rzo1 opened a new pull request, #8817: URL: https://github.com/apache/storm/pull/8817
## What Adds a CI check that validates every referenced GitHub Action against the [ASF allowlist](https://github.com/apache/infrastructure-actions/tree/main/allowlist-check), and wires it in as a required status check on `master`. ## Why Dependabot's `github-actions` ecosystem updater opens PRs that bump action versions. Without this guard, an update could point us at an action that is **not** on the ASF allowlist, which would only surface later (or get merged). This makes the violation fail fast on the PR. ## How - **New workflow** `.github/workflows/asf-allowlist-check.yml` - Runs `apache/infrastructure-actions/allowlist-check@main`. - Triggers on `pull_request` (and `push` to `master`/`2.x`) limited to `paths: .github/**` — exactly the files Dependabot's github-actions updater touches. - `scan-glob: ".github/**/*.{yml,yaml}"` because Storm mixes both `.yml` and `.yaml` workflow files (the action's default only matches `.yml`). - `permissions: contents: read`, `persist-credentials: false` per ASF guidance. - **`.asf.yaml`**: adds `asf-allowlist-check` to `required_status_checks.contexts` on `master` so failing PRs are blocked from merging (branch protection on ASF repos is managed via `.asf.yaml`, not the GitHub UI). 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
