This is an automated email from the ASF dual-hosted git repository.
adoroszlai pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ratis.git
The following commit(s) were added to refs/heads/master by this push:
new d5c00341f RATIS-2588. Add check for allowed action usage in workflows
(#1507)
d5c00341f is described below
commit d5c00341f6396750a4b5e444b365e313a81c0de5
Author: Doroszlai, Attila <[email protected]>
AuthorDate: Sun Jul 5 08:02:30 2026 +0200
RATIS-2588. Add check for allowed action usage in workflows (#1507)
---
.../{zizmor.yml => asf-allowlist-check.yaml} | 37 ++++++++++++++--------
.github/workflows/{zizmor.yml => zizmor.yaml} | 0
2 files changed, 23 insertions(+), 14 deletions(-)
diff --git a/.github/workflows/zizmor.yml
b/.github/workflows/asf-allowlist-check.yaml
similarity index 52%
copy from .github/workflows/zizmor.yml
copy to .github/workflows/asf-allowlist-check.yaml
index 36d715ea2..dfbcec3aa 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/asf-allowlist-check.yaml
@@ -13,28 +13,37 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-name: zizmor
+name: "ASF Allowlist Check"
on:
+ workflow_dispatch:
+ pull_request:
+ paths:
+ - ".github/workflows/**"
push:
branches-ignore:
- 'dependabot/**'
tags:
- '**'
- pull_request:
+ paths:
+ - ".github/workflows/**"
-permissions: { }
+permissions:
+ contents: read
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number ||
case(github.repository_owner == 'apache', github.sha, github.ref_name) }}
+ cancel-in-progress: ${{ github.event_name == 'pull_request' ||
github.repository_owner != 'apache' }}
jobs:
- zizmor:
- runs-on: ubuntu-latest
- permissions:
- security-events: write
+ asf-allowlist-check:
+ runs-on: ubuntu-slim
steps:
- - name: Checkout project
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- with:
- persist-credentials: false
-
- - name: Run zizmor
- uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa
# v0.5.7
+ - name: Checkout project
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #
v7.0.0
+ with:
+ persist-credentials: false
+ - name: Check actions
+ uses:
apache/infrastructure-actions/allowlist-check@775350a154e610e84c460cb1bbe2d2ab26c15cb3
+ with:
+ scan-glob: ".github/workflows/*.y*ml"
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yaml
similarity index 100%
rename from .github/workflows/zizmor.yml
rename to .github/workflows/zizmor.yaml
