From 3b79d1557ead760ab68afab5825d600b50b7ea85 Mon Sep 17 00:00:00 2001 From: Jeffrey Sica Date: Sat, 31 Oct 2026 21:48:45 -0500 Subject: [PATCH] chore: release v3.5.0 Signed-off-by: Jeffrey Sica --- .github/workflows/prow-bot.yml | 2 +- .github/workflows/prow.yml | 4 +- README.md | 8 +-- docs/automatic-merging.md | 4 +- docs/commands.md | 4 +- docs/configuration.md | 4 +- docs/cron-jobs.md | 4 +- docs/events.md | 2 +- docs/examples.md | 8 +-- docs/installing.md | 20 +++--- docs/pr-jobs.md | 4 +- docs/prow-for-your-org.md | 6 +- docs/releases/v3.5.0.md | 67 +++++++++++++++++++ docs/releasing.md | 4 +- package-lock.json | 4 +- package.json | 2 +- .../workflow-templates/prow-pull-request.yml | 10 +-- templates/workflow-templates/prow.yml | 4 +- 18 files changed, 114 insertions(+), 47 deletions(-) create mode 100644 docs/releases/v3.5.0.md diff --git a/.github/workflows/prow-bot.yml b/.github/workflows/prow-bot.yml index f608d0a8..3b0b5857 100644 --- a/.github/workflows/prow-bot.yml +++ b/.github/workflows/prow-bot.yml @@ -1,5 +1,5 @@ # This repository runs the bot through its own reusable workflow; templates/workflow-templates/prow.yml -# is the same file for consumers, with pull_request_target and @v3.4.0. Kept on pull_request here, so +# is the same file for consumers, with pull_request_target and @v3.5.0. Kept on pull_request here, so # fork pull requests are handled by the scheduled sweep like templates/workflow-templates/prow-pull-request.yml. name: Prow bot on: diff --git a/.github/workflows/prow.yml b/.github/workflows/prow.yml index 5955be8f..fd7cf73b 100644 --- a/.github/workflows/prow.yml +++ b/.github/workflows/prow.yml @@ -2,7 +2,7 @@ # # jobs: # prow: -# uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 +# uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 # # It runs the action at the commit of this very file, so the workflow and the action can # never drift and no floating action tag exists inside it. The caller owns the triggers, @@ -66,7 +66,7 @@ jobs: - name: Require the workflow's own commit if: job.workflow_sha == '' run: | - echo "::error::job.workflow_sha is empty; this reusable workflow needs github.com. Use 'uses: cncf/prow-github-actions@v3.4.0' directly instead." + echo "::error::job.workflow_sha is empty; this reusable workflow needs github.com. Use 'uses: cncf/prow-github-actions@v3.5.0' directly instead." exit 1 # Checks out cncf/prow-github-actions at that commit, never the caller's repository diff --git a/README.md b/README.md index 38d90559..25dbad75 100644 --- a/README.md +++ b/README.md @@ -50,11 +50,11 @@ concurrency: jobs: prow: if: github.event_name != 'workflow_dispatch' && github.event_name != 'push' - uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 + uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 label-sync: if: github.event_name == 'workflow_dispatch' || github.event_name == 'push' - uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 + uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 with: jobs: label-sync ``` @@ -71,7 +71,7 @@ your organization's `.github` repository for label families and `needs-*` rules ([starter](./templates/prow.yaml), [configuration](./docs/configuration.md)). The [Installing](./docs/installing.md) guide covers organizations, upgrading, inputs and secrets. -These docs describe `main`; the latest release is [`v3.4.0`](https://github.com/cncf/prow-github-actions/releases/tag/v3.4.0) +These docs describe `main`; the latest release is [`v3.5.0`](https://github.com/cncf/prow-github-actions/releases/tag/v3.5.0) ([releasing](./docs/releasing.md)). The action requires the `node24` runtime (GitHub requires actions/runner 2.327.1 or newer for node24 on self-hosted runners). @@ -97,7 +97,7 @@ jobs: execute: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: prow-commands: /assign /unassign /cc /uncc /approve /lgtm /hold /close /reopen /lock /retitle /milestone /remove /area /kind /priority /label /lifecycle /stage /status /help /good-first-issue /retest /test /ok-to-test /label-sync /meow github-token: '${{ secrets.GITHUB_TOKEN }}' diff --git a/docs/automatic-merging.md b/docs/automatic-merging.md index 7eb20008..6b0daa6c 100644 --- a/docs/automatic-merging.md +++ b/docs/automatic-merging.md @@ -45,7 +45,7 @@ jobs: execute: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: prow-commands: /lgtm /approve /hold /kind /area /priority /check-required-labels /auto-cc jobs: lgtm @@ -196,7 +196,7 @@ jobs: execute: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: jobs: lgtm github-token: '${{ secrets.GITHUB_TOKEN }}' diff --git a/docs/commands.md b/docs/commands.md index 4022127f..e8b80ac7 100644 --- a/docs/commands.md +++ b/docs/commands.md @@ -1,6 +1,6 @@ # Prow github actions commands -These docs describe `main`; the latest release is `v3.4.0` ([releasing](./releasing.md)). +These docs describe `main`; the latest release is `v3.5.0` ([releasing](./releasing.md)). ## Command syntax @@ -161,7 +161,7 @@ jobs: prow: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: prow-commands: /meow github-token: '${{ secrets.GITHUB_TOKEN }}' diff --git a/docs/configuration.md b/docs/configuration.md index f384aaf9..8b0b45d8 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -27,7 +27,7 @@ The configuration is read once per run, however many commands the comment carrie ### The `config` input ```yaml -- uses: cncf/prow-github-actions@v3.4.0 +- uses: cncf/prow-github-actions@v3.5.0 with: config: cncf/prow-config:configs/prow.yaml@v1 github-token: ${{ secrets.GITHUB_TOKEN }} @@ -212,7 +212,7 @@ jobs: execute: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: jobs: label-sync github-token: '${{ secrets.GITHUB_TOKEN }}' diff --git a/docs/cron-jobs.md b/docs/cron-jobs.md index 9d245dce..b5103e9a 100644 --- a/docs/cron-jobs.md +++ b/docs/cron-jobs.md @@ -68,7 +68,7 @@ jobs: execute: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: jobs: sweep lgtm github-token: '${{ secrets.GITHUB_TOKEN }}' @@ -112,7 +112,7 @@ jobs: execute: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: jobs: label-sync github-token: '${{ secrets.GITHUB_TOKEN }}' diff --git a/docs/events.md b/docs/events.md index a105fa59..feb6fa65 100644 --- a/docs/events.md +++ b/docs/events.md @@ -67,7 +67,7 @@ jobs: execute: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: prow-commands: /lgtm /approve /hold /kind /area /priority /check-required-labels /auto-cc jobs: lgtm diff --git a/docs/examples.md b/docs/examples.md index a1dc543a..8f12e1ec 100644 --- a/docs/examples.md +++ b/docs/examples.md @@ -100,7 +100,7 @@ jobs: execute: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: prow-commands: /approve /lgtm github-token: '${{ secrets.GITHUB_TOKEN }}' @@ -127,7 +127,7 @@ jobs: execute: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: prow-commands: /assign /approve /retitle /area /kind /priority /lgtm /close /reopen /hold /cc /uncc /retest /test /ok-to-test github-token: '${{ secrets.GITHUB_TOKEN }}' @@ -152,7 +152,7 @@ jobs: execute: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: prow-commands: /triage github-token: '${{ secrets.GITHUB_TOKEN }}' @@ -178,7 +178,7 @@ jobs: execute: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: prow-commands: /meow github-token: '${{ secrets.GITHUB_TOKEN }}' diff --git a/docs/installing.md b/docs/installing.md index 1965cc4b..1063ef61 100644 --- a/docs/installing.md +++ b/docs/installing.md @@ -59,11 +59,11 @@ concurrency: jobs: prow: if: github.event_name != 'workflow_dispatch' && github.event_name != 'push' - uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 + uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 label-sync: if: github.event_name == 'workflow_dispatch' || github.event_name == 'push' - uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 + uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 with: jobs: label-sync ``` @@ -105,7 +105,7 @@ flags it; a hash-pinning policy often comes with it). The second template, + if: github.event_name != 'workflow_dispatch' && github.event_name != 'push' && github.event_name != 'schedule' + sweep: + if: github.event_name == 'schedule' -+ uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 ++ uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 + with: + jobs: sweep lgtm ``` @@ -118,8 +118,8 @@ any, on a comment (`/lgtm`, `/approve`, ...) | the `issue_comment` run, which ha Caveat: an `lgtm` label applied **by hand** on a fork pull request cannot be [bound to the commit](./automatic-merging.md#lgtm-is-bound-to-a-commit) by the read-only run, -so the sweep strips it with a comment; use `/lgtm`. Organizations that hash-pin replace `@v3.4.0` -in the template with the release's commit sha and a `# v3.4.0` comment; Dependabot keeps it +so the sweep strips it with a comment; use `/lgtm`. Organizations that hash-pin replace `@v3.5.0` +in the template with the release's commit sha and a `# v3.5.0` comment; Dependabot keeps it current. ## An organization @@ -141,7 +141,7 @@ pass a token with read access to it: ```yaml jobs: prow: - uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 + uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 secrets: token: ${{ secrets.PROW_TOKEN }} ``` @@ -153,9 +153,9 @@ lookup ([the `config` input](./configuration.md#the-config-input)). Ref | Behaviour --- | --- -`@v3.4.0` | Exact release, what the templates ship. [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot)'s `github-actions` ecosystem proposes the next release (it also updates reusable-workflow `uses:` refs). +`@v3.5.0` | Exact release, what the templates ship. [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot)'s `github-actions` ecosystem proposes the next release (it also updates reusable-workflow `uses:` refs). `@v3` | Floats: `release.yml` moves it to every stable `v3.x.y` that is newer than the one it points at (a backport to an older minor leaves it alone). Nothing to do; you get every fix and every minor change without review. -`@ # v3.4.0` | Hash pinning; the commit is on the [release page](https://github.com/cncf/prow-github-actions/releases/tag/v3.4.0). Dependabot keeps the comment and the sha in step. +`@ # v3.5.0` | Hash pinning; the commit is on the [release page](https://github.com/cncf/prow-github-actions/releases/tag/v3.5.0). Dependabot keeps the comment and the sha in step. Whatever the ref, the reusable workflow checks out the action at the **same commit as the workflow file**, so a caller pinned to a sha runs exactly that action bundle and a floating @@ -191,7 +191,7 @@ Secret | Default | Meaning ```yaml jobs: prow: - uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 + uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 with: prow-commands: /lgtm /approve /hold /kind /area /priority /meow merge-method: squash @@ -219,6 +219,6 @@ Label sections (`/kind`, `/area`, `/priority`, ...) and `needs-*` rules need a ` ## Using the action directly -The action itself is still `uses: cncf/prow-github-actions@v3.4.0` with the same inputs; it is the +The action itself is still `uses: cncf/prow-github-actions@v3.5.0` with the same inputs; it is the way on GitHub Enterprise Server and for workflows that mix it with other steps. The [events](./events.md#recommended-triggers) page has the direct form of the caller above. diff --git a/docs/pr-jobs.md b/docs/pr-jobs.md index 9f65c31b..b80c52b5 100644 --- a/docs/pr-jobs.md +++ b/docs/pr-jobs.md @@ -31,7 +31,7 @@ jobs: execute: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: jobs: lgtm github-token: '${{ secrets.GITHUB_TOKEN }}' @@ -63,7 +63,7 @@ jobs: execute: runs-on: ubuntu-latest steps: - - uses: cncf/prow-github-actions@v3.4.0 + - uses: cncf/prow-github-actions@v3.5.0 with: jobs: lgtm github-token: '${{ secrets.GITHUB_TOKEN }}' diff --git a/docs/prow-for-your-org.md b/docs/prow-for-your-org.md index 3df09862..d1de3cb3 100644 --- a/docs/prow-for-your-org.md +++ b/docs/prow-for-your-org.md @@ -129,7 +129,7 @@ concurrency: jobs: prow: if: github.event_name != 'workflow_dispatch' && github.event_name != 'push' - uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 + uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 # optional; the defaults enable every built-in command and the lgtm job # with: # prow-commands: /lgtm /approve /hold /kind /area /priority @@ -141,12 +141,12 @@ jobs: label-sync: if: github.event_name == 'workflow_dispatch' || github.event_name == 'push' - uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 + uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 with: jobs: label-sync ``` -The templates pin the release `@v3.4.0`; [upgrading](./installing.md#upgrading) covers moving to +The templates pin the release `@v3.5.0`; [upgrading](./installing.md#upgrading) covers moving to newer releases, the floating `v3` tag and hash pinning. The `permissions` block is the ceiling: the reusable workflow can only downgrade what the caller grants ([installing](./installing.md#one-repository)). Inputs, secrets and upgrading are covered diff --git a/docs/releases/v3.5.0.md b/docs/releases/v3.5.0.md new file mode 100644 index 00000000..e8a31c3c --- /dev/null +++ b/docs/releases/v3.5.0.md @@ -0,0 +1,67 @@ +# v3.5.0 + +A hardening release: authorization gaps closed, commands that fail now say so, fewer GitHub API +calls per event, and an App server that survives bad input, slow handlers and rolling updates. +`@v3` callers get it automatically; `@v3.4.0` pins move to `@v3.5.0`. + +## Commands + +- **Authorization.** `/unassign @user` and `/uncc @user` now require the commenter to be an org + member or repository collaborator (self-unassign and self-uncc are unchanged). `/remove` refuses + `lgtm`, `approved`, `hold` and `do-not-merge/*` labels and points to the cancel command. Commands + run only on a *created* comment; editing an old comment no longer re-runs it. +- **Exclusive label families** (`/priority`, `/lifecycle`, `/stage`, `/status`, `exclusive: true`) + take one value; `/priority low high` is refused and the issue is left untouched. +- **Exact cancel matching.** `/lgtm cancel`, `/hold cancel` and `/approve cancel` are a cancel only + when the whole argument is `cancel`; a sentence that merely contains the word no longer removes a + label. `LGTM` on a repository that spells the label that way now cancels. +- **Refusals are reported.** A refused `/close`, `/reopen`, `/retitle` or self `/assign` fails the + run with ` is not authorized to …`, like `/lock` and `/milestone`; when several commands in + one comment fail, every failure is reported. `/approve`, `/cc` and `/uncc` on an issue reply that + they only apply to pull requests. +- `/milestone` pages through all open milestones; `/retitle` validates its title (1–256 chars). + +## Plugins and cron jobs + +- One bad item no longer aborts the run: the sweep, tide, blunderbuss, the lgtm cron and the App's + per-installation schedule each isolate per-item failures and continue. +- The bot resolves its own identity from the token instead of assuming `github-actions[bot]`, so + under a GitHub App tide dequeues the entries it enqueued, `/approve cancel` finds its own review, + and the approve plugin ignores its own label writes. +- blunderbuss skips users who already reviewed and counts requested teams toward + `max_request_count`. OWNERS rules survive a truncated tree listing. A deleted fork + (`head.repo: null`) is treated as a fork. `merge-method` is trimmed, case-insensitive, and an + unknown value warns before falling back to `merge`. +- Fewer and parallel API calls: auth checks, the comment thread, the root OWNERS and the Octokit + client are memoized per run; config probes, OWNERS probes and label removals run concurrently. + +## App server (beta) + +- `POST /webhook` is capped at 25 MB (`413`); App-level events with no repository get `202 ignored` + instead of a `400`; a failed delivery is forgotten so GitHub's redelivery runs it again (Node, + Redis and Cloudflare KV stores alike). +- Redis locks renew while a handler runs; waiters back off with jitter; `/readyz` answers `503` + whenever Redis is not ready and during the `PROW_SHUTDOWN_DRAIN_MS` drain on `SIGTERM`. +- Cloudflare Worker: one platform scope per isolate, a real per-pull-request lock in the Durable + Object, a retrying queue path with a dead-letter queue (`prow-jobs-dlq`), and tokens minted only + where they are read. + +## Upgrading + +Nothing to do for the action. Helm users: the chart's Deployment, Service and PDB now select +`app.kubernetes.io/component: server` so CronJob pods never receive webhook traffic. A Deployment's +selector cannot change in place, so delete it once before `helm upgrade` (see +[Kubernetes](https://github.com/cncf/prow-github-actions/blob/v3.5.0/docs/github-app.md#kubernetes)): + +```sh +kubectl delete deployment prow-prow-github-app # -prow-github-app +helm upgrade prow oci://ghcr.io/cncf/prow-github-actions/charts/prow-github-app --version 3.5.0 … +``` + +The chart also raises `terminationGracePeriodSeconds` to 75 and adds `cronjob.activeDeadlineSeconds` +(default 3000); `values.schema.json` now rejects unknown keys. + +## Verification + +The SBOM, its cosign signature and the SLSA provenance are attached to this release; the commands +are under *SBOM and provenance* below. diff --git a/docs/releasing.md b/docs/releasing.md index 50dbb9ea..60d8eacf 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -50,7 +50,7 @@ highest in its major, and `X.Y` only when it is the highest in its minor. A backport `v3.3.2` tagged after `v3.4.0` therefore publishes `3.3.2` and `3.3` and leaves `3`, `v3` and `latest` on `v3.4.0`. -The templates, the README and the docs pin the **exact** release (`@v3.4.0`) on +The templates, the README and the docs pin the **exact** release (`@v3.5.0`) on purpose: organizations that hash-pin can replace it with the release's commit sha, and Dependabot bumps it to the next release. The floating `v3` tag keeps moving for callers who prefer it ([upgrading](./installing.md#upgrading)). @@ -161,7 +161,7 @@ Releases follow [SemVer](https://semver.org/) with `v`-prefixed tags - uses: cncf/prow-github-actions@v3 # or pin to an exact release, what the templates ship -- uses: cncf/prow-github-actions@v3.4.0 +- uses: cncf/prow-github-actions@v3.5.0 ``` The same refs work for the reusable workflow, diff --git a/package-lock.json b/package-lock.json index a72135a5..206457ee 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "prow-github-actions", - "version": "3.4.0", + "version": "3.5.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "prow-github-actions", - "version": "3.4.0", + "version": "3.5.0", "license": "MIT", "dependencies": { "@actions/core": "^3.0.1", diff --git a/package.json b/package.json index 8024e68e..b4343021 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "prow-github-actions", - "version": "3.4.0", + "version": "3.5.0", "description": "Slash commands, jobs, and chat-ops for Github actions inspired by Kubernetes Prow", "author": "John McBride", "license": "MIT", diff --git a/templates/workflow-templates/prow-pull-request.yml b/templates/workflow-templates/prow-pull-request.yml index 4484ebf5..4221a02c 100644 --- a/templates/workflow-templates/prow-pull-request.yml +++ b/templates/workflow-templates/prow-pull-request.yml @@ -3,8 +3,8 @@ # prow.yaml. Docs: https://github.com/cncf/prow-github-actions/blob/main/docs/installing.md#without-pull_request_target # # Choose this template over prow.yml when your policy forbids pull_request_target (zizmor's -# dangerous-triggers audit, for instance). Organizations that hash-pin replace `@v3.4.0` below with a -# commit sha and a `# v3.4.0` comment. +# dangerous-triggers audit, for instance). Organizations that hash-pin replace `@v3.5.0` below with a +# commit sha and a `# v3.5.0` comment. # # What changes compared to prow.yml: # - pull_request and pull_request_review runs for a fork pull request get a read-only token, so @@ -54,7 +54,7 @@ concurrency: jobs: prow: if: github.event_name != 'workflow_dispatch' && github.event_name != 'push' && github.event_name != 'schedule' - uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 + uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 # optional; the defaults enable every built-in command and the lgtm job # with: # prow-commands: /lgtm /approve /hold /kind /area /priority @@ -67,12 +67,12 @@ jobs: # fork pull requests updated within sweep.lookback (default 1h), plus the lgtm backstop sweep: if: github.event_name == 'schedule' - uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 + uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 with: jobs: sweep lgtm label-sync: if: github.event_name == 'workflow_dispatch' || github.event_name == 'push' - uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 + uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 with: jobs: label-sync diff --git a/templates/workflow-templates/prow.yml b/templates/workflow-templates/prow.yml index e44b52d8..b512acd3 100644 --- a/templates/workflow-templates/prow.yml +++ b/templates/workflow-templates/prow.yml @@ -43,7 +43,7 @@ concurrency: jobs: prow: if: github.event_name != 'workflow_dispatch' && github.event_name != 'push' - uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 + uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 # optional; the defaults enable every built-in command and the lgtm job # with: # prow-commands: /lgtm /approve /hold /kind /area /priority @@ -55,6 +55,6 @@ jobs: label-sync: if: github.event_name == 'workflow_dispatch' || github.event_name == 'push' - uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0 + uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0 with: jobs: label-sync