Summary

If none of your client repos use drivers-github-tools, close this ticket as "Fix Not Needed."

drivers-github-tools now cuts real, immutable, versioned releases (e.g. v3.0.1) through a new release workflow, instead of only moving a floating major-version tag. Driver teams currently pinned to the floating @v3 tag should migrate to an exact vX.Y.Z tag or its commit SHA. Floating tags will only continue to exist for v3 — once v4 ships, there is no floating v4 tag, so teams still on the floating pattern need to move before using v4.

There is no current plan to make a v4 release, it will happen when we need to make a breaking change.

Example

Before (floating tag):

- name: secure-checkout
  uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
  with: 
    app_id: ${{ vars.APP_ID }}
    private_key: ${{ secrets.APP_PRIVATE_KEY }}

After (exact version, pinned to its commit SHA):

- name: secure-checkout
  uses: mongodb-labs/drivers-github-tools/secure-checkout@1d1e7e4d7b9f7f3c700ecf33ab39acc226b6b43b  # v3.0.1
  with: 
    app_id: ${{ vars.APP_ID }}
    private_key: ${{ secrets.APP_PRIVATE_KEY }}

Motivation

Who is the affected end user?

MongoDB driver teams whose CI references mongodb-labs/drivers-github-tools actions pinned to the floating @v3 tag.

How does this affect the end user?

Not blocked today — v3 still moves. But they're relying on a mutable reference (already flagged by Semgrep's github-actions-mutable-action-tag rule as a supply-chain risk), and that pattern stops existing once v4 ships.

How likely is it that this problem or use case will occur?

Main path — every driver repo currently pinned to @v3 is affected.

If the problem does occur, what are the consequences and how severe are they?

Low severity today. If a team doesn't migrate before v4, they lose the floating tag they've been relying on and must switch to exact-version pinning anyway, under more time pressure.

Is this issue urgent?

No fixed deadline, but should land before drivers-github-tools cuts a v4 release.

Is this ticket required by a downstream team?

No — proactive migration guidance, not a specific downstream ask.

Is this ticket only for tests?

No, functional change to each affected repo's CI configuration.

Acceptance Criteria

• Driver repos currently pinned to the floating @v3 tag are identified.
• Each identified repo is notified of the migration and the v4 floating-tag change.
• Each repo's pin is updated to an exact vX.Y.Z tag or SHA.