This is an automated email from the ASF dual-hosted git repository.
rzo1 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/storm.git
The following commit(s) were added to refs/heads/master by this push:
new c79b8b791 ci: add ASF allowlist check for GitHub Actions (#8817)
c79b8b791 is described below
commit c79b8b7918a780493c0c6c86a26167feb6195d6f
Author: Richard Zowalla <[email protected]>
AuthorDate: Tue Jun 30 11:28:58 2026 +0200
ci: add ASF allowlist check for GitHub Actions (#8817)
Adds a workflow running apache/infrastructure-actions/allowlist-check on
PRs touching .github/** (which is what Dependabot's github-actions
updater modifies) so that bumps to actions not on the ASF allowlist are
caught before merge. Also marks asf-allowlist-check as a required status
check on master via .asf.yaml so such PRs are blocked from merging.
---
.asf.yaml | 7 ++++-
.github/workflows/asf-allowlist-check.yml | 44 +++++++++++++++++++++++++++++++
2 files changed, 50 insertions(+), 1 deletion(-)
diff --git a/.asf.yaml b/.asf.yaml
index ec94ae70c..de058ec88 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -7,7 +7,12 @@ github:
homepage: https://storm.apache.org/
protected_branches:
# Prevent force pushes to primary branches
- master: {}
+ master:
+ # Block merges when the ASF allowlist check fails (e.g. a Dependabot
+ # PR that bumps a GitHub Action to a version not on the ASF allowlist).
+ required_status_checks:
+ contexts:
+ - asf-allowlist-check
custom_subjects:
new_pr: "[PR] {title} ({repository})"
close_pr: "Re: [PR] {title} ({repository})"
diff --git a/.github/workflows/asf-allowlist-check.yml
b/.github/workflows/asf-allowlist-check.yml
new file mode 100644
index 000000000..c488652cc
--- /dev/null
+++ b/.github/workflows/asf-allowlist-check.yml
@@ -0,0 +1,44 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: ASF Allowlist Check
+
+on:
+ workflow_dispatch:
+ pull_request:
+ paths:
+ - ".github/**"
+ push:
+ branches: [ "master", "2.x" ]
+ paths:
+ - ".github/**"
+
+permissions:
+ contents: read
+
+jobs:
+ asf-allowlist-check:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #
v6.0.3
+ with:
+ persist-credentials: false
+
+ - uses: apache/infrastructure-actions/allowlist-check@main
+ with:
+ # Storm uses both .yml and .yaml workflow files. The check uses
+ # Python's glob.glob(), which does not support brace expansion, so
+ # use *.y*ml to match both extensions in a single pattern.
+ scan-glob: ".github/**/*.y*ml"
