[
https://issues.apache.org/jira/browse/KAFKA-21290?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Omnia Ibrahim updated KAFKA-21290:
----------------------------------
Description:
When a workflow references a GitHub Action that isn’t on the ASF org-level
allowlist, the job dies at startup with no logs and the PR can still look green
— nothing actually ran. We’ve been finding out about this the hard way, after
the fact, when a pin drifts off the approved list.
ASF Infra ships a composite action for exactly this —
{{{}apache/infrastructure-actions/allowlist-check{}}}— that scans every
{{uses:}} ref under {{.github/}} and checks it against the approved allowlist
(with the GitHub/ASF-owned orgs {{{}actions/{}}}, {{{}github/{}}}, {{apache/*}}
implicitly trusted). It also warns when an approved pin is nearing its upstream
expiry, which is the usual cause of the silent failures.
This adds a small workflow wiring that action in, so we catch an unapproved or
expiring action at PR time instead of mid-CI. It runs on PRs and on a weekly
schedule — the schedule covers the case where an allowlisted pin expires
upstream in a week where we don’t touch {{{}.github/{}}}.
Already in use across other ASF projects (Storm,Lucene, Iceberg), and Infra
auto-PRs it into major repos, so this just brings Kafka in line with the
standard setup.
was:
When a workflow references a GitHub Action that isn’t on the ASF org-level
allowlist, the job dies at startup with no logs and the PR can still look green
— nothing actually ran. We’ve been finding out about this the hard way, after
the fact, when a pin drifts off the approved list.
ASF Infra ships a composite action for exactly this —
{{{}apache/infrastructure-actions/allowlist-check{}}}— that scans every
{{uses:}} ref under {{.github/}} and checks it against the approved allowlist
(with the GitHub/ASF-owned orgs {{{}actions/*{}}}, {{{}github/*{}}},
{{apache/*}} implicitly trusted). It also warns when an approved pin is nearing
its upstream expiry, which is the usual cause of the silent failures.
This adds a small workflow wiring that action in, so we catch an unapproved or
expiring action at PR time instead of mid-CI. It runs on PRs and on a weekly
schedule — the schedule covers the case where an allowlisted pin expires
upstream in a week where we don’t touch {{{}.github/{}}}.
Already in use across other ASF projects (Storm,Lucene, Iceberg), and Infra
auto-PRs it into major repos, so this just brings Kafka in line with the
standard setup.
> Add ASF allowlist check to CI workflows
> ---------------------------------------
>
> Key: KAFKA-21290
> URL: https://issues.apache.org/jira/browse/KAFKA-21290
> Project: Kafka
> Issue Type: Improvement
> Reporter: Omnia Ibrahim
> Priority: Minor
>
> When a workflow references a GitHub Action that isn’t on the ASF org-level
> allowlist, the job dies at startup with no logs and the PR can still look
> green — nothing actually ran. We’ve been finding out about this the hard way,
> after the fact, when a pin drifts off the approved list.
> ASF Infra ships a composite action for exactly this —
> {{{}apache/infrastructure-actions/allowlist-check{}}}— that scans every
> {{uses:}} ref under {{.github/}} and checks it against the approved allowlist
> (with the GitHub/ASF-owned orgs {{{}actions/{}}}, {{{}github/{}}},
> {{apache/*}} implicitly trusted). It also warns when an approved pin is
> nearing its upstream expiry, which is the usual cause of the silent failures.
> This adds a small workflow wiring that action in, so we catch an unapproved
> or expiring action at PR time instead of mid-CI. It runs on PRs and on a
> weekly schedule — the schedule covers the case where an allowlisted pin
> expires upstream in a week where we don’t touch {{{}.github/{}}}.
> Already in use across other ASF projects (Storm,Lucene, Iceberg), and Infra
> auto-PRs it into major repos, so this just brings Kafka in line with the
> standard setup.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
