From 0a4b543fa3def1afa7146279f457a59db7314f24 Mon Sep 17 00:00:00 2001
From: Klesh Wong <klesh@qq.com>
Date: Tue, 27 Oct 2026 11:29:35 +0800
Subject: [PATCH] ci(gha): check workflow actions against the ASF allowlist

GitHub blocks actions that are not on the ASF org-wide allow list, and a
blocked action fails with "Startup failure": no logs, no annotation, and a
PR that looks green because the job never ran. The allow list lives in
apache/infrastructure-actions and is only updated after infra reviews the
matching Dependabot PR there, so this project can reference a version that
is not approved yet without noticing.

Add the check ASF ships for exactly this: a job running
apache/infrastructure-actions/allowlist-check on any change under .github/,
which fails the PR naming the offending ref, and warns ahead of time when an
approved pin is nearing its expiry date.

Dependabot cannot consult the allow list, so also set the ASF-recommended
cooldown of 4 days on the github-actions ecosystem to give that review time
to land before a bump is proposed here.

Current main passes the check: 13 unique refs, all trusted or allowlisted.
---
 .github/dependabot.yml                    | 13 +++++
 .github/workflows/asf-allowlist-check.yml | 61 +++++++++++++++++++++++
 2 files changed, 74 insertions(+)
 create mode 100644 .github/workflows/asf-allowlist-check.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 97009cc0bc7..6df176f2740 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -264,6 +264,17 @@ updates:
   # Dependabot never proposes a change of action *namespace*. Migrating to a
   # differently owned action stays a manual step because ASF infrastructure
   # maintains an allow-list of permitted actions.
+  #
+  # Dependabot knows nothing about that allow-list: it resolves the newest
+  # upstream tag and opens a PR whether or not ASF has reviewed the release
+  # yet. The allow-list is only updated when infra merges the matching
+  # Dependabot PR in apache/infrastructure-actions, so a bump proposed here
+  # before that review has landed cannot run and cannot be merged (PR #9116
+  # proposed docker/setup-qemu-action v4.3.0 on 2026-09-05, while the allow-list
+  # still stopped at v4.2.0). The cooldown below is the ASF-recommended way to
+  # let that review land first; `.github/workflows/asf-allowlist-check.yml`
+  # turns any remaining race into a visible failing check instead of a silent
+  # "Startup failure" at run time.
   - package-ecosystem: github-actions
     directory: /
     schedule:
@@ -271,6 +282,8 @@ updates:
       day: monday
       time: "06:00"
       timezone: Etc/UTC
+    cooldown:
+      default: 4
     open-pull-requests-limit: 5
     commit-message:
       prefix: build(deps)
diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml
new file mode 100644
index 00000000000..747426ec052
--- /dev/null
+++ b/.github/workflows/asf-allowlist-check.yml
@@ -0,0 +1,61 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Verifies that every `uses:` ref in .github/workflows is on the ASF
+# Infrastructure allow list (apache/infrastructure-actions). GitHub blocks
+# actions outside that list at the organisation level, and the resulting job
+# dies with "Startup failure": no logs, no annotation, and a PR that looks
+# green because no check ever ran.
+#
+# This check moves that failure to PR time. It also warns (without failing)
+# when a pinned action's approved version is about to expire, which is how
+# superseded pins are removed from the allow list roughly three months after
+# their replacement is approved.
+#
+# Dependabot covers version bumps; see the github-actions block in
+# .github/dependabot.yml for the cooldown that lets ASF review a release
+# before a bump is proposed here.
+
+name: asf-allowlist-check
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/**"
+
+permissions:
+  contents: read
+
+jobs:
+  asf-allowlist-check:
+    name: ASF action allowlist
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      # `apache/*` is implicitly trusted, but pinning keeps the run reproducible
+      # and lets Dependabot track the monorepo's per-action tag prefix.
+      - uses: apache/infrastructure-actions/allowlist-check@47b297bbe90f580139129bee531bd84bd95b7f5d # allowlist-check/v1.0.4
+        with:
+          scan-glob: ".github/workflows/*.yml"