Copilot commented on code in PR #16242:
URL: https://github.com/apache/grails-core/pull/16242#discussion_r3881979043
##########
AGENTS.md:
##########
@@ -239,6 +240,21 @@ class MyService { }
| Build docs | `./gradlew :grails-doc:publishGuide -x aggregateGroovydoc` |
| Debug | `./gradlew bootRun --debug-jvm` |
+## GitHub Actions
+
+Apache GitHub Actions policy blocks third-party actions unless they are on the
organization allowlist. A workflow that uses an unlisted `uses:` SHA fails at
**startup** before any job runs.
+
+The allowlist source of truth is:
+
+https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml
Review Comment:
This is a bare URL in the middle of prose; consider converting it to a
Markdown link (e.g., `[approved_patterns.yml](...)`) for consistency with the
rest of the doc and easier readability.
##########
AGENTS.md:
##########
@@ -239,6 +240,21 @@ class MyService { }
| Build docs | `./gradlew :grails-doc:publishGuide -x aggregateGroovydoc` |
| Debug | `./gradlew bootRun --debug-jvm` |
+## GitHub Actions
+
+Apache GitHub Actions policy blocks third-party actions unless they are on the
organization allowlist. A workflow that uses an unlisted `uses:` SHA fails at
**startup** before any job runs.
+
+The allowlist source of truth is:
+
+https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml
+
+Rules:
+
+- Pin every third-party action to a **full commit SHA** that appears in that
file, with a trailing `# version` comment.
+- `actions/*`, `github/*`, and `apache/*` are allowed by namespace. Still
SHA-pin them for supply-chain consistency.
+- Do not use a newer SHA, tag, or major version until it is on the allowlist.
If you need a new pin, open a PR against `apache/infrastructure-actions`
(`actions.yml`, not the generated `approved_patterns.yml`).
+- Before adding or bumping a `uses:` line, search `approved_patterns.yml` for
that action and copy an approved SHA.
Review Comment:
These two bullets read as slightly contradictory: the first implies the SHA
must appear in `approved_patterns.yml`, while the second says some namespaces
are allowed by namespace (so their SHAs may not be in `approved_patterns.yml`).
Consider rewording to explicitly distinguish (a) third-party actions that must
use an allowlisted SHA from `approved_patterns.yml` vs (b) namespace-allowed
actions that should still be SHA-pinned even if the SHA isn’t listed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
