dnskr opened a new issue, #7456: URL: https://github.com/apache/kyuubi/issues/7456
### Code of Conduct - [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) ### Search before asking - [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues) and found no similar issues. ### Describe the proposal The Apache Software Foundation has a specific policy for using GitHub Actions, which can be found at [GitHub Actions Policy](https://infra.apache.org/github-actions-policy.html). We need to review existing CI workflows and make the necessary changes to ensure the project remains compliant and avoids potential risks. #### Task list - [ ] **Review `pull_request_target` usage** Evaluate the risk in `.github/workflows/labeler.yml`, which uses `pull_request_target` trigger and accesses `GITHUB_TOKEN`. While this is common for labelers, the ASF policy is strict about "ANY confidential credentials". So, we need to confirm if the labeler can be moved to a safer trigger or if its current usage is acceptable under the "very limited circumstances" mentioned in the policy. - [ ] **Ensure job concurrency levels** Make sure the job concurrency level is less than or equal to 20 (or 15). Configuring an explicit `max-parallel` value for all workflows with a matrix can be a good solution to respect these concurrency limits. - [ ] **Enable automatic dependency management for GitHub Actions** All repositories using GitHub Actions must have automatic dependency management in place. Create `.github/dependabot.yml` to manage updates for GitHub Actions, which will also maintain the SHA hashes required/recommended by the pinning policy. - [ ] **Ensure GitHub Actions in ASF org-level allowlist** Add [ASF Allowlist Check](https://github.com/apache/infrastructure-actions/blob/d3e898ebd3169ee0a078359ff8434a09cd081375/allowlist-check/README.md) to verify all `uses:` refs in the project workflows are on the ASF Infrastructure [approved allowlist](https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
