Various small docs improvements #47
Conversation
Signed-off-by: Thomas Steenbergen <[email protected]>
Improved introductory wording for clarity, added a link to GitHub actions documentation to better assist novice users. Signed-off-by: Thomas Steenbergen <[email protected]>
Updated examples to use the main branch and added note advising users to use tagged revisions for production instead of the main branch. This change reduces the need to update the README every time a new revision of the GitHub action for ORT is tagged. Signed-off-by: Thomas Steenbergen <[email protected]>
Signed-off-by: Thomas Steenbergen <[email protected]>
Signed-off-by: Thomas Steenbergen <[email protected]>
Updated copyright year range so it matches NOTICE file. Signed-off-by: Thomas Steenbergen <[email protected]>
tsteenbe
force-pushed
the
small-docs-improvements
branch
from
8b5348e to
047b546
Compare
| run: git config --global url.https://github.com/.insteadOf ssh://[email protected]/ | ||
| - name: Checkout project | ||
| uses: actions/checkout@v3 | ||
| uses: actions/checkout@v5 |
There was a problem hiding this comment.
Suggestion: if you want to get the benefits of dependabot or similar services to autoupdate actions, pin down the action, inclusive, this is one of items that is considered in scorecard.
So, it would be something like:
actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8There was a problem hiding this comment.
@heliocastro I followed the actions/checkout docs which clearly shows to use the v5. Think using hash in action versions looks weird especially in examples
There was a problem hiding this comment.
| run: git config --global url.https://github.com/.insteadOf ssh://[email protected]/ | ||
| - name: Run GitHub Action for ORT | ||
| uses: oss-review-toolkit/ort-ci-github-action@v1 | ||
| uses: oss-review-toolkit/ort-ci-github-action@main |
There was a problem hiding this comment.
Same thing here, avoid @main, which is not seen very well. Consider always tag and pin down
There was a problem hiding this comment.
I guess main is intended here as it's this action itself.
There was a problem hiding this comment.
@heliocastro I switch to using "main" as I prefer not having to update the README every time we tag a new version of the action. We could also change it to a tag called "latest" similar to how we do things for the ORT docker image. Does that work for you?
There was a problem hiding this comment.
So keep with main in this case, but then for external actions, move to pinnning and then is ok
See individual commits for details.