[klesh]

Why

GitHub blocks actions that are not on the ASF org-wide allow list, and a blocked action fails with "Startup failure" — no logs, no annotation, and a PR that looks green because the job never ran.

The allow list lives in apache/infrastructure-actions: actions.yml is the source of truth (per action@sha, with tag and optional expires_at), and approved_patterns.yml is the generated list GitHub enforces. actions/*, github/* and apache/* are implicitly trusted; everything else needs a reviewed entry.

Dependabot does not consult that list. It resolves the newest upstream tag and opens a PR whether or not ASF has reviewed the release. The allow list is only updated when infra merges the matching Dependabot PR in apache/infrastructure-actions, so this project can reference a version that isn't approved yet without noticing.

Concrete example: #9116 proposed docker/setup-qemu-action v4.3.0 on 2026-09-05, while actions.yml as of that date still stopped at v4.2.0.

Changes

.github/workflows/asf-allowlist-check.yml (new)

Runs the check ASF ships for exactly this problem:

- uses: apache/infrastructure-actions/allowlist-check@47b297b # allowlist-check/v1.0.4

• Triggers on pull_request and push to main, paths: .github/** only, so ordinary PRs pay nothing.
• Fails with ::error file=...::X is not on the ASF allowlist, naming the offending ref and file.
• Emits non-failing warnings when an approved pin is nearing its expires_at, which is the early signal for pins that are about to be dropped from the allow list.
• permissions: contents: read, persist-credentials: false.
• apache/* is implicitly trusted, but the pin is reproducible and Dependabot can track the monorepo's # allowlist-check/vX.Y.Z comment.

.github/dependabot.yml

Adds the ASF-recommended cooldown to the github-actions ecosystem, so ASF review has time to land before a bump is proposed here:

    cooldown:
      default: 4

Other ecosystems are untouched. The comment block records the reasoning and the #9116 example so it survives without this PR's context.

Verification

Ran ASF's own checker against the repo rather than eyeballing it:

Checking 13 unique action ref(s) against the ASF allowlist:
  ✅ docker/{login,setup-qemu,setup-buildx,build-push}-action@<sha> — matches allowlist
  ✅ golangci/golangci-lint-action@v9 — matches allowlist   (via golangci/*@*)
  ✅ actions/*, github/*, apache/* — trusted owner
All 13 unique action refs are on the ASF allowlist

Both files parse as YAML; the new workflow carries the ASF license header .licenserc.yaml requires.

Follow-up

Not part of this PR, but note that main's Docker pins expire 2026-11-30 (setup-qemu-action) and 2026-12-09 (setup-buildx-action, build-push-action). #9255 is mergeable: clean and moves all four to their current approved versions — merging it is what prevents this new check from going red in five weeks.

[Startrekzky]

LGTM