This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch add-asf-allowlist-check in repository https://gitbox.apache.org/repos/asf/storm.git
commit 5b521a8b367a4f4f85997e3dceb5719c1e159582 Author: Richard Zowalla <[email protected]> AuthorDate: Mon Jun 29 19:25:12 2026 +0200 ci: add ASF allowlist check for GitHub Actions Adds a workflow running apache/infrastructure-actions/allowlist-check on PRs touching .github/** (which is what Dependabot's github-actions updater modifies) so that bumps to actions not on the ASF allowlist are caught before merge. Also marks asf-allowlist-check as a required status check on master via .asf.yaml so such PRs are blocked from merging. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> --- .asf.yaml | 7 +++++- .github/workflows/asf-allowlist-check.yml | 42 +++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+), 1 deletion(-) diff --git a/.asf.yaml b/.asf.yaml index ec94ae70c..de058ec88 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -7,7 +7,12 @@ github: homepage: https://storm.apache.org/ protected_branches: # Prevent force pushes to primary branches - master: {} + master: + # Block merges when the ASF allowlist check fails (e.g. a Dependabot + # PR that bumps a GitHub Action to a version not on the ASF allowlist). + required_status_checks: + contexts: + - asf-allowlist-check custom_subjects: new_pr: "[PR] {title} ({repository})" close_pr: "Re: [PR] {title} ({repository})" diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml new file mode 100644 index 000000000..320dab247 --- /dev/null +++ b/.github/workflows/asf-allowlist-check.yml @@ -0,0 +1,42 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +name: ASF Allowlist Check + +on: + workflow_dispatch: + pull_request: + paths: + - ".github/**" + push: + branches: [ "master", "2.x" ] + paths: + - ".github/**" + +permissions: + contents: read + +jobs: + asf-allowlist-check: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - uses: apache/infrastructure-actions/allowlist-check@main + with: + # Storm uses both .yml and .yaml workflow files. + scan-glob: ".github/**/*.{yml,yaml}"
