This is an automated email from the ASF dual-hosted git repository. derrickaw pushed a commit to branch 20260720_addApacheActionInfo in repository https://gitbox.apache.org/repos/asf/beam.git
commit cc0b0105b525c7e079916a06193ace76129e113d Author: Derrick Williams <[email protected]> AuthorDate: Mon Jul 20 18:19:14 2026 +0000 add third party allow list check and doc --- .github/workflows/README.md | 9 +++++++++ .github/workflows/beam_PreCommit_GHA.yml | 3 +++ 2 files changed, 12 insertions(+) diff --git a/.github/workflows/README.md b/.github/workflows/README.md index dcc885feec9..41287872ee2 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -58,6 +58,7 @@ On top of normal Actions workflow steps, all new CI workflows (excluding release 4) A set of GitHub token permissions 5) Concurrency Groups 6) Comment Triggering Support +7) Allowed Actions (See below) Each of these is described in more detail below. ## Name and Phrase @@ -165,6 +166,14 @@ In order to make it easier for non-committers to interact with workflows, workfl **Note:** Comment triggering is found not scalable ([#28909](https://github.com/apache/beam/issues/28909)) and is currently limited to a subset of suites. For more information see the [Running Workflows Manually](#running-workflows-manually) section. +## Allowed Actions + +GitHub Actions under the trusted namespaces `actions/*`, `github/*`, and `apache/*` are automatically approved. Any third-party actions outside of these namespaces must be explicitly approved and added to the ASF-wide allowlist before use. + +Additionally, third-party actions must be pinned to a specific Git commit SHA (e.g., `zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02`) instead of a version tag or branch name to comply with ASF security policy. + +For details on the allowlist and how to request new actions, see the [ASF Infrastructure Actions Allowlist Check Documentation](https://github.com/apache/infrastructure-actions/blob/main/allowlist-check/README.md). + # Testing new workflows or workflow updates ## Testing New Workflows diff --git a/.github/workflows/beam_PreCommit_GHA.yml b/.github/workflows/beam_PreCommit_GHA.yml index 7ad6b5e6758..4159a9bfa78 100644 --- a/.github/workflows/beam_PreCommit_GHA.yml +++ b/.github/workflows/beam_PreCommit_GHA.yml @@ -74,6 +74,9 @@ jobs: - uses: actions/checkout@v7 with: persist-credentials: false + # For details on the ASF GHA allowlist, see: https://github.com/apache/infrastructure-actions/blob/main/allowlist-check/README.md + - name: Validate GHA Allowlist + uses: apache/infrastructure-actions/allowlist-check@main # zizmor: ignore[unpinned-uses] - name: Setup repository uses: ./.github/actions/setup-action with:
