ascheman commented on PR #13083: URL: https://github.com/apache/maven/pull/13083#issuecomment-5613790846
**Update after review — reworked, and now green on CI.** The original `docker://rhysd/actionlint` approach was blocked by the ASF allowed-actions policy (the run was a `startup_failure` — external Docker images aren't on the org allowlist), so digest-pinning wouldn't have helped. Reworked to: - **`github/super-linter/slim`** — GitHub-owned, so it's on the ASF allowlist — restricted to `VALIDATE_GITHUB_ACTIONS`, i.e. it runs **actionlint**. SHA-pinned (`b807e99…`, v7). - Added `fetch-depth: 0` (super-linter needs full history). CI is green now ✅. This also resolves the earlier feedback: @gnodet's pinning note (now SHA-pinned) and the Copilot `permissions` note (now `contents: read`). Bonus: super-linter bundles shellcheck/yaml/etc., so coverage can be extended later via more `VALIDATE_*` flags without allowlisting new actions; and the SHA+comment pin is auto-renovated by the repo's existing `github-actions` Dependabot. **Supporting data:** I ran actionlint across 121 locally-checked-out Maven repos — 17 have ≥1 finding (86 total). ~79% are `SC2086` quoting nits, but there's also a real broken shell test in `maven-gh-actions-shared` and a few stale action pins. So a **shared reusable workflow in `apache/maven-gh-actions-shared`** would catch these ecosystem-wide, adopted per-repo over time — which is the open question here: standalone per-repo vs centralize? WDYT @slawekjaranowski? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
