we make the bot open a PR with the hash instead of the version number? (Although that might defeat the purpose of this PR...)

@DarkLight1337
Copy link
Member

Also cc @simon-mo

@russellb
Copy link
Collaborator Author

How does this interact with #1217? Can we make the bot open a PR with the hash instead of the version number? (Although that might defeat the purpose of this PR...)

Yes, dependabot handles this correctly. It will update the hashes.

@russellb
Copy link
Collaborator Author

How does this interact with #1217? Can we make the bot open a PR with the hash instead of the version number? (Although that might defeat the purpose of this PR...)

Yes, dependabot handles this correctly. It will update the hashes.

Here is a sample PR that shows how dependabot does updates in this style: instructlab/instructlab#2418

DarkLight1337
DarkLight1337 reviewed Oct 17, 2024
View reviewed changes
Copy link
Member

@DarkLight1337 DarkLight1337 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the explanation! It should be fine then. I'll leave it to @simon-mo for the final approval.

@DarkLight1337 DarkLight1337 added the ready ONLY add when PR is ready to merge/full CI is needed label Oct 17, 2024
@russellb russellb mentioned this pull request Oct 17, 2024
Merged
@simon-mo simon-mo merged commit 944dd8e into vllm-project:main Oct 18, 2024
51 checks passed
charlifu pushed a commit to charlifu/vllm that referenced this pull request Oct 23, 2024
@russellb @charlifu
[CI/Build] Use commit hash references for github actions (vllm-projec…
b40167b 
…t#9430)

Signed-off-by: charlifu <charlifu@amd.com>
vrdn-23 pushed a commit to vrdn-23/vllm that referenced this pull request Oct 23, 2024
@russellb @vrdn-23
[CI/Build] Use commit hash references for github actions (vllm-projec…
0bf1faf 
…t#9430)

Signed-off-by: Vinay Damodaran <vrdn@hey.com>
Alvant pushed a commit to compressa-ai/vllm that referenced this pull request Oct 26, 2024
@russellb @Alvant
[CI/Build] Use commit hash references for github actions (vllm-projec…
6c05266 
…t#9430)

Signed-off-by: Alvant <alvasian@yandex.ru>
garg-amit pushed a commit to garg-amit/vllm that referenced this pull request Oct 28, 2024
@russellb @garg-amit
[CI/Build] Use commit hash references for github actions (vllm-projec…
6b24204 
…t#9430)

Signed-off-by: Amit Garg <mitgarg17495@gmail.com>
FerdinandZhong pushed a commit to FerdinandZhong/vllm that referenced this pull request Oct 29, 2024
@russellb @FerdinandZhong
[CI/Build] Use commit hash references for github actions (vllm-projec…
d102412 
…t#9430)

Signed-off-by: qishuai <ferdinandzhong@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@DarkLight1337 DarkLight1337 DarkLight1337 left review comments

Assignees
No one assigned
Labels
ready ONLY add when PR is ready to merge/full CI is needed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@russellb @DarkLight1337 @simon-mo