This is an automated email from the ASF dual-hosted git repository.
Startrekzky pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/devlake.git
The following commit(s) were added to refs/heads/main by this push:
new eba2b5b84 ci(gha): check workflow actions against the ASF allowlist
(#9260)
eba2b5b84 is described below
commit eba2b5b84b0595cec4434500f457aae8d007bcec
Author: Klesh Wong <[email protected]>
AuthorDate: Tue Oct 27 18:25:47 2026 +0800
ci(gha): check workflow actions against the ASF allowlist (#9260)
GitHub blocks actions that are not on the ASF org-wide allow list, and a
blocked action fails with "Startup failure": no logs, no annotation, and a
PR that looks green because the job never ran. The allow list lives in
apache/infrastructure-actions and is only updated after infra reviews the
matching Dependabot PR there, so this project can reference a version that
is not approved yet without noticing.
Add the check ASF ships for exactly this: a job running
apache/infrastructure-actions/allowlist-check on any change under .github/,
which fails the PR naming the offending ref, and warns ahead of time when an
approved pin is nearing its expiry date.
Dependabot cannot consult the allow list, so also set the ASF-recommended
cooldown of 4 days on the github-actions ecosystem to give that review time
to land before a bump is proposed here.
Current main passes the check: 13 unique refs, all trusted or allowlisted.
---
.github/dependabot.yml | 13 +++++++
.github/workflows/asf-allowlist-check.yml | 61 +++++++++++++++++++++++++++++++
2 files changed, 74 insertions(+)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 97009cc0b..6df176f27 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -264,6 +264,17 @@ updates:
# Dependabot never proposes a change of action *namespace*. Migrating to a
# differently owned action stays a manual step because ASF infrastructure
# maintains an allow-list of permitted actions.
+ #
+ # Dependabot knows nothing about that allow-list: it resolves the newest
+ # upstream tag and opens a PR whether or not ASF has reviewed the release
+ # yet. The allow-list is only updated when infra merges the matching
+ # Dependabot PR in apache/infrastructure-actions, so a bump proposed here
+ # before that review has landed cannot run and cannot be merged (PR #9116
+ # proposed docker/setup-qemu-action v4.3.0 on 2026-09-05, while the
allow-list
+ # still stopped at v4.2.0). The cooldown below is the ASF-recommended way to
+ # let that review land first; `.github/workflows/asf-allowlist-check.yml`
+ # turns any remaining race into a visible failing check instead of a silent
+ # "Startup failure" at run time.
- package-ecosystem: github-actions
directory: /
schedule:
@@ -271,6 +282,8 @@ updates:
day: monday
time: "06:00"
timezone: Etc/UTC
+ cooldown:
+ default: 4
open-pull-requests-limit: 5
commit-message:
prefix: build(deps)
diff --git a/.github/workflows/asf-allowlist-check.yml
b/.github/workflows/asf-allowlist-check.yml
new file mode 100644
index 000000000..747426ec0
--- /dev/null
+++ b/.github/workflows/asf-allowlist-check.yml
@@ -0,0 +1,61 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Verifies that every `uses:` ref in .github/workflows is on the ASF
+# Infrastructure allow list (apache/infrastructure-actions). GitHub blocks
+# actions outside that list at the organisation level, and the resulting job
+# dies with "Startup failure": no logs, no annotation, and a PR that looks
+# green because no check ever ran.
+#
+# This check moves that failure to PR time. It also warns (without failing)
+# when a pinned action's approved version is about to expire, which is how
+# superseded pins are removed from the allow list roughly three months after
+# their replacement is approved.
+#
+# Dependabot covers version bumps; see the github-actions block in
+# .github/dependabot.yml for the cooldown that lets ASF review a release
+# before a bump is proposed here.
+
+name: asf-allowlist-check
+
+on:
+ workflow_dispatch:
+ pull_request:
+ paths:
+ - ".github/**"
+ push:
+ branches:
+ - main
+ paths:
+ - ".github/**"
+
+permissions:
+ contents: read
+
+jobs:
+ asf-allowlist-check:
+ name: ASF action allowlist
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v7
+ with:
+ persist-credentials: false
+ # `apache/*` is implicitly trusted, but pinning keeps the run
reproducible
+ # and lets Dependabot track the monorepo's per-action tag prefix.
+ - uses:
apache/infrastructure-actions/allowlist-check@47b297bbe90f580139129bee531bd84bd95b7f5d
# allowlist-check/v1.0.4
+ with:
+ scan-glob: ".github/workflows/*.yml"
