klesh opened a new pull request, #9260: URL: https://github.com/apache/devlake/pull/9260
## Why GitHub blocks actions that are not on the ASF org-wide allow list, and a blocked action fails with **"Startup failure"** — no logs, no annotation, and a PR that looks green because the job never ran. The allow list lives in [`apache/infrastructure-actions`](https://github.com/apache/infrastructure-actions): `actions.yml` is the source of truth (per `action@sha`, with `tag` and optional `expires_at`), and `approved_patterns.yml` is the generated list GitHub enforces. `actions/*`, `github/*` and `apache/*` are implicitly trusted; everything else needs a reviewed entry. **Dependabot does not consult that list.** It resolves the newest upstream tag and opens a PR whether or not ASF has reviewed the release. The allow list is only updated when infra merges the matching Dependabot PR in `apache/infrastructure-actions`, so this project can reference a version that isn't approved yet without noticing. Concrete example: [#9116](https://github.com/apache/devlake/pull/9116) proposed `docker/setup-qemu-action` v4.3.0 on 2026-09-05, while `actions.yml` as of that date still stopped at v4.2.0. ## Changes ### `.github/workflows/asf-allowlist-check.yml` (new) Runs the check ASF ships for exactly this problem: ```yaml - uses: apache/infrastructure-actions/allowlist-check@47b297b # allowlist-check/v1.0.4 ``` - Triggers on `pull_request` and `push` to `main`, `paths: .github/**` only, so ordinary PRs pay nothing. - Fails with `::error file=...::X is not on the ASF allowlist`, naming the offending ref and file. - Emits **non-failing** warnings when an approved pin is nearing its `expires_at`, which is the early signal for pins that are about to be dropped from the allow list. - `permissions: contents: read`, `persist-credentials: false`. - `apache/*` is implicitly trusted, but the pin is reproducible and Dependabot can track the monorepo's `# allowlist-check/vX.Y.Z` comment. ### `.github/dependabot.yml` Adds the ASF-recommended cooldown to the `github-actions` ecosystem, so ASF review has time to land before a bump is proposed here: ```yaml cooldown: default: 4 ``` Other ecosystems are untouched. The comment block records the reasoning and the #9116 example so it survives without this PR's context. ## Verification Ran ASF's own checker against the repo rather than eyeballing it: ``` Checking 13 unique action ref(s) against the ASF allowlist: ✅ docker/{login,setup-qemu,setup-buildx,build-push}-action@<sha> — matches allowlist ✅ golangci/golangci-lint-action@v9 — matches allowlist (via golangci/*@*) ✅ actions/*, github/*, apache/* — trusted owner All 13 unique action refs are on the ASF allowlist ``` Both files parse as YAML; the new workflow carries the ASF license header `.licenserc.yaml` requires. ## Follow-up Not part of this PR, but note that `main`'s Docker pins expire **2026-11-30** (`setup-qemu-action`) and **2026-12-09** (`setup-buildx-action`, `build-push-action`). [#9255](https://github.com/apache/devlake/pull/9255) is `mergeable: clean` and moves all four to their current approved versions — merging it is what prevents this new check from going red in five weeks. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
