)]}'
{
  "commit": "09c196cf0af1270bac6c55f07cf099d0418c45df",
  "tree": "ec6604844994c772a90da31a80e63fe39da9b9d2",
  "parents": [
    "9cbf91b3e2274823b195743c334f3badccc4506f"
  ],
  "author": {
    "name": "James Fredley",
    "email": "jamesfredley@users.noreply.github.com",
    "time": "Fri May 29 13:09:58 2026 -0400"
  },
  "committer": {
    "name": "James Fredley",
    "email": "jamesfredley@users.noreply.github.com",
    "time": "Fri May 29 13:09:58 2026 -0400"
  },
  "message": "ci: audit and update GitHub Actions to ASF-approved versions\n\nPin every external GitHub Action to a full commit SHA from the ASF\napproved actions allow-list, with a trailing comment naming the version\nit resolves to. Mirrors the grails-core audit in apache/grails-core#15690.\n\n- actions/checkout -\u003e de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (was v4, v5)\n- actions/setup-java -\u003e be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 (was v4, v5)\n- gradle/actions/setup-gradle -\u003e 50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 (was 0723195856401067f7a2779048b490ace7a47d7c # v5.0.2)\n- actions/upload-artifact -\u003e 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 (was 50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0)\n- release-drafter/release-drafter -\u003e e1247478eabc9f6d9cf5ec2b3547469b0e1d2767 # v7.3.1 (was 6a93d829887aa2e0748befe2e808c66c0ec6e4c7 # v6.4.0)\n- softprops/action-gh-release -\u003e b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 (was 153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1)\n\nAdd cache-provider: basic to all 7 setup-gradle steps so caching\nstays on the MIT-licensed provider rather than the proprietary enhanced\nprovider introduced in gradle/actions v6 (Gradle commercial Terms of Use).\n\nFirst-party apache/grails-github-actions/* and local ./.github/actions/*\nreferences are intentionally left unchanged.\n\nAssisted-by: claude-code:claude-4.8-opus\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ee5a47234b8b1f5306491fe4c9802409a20299bd",
      "old_mode": 33188,
      "old_path": ".github/workflows/gradle.yml",
      "new_id": "38c9f179cc6859796e00cbfb8023bf5671eeb5f0",
      "new_mode": 33188,
      "new_path": ".github/workflows/gradle.yml"
    },
    {
      "type": "modify",
      "old_id": "fed8dcbbca35fcc091ce44ba12bc2e81a45477fb",
      "old_mode": 33188,
      "old_path": ".github/workflows/rat.yml",
      "new_id": "a3e6d76ec4f96618f169e4671a820abc019e06c4",
      "new_mode": 33188,
      "new_path": ".github/workflows/rat.yml"
    },
    {
      "type": "modify",
      "old_id": "5406729fa522011c4e2dd2014d932df36a1b4cf6",
      "old_mode": 33188,
      "old_path": ".github/workflows/release-notes.yml",
      "new_id": "f33448cf451ffc9a0db888374a4bdc586291f686",
      "new_mode": 33188,
      "new_path": ".github/workflows/release-notes.yml"
    },
    {
      "type": "modify",
      "old_id": "5551cd6c7e24e9c6dc9aa9e61d8205535e31e49c",
      "old_mode": 33188,
      "old_path": ".github/workflows/release.yml",
      "new_id": "81b49a9ba58e22c93378c9d5412b071fcd69536b",
      "new_mode": 33188,
      "new_path": ".github/workflows/release.yml"
    }
  ]
}