rusackas opened a new pull request, #43844: URL: https://github.com/apache/superset/pull/43844
### SUMMARY Adds [`apache/infrastructure-actions/allowlist-check`](https://github.com/apache/infrastructure-actions/tree/main/allowlist-check) as a CI workflow. It scans every `uses:` ref under `.github/` and fails the PR if any action isn't on the ASF org-level allowlist. Without this, a non-allowlisted action fails at "Set up job" with no logs and no notification, and only after merge. It also emits a non-failing `::warning::` when a pinned SHA's allowlist entry is about to expire. Airflow, Iceberg, Hive, Avro, Thrift and a dozen other ASF projects already run it. Design notes: - SHA-pinned to `allowlist-check/v1.0.0` (matches Superset's pinning convention and passes zizmor's default `unpinned-uses` policy with no config exemption). The `allowlist-check/` directory is byte-identical between that tag and current `main`, so nothing is lost by pinning. The action always fetches the allowlist itself from `main` at runtime, so the pin only fixes the checker code, not the list. - Triggers on `.github/**` changes (PR + push) and a weekly cron, so expiry warnings surface even when nothing under `.github/` changes. Running the checker locally against `master` turned up two things, both fixed here so the first run is green: 1. **Removed a dead, non-allowlisted workflow file.** `.github/actions/change-detector/label-draft-pr.yml` is a *workflow* that landed under `.github/actions/` in #40159 (a dependabot bump, so it was almost certainly a stray file in that commit). GitHub only runs workflows from `.github/workflows/`, nothing references it, and it pins `actions-ecosystem/action-add-labels@v1`, which is not on the allowlist. It has never run and cannot run from where it sits. 2. **Bumped three expiring docker pins** in `.github/actions/setup-docker/action.yml`. Their allowlist entries expire 2026-09-24, at which point every docker build job would start failing at startup. Bumped to the latest allowlisted releases: `docker/login-action` v4.2.0 → v4.6.0, `docker/setup-buildx-action` v4.1.0 → v4.3.0, `docker/setup-qemu-action` v4.1.0 → v4.2.0. All three are plain node actions with no nested `uses:` steps, so there's no transitive-allowlist gap (the trap we hit in #42506). The login and buildx SHAs are already in use in `mirror-service-images.yml`. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A (CI only) ### TESTING INSTRUCTIONS Local run of the upstream checker against this branch: ``` Checking 37 unique action ref(s) against the ASF allowlist: All 37 unique action refs are on the ASF allowlist ``` Against `master` the same run reports 1 violation (the stray file above) and 3 expiry warnings (the docker pins). Also verified: `zizmor` (regular persona) reports no findings on the new workflow or the edited action, `action-validator` accepts the workflow, and `pre-commit` passes. The new workflow will run on this PR itself since it touches `.github/**`. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01NLZYbrAretVP1D2VaD9HEE -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
