Omnia Ibrahim created KAFKA-21290:
-------------------------------------
Summary: Add ASF allowlist check to CI workflows
Key: KAFKA-21290
URL: https://issues.apache.org/jira/browse/KAFKA-21290
Project: Kafka
Issue Type: Improvement
Reporter: Omnia Ibrahim
When a workflow references a GitHub Action that isn’t on the ASF org-level
allowlist, the job dies at startup with no logs and the PR can still look green
— nothing actually ran. We’ve been finding out about this the hard way, after
the fact, when a pin drifts off the approved list.
ASF Infra ships a composite action for exactly this —
{{{}apache/infrastructure-actions/allowlist-check{}}}— that scans every
{{uses:}} ref under {{.github/}} and checks it against the approved allowlist
(with the GitHub/ASF-owned orgs {{{}actions/*{}}}, {{{}github/*{}}},
{{apache/*}} implicitly trusted). It also warns when an approved pin is nearing
its upstream expiry, which is the usual cause of the silent failures.
This adds a small workflow wiring that action in, so we catch an unapproved or
expiring action at PR time instead of mid-CI. It runs on PRs and on a weekly
schedule — the schedule covers the case where an allowlisted pin expires
upstream in a week where we don’t touch {{{}.github/{}}}.
Already in use across other ASF projects (Storm,Lucene, Iceberg), and Infra
auto-PRs it into major repos, so this just brings Kafka in line with the
standard setup.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
