`gradle/wrapper-validation-action` has wildcard and SHA entry

[snazy]

From actions.yml:

gradle/wrapper-validation-action:
  '*':
    expires_at: 2050-01-01
    keep: true
  f9c9c575b8b21b6485636a91ffecd10e558c62f6:
    tag: v3.5.0
    expires_at: 2050-01-01

Not sure this makes much sense to have the specific entry, if there's a wildcard entry. However, @raboof mentioned that wildcards should be removed.

[raboof]

Are there any ASF repo's that still use other tags than f9c9c575b8b21b6485636a91ffecd10e558c62f6?

Indeed I think the goal is to remove the wildcard entries (per https://infra.apache.org/github-actions-policy.html)

[snazy]

Are there any ASF repo's that still use other tags than f9c9c575b8b21b6485636a91ffecd10e558c62f6?

🤷

[snazy]

But I suspect it's fine to remove the wildcard for that action, it's been replaced by another one

[raboof]

A few it seems. That goes against https://infra.apache.org/github-actions-policy.html but it seems somewhat rude to just break their workflows even if they're noncompliant. I'm not sure infra has any particular plan on how to start enforcing this rule. maybe we should create some issue tracker issues?

$ ./utils/action-usage.sh gradle/wrapper-validation-action

Usage of gradle/wrapper-validation-action:

Repositories:
apache/beam
apache/calcite-avatica
apache/fineract-credit-scorecard
apache/groovy-geb
apache/jmeter
apache/samza
apache/solr

Search links:
https://github.com/search?q=repo%3Aapache%2fbeam%20gradle%2Fwrapper-validation-action&type=code
https://github.com/search?q=repo%3Aapache%2fcalcite-avatica%20gradle%2Fwrapper-validation-action&type=code
https://github.com/search?q=repo%3Aapache%2ffineract-credit-scorecard%20gradle%2Fwrapper-validation-action&type=code
https://github.com/search?q=repo%3Aapache%2fgroovy-geb%20gradle%2Fwrapper-validation-action&type=code
https://github.com/search?q=repo%3Aapache%2fjmeter%20gradle%2Fwrapper-validation-action&type=code
https://github.com/search?q=repo%3Aapache%2fsamza%20gradle%2Fwrapper-validation-action&type=code
https://github.com/search?q=repo%3Aapache%2fsolr%20gradle%2Fwrapper-validation-action&type=code

[snazy]

Agree, it would be quite rude to break those projects.

It seems possible to remove the need for this action (the corresponding repo is in archived state), as it verifies the binary gradle-wrapper.jar in the source repo. Went ahead and created a demo repository here illustrating the usage of Gradle without having to have the binary gradle-wrapper.jar in the source tree.

[raboof]

Looks neat! I wonder what the best way to promote this approach to projects would be... perhaps we should just create a few PRs to get further feedback?

[snazy]

Yep!
First PR is up for review.