rusackas commented on code in PR #43844:
URL: https://github.com/apache/superset/pull/43844#discussion_r3936731143
##########
.github/workflows/asf-allowlist-check.yml:
##########
@@ -0,0 +1,42 @@
+# Verifies that every `uses:` ref under .github/ is on the ASF Infrastructure
+# GitHub Actions allowlist (apache/infrastructure-actions). An action that is
+# not allowlisted fails at "Set up job" with no logs and no notification, so
+# this check surfaces the problem at PR time instead. It also warns (without
+# failing) when a pinned SHA's allowlist entry is about to expire.
+name: ASF Allowlist Check
+
+on:
+ workflow_dispatch:
+ pull_request:
+ paths:
+ - ".github/**"
Review Comment:
Good catch — added `ready_for_review` to the trigger types so a
draft-to-ready transition without new commits still runs the check.
##########
.github/workflows/asf-allowlist-check.yml:
##########
@@ -0,0 +1,42 @@
+# Verifies that every `uses:` ref under .github/ is on the ASF Infrastructure
+# GitHub Actions allowlist (apache/infrastructure-actions). An action that is
+# not allowlisted fails at "Set up job" with no logs and no notification, so
+# this check surfaces the problem at PR time instead. It also warns (without
+# failing) when a pinned SHA's allowlist entry is about to expire.
+name: ASF Allowlist Check
+
+on:
+ workflow_dispatch:
+ pull_request:
+ paths:
+ - ".github/**"
+ push:
+ branches:
+ - "master"
+ - "[0-9].[0-9]*"
+ paths:
+ - ".github/**"
+ schedule:
+ # Weekly, so allowlist expirations are surfaced even when nothing under
+ # .github/ has changed.
+ - cron: "0 6 * * 1"
+
+permissions:
+ contents: read
+
+# cancel previous workflow jobs for PRs
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number ||
github.run_id }}
+ cancel-in-progress: true
+
+jobs:
+ asf-allowlist-check:
+ runs-on: ubuntu-26.04
+ steps:
+ - name: Checkout Repository
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
+ with:
+ persist-credentials: false
+
+ - name: Check action refs against the ASF allowlist
+ uses:
apache/infrastructure-actions/allowlist-check@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# allowlist-check/v1.0.0
Review Comment:
@sadpandajoe Confirmed — the underlying action defaults to
`.github/**/*.yml`. Passed `scan-glob: ".github/**/*.y*ml"` so it covers both
extensions without a brace pattern (Python's glob module doesn't support
those). No fixture to add here since the scanning logic itself lives in
apache/infrastructure-actions, not this repo.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
