This is an automated email from the ASF dual-hosted git repository.
derrickaw pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/beam.git
The following commit(s) were added to refs/heads/master by this push:
new 414b48ad644 add Apache third party allow list check and doc (#39392)
414b48ad644 is described below
commit 414b48ad644d7fda3db4d2b81f9931f6a40d0394
Author: Derrick Williams <[email protected]>
AuthorDate: Tue Jul 21 13:23:12 2026 -0400
add Apache third party allow list check and doc (#39392)
* add third party allow list check and doc
* add python action and shift validate further down
* fix two workflow/action issues caught during test run
* reuse setup environment step per comment
---
.github/actions/setup-k8s-access/action.yml | 2 +-
.github/workflows/README.md | 9 +++++++++
.github/workflows/beam_Infrastructure_UsersPermissions.yml | 2 +-
.github/workflows/beam_PreCommit_GHA.yml | 12 ++++++++----
4 files changed, 19 insertions(+), 6 deletions(-)
diff --git a/.github/actions/setup-k8s-access/action.yml
b/.github/actions/setup-k8s-access/action.yml
index cb00c853738..264aa77cfc8 100644
--- a/.github/actions/setup-k8s-access/action.yml
+++ b/.github/actions/setup-k8s-access/action.yml
@@ -68,7 +68,7 @@ runs:
run: |
kubectl config set-context --current --namespace=${{
steps.replace_namespace.outputs.TEST_NAMESPACE }}
- name: Post cleanup
- uses: pyTooling/Actions/[email protected]
+ uses:
pytooling/actions/with-post-step@42e17fae05f224e5ac3d79d021a4e3577878efe5 #
v4.2.2
with:
main: echo "Post Cleanup"
post: |
diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index dcc885feec9..41287872ee2 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -58,6 +58,7 @@ On top of normal Actions workflow steps, all new CI workflows
(excluding release
4) A set of GitHub token permissions
5) Concurrency Groups
6) Comment Triggering Support
+7) Allowed Actions (See below)
Each of these is described in more detail below.
## Name and Phrase
@@ -165,6 +166,14 @@ In order to make it easier for non-committers to interact
with workflows, workfl
**Note:** Comment triggering is found not scalable
([#28909](https://github.com/apache/beam/issues/28909)) and is currently
limited to a subset of suites. For more information see the [Running Workflows
Manually](#running-workflows-manually) section.
+## Allowed Actions
+
+GitHub Actions under the trusted namespaces `actions/*`, `github/*`, and
`apache/*` are automatically approved. Any third-party actions outside of these
namespaces must be explicitly approved and added to the ASF-wide allowlist
before use.
+
+Additionally, third-party actions must be pinned to a specific Git commit SHA
(e.g., `zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02`)
instead of a version tag or branch name to comply with ASF security policy.
+
+For details on the allowlist and how to request new actions, see the [ASF
Infrastructure Actions Allowlist Check
Documentation](https://github.com/apache/infrastructure-actions/blob/main/allowlist-check/README.md).
+
# Testing new workflows or workflow updates
## Testing New Workflows
diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml
b/.github/workflows/beam_Infrastructure_UsersPermissions.yml
index 0e806034b5c..b188e5ff875 100644
--- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml
+++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml
@@ -52,7 +52,7 @@ jobs:
- name: Setup gcloud
uses:
google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
- name: Install Terraform
- uses: hashicorp/setup-terraform@v4
+ uses:
hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
with:
terraform_version: 1.12.2
- name: Initialize Terraform
diff --git a/.github/workflows/beam_PreCommit_GHA.yml
b/.github/workflows/beam_PreCommit_GHA.yml
index 7ad6b5e6758..fa3d2c9605b 100644
--- a/.github/workflows/beam_PreCommit_GHA.yml
+++ b/.github/workflows/beam_PreCommit_GHA.yml
@@ -80,15 +80,19 @@ jobs:
comment_phrase: ${{ matrix.job_phrase }}
github_token: ${{ secrets.GITHUB_TOKEN }}
github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
- - name: Run zizmor
- uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02
# v0.6.0
- with:
- advanced-security: true
- name: Setup environment
uses: ./.github/actions/setup-environment-action
with:
java-version: default
go-version: default
+ python-version: default
+ # For details on the ASF GHA allowlist, see:
https://github.com/apache/infrastructure-actions/blob/main/allowlist-check/README.md
+ - name: Validate GHA Allowlist
+ uses: apache/infrastructure-actions/allowlist-check@main # zizmor:
ignore[unpinned-uses]
+ - name: Run zizmor
+ uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02
# v0.6.0
+ with:
+ advanced-security: true
- name: run GHA PreCommit script
uses: ./.github/actions/gradle-command-self-hosted-action
with:
