ci(gha): check workflow actions against the ASF allowlist

.github/dependabot.yml

@@ -264,13 +264,26 @@ updates:
   # Dependabot never proposes a change of action *namespace*. Migrating to a
   # differently owned action stays a manual step because ASF infrastructure
   # maintains an allow-list of permitted actions.
+  #
+  # Dependabot knows nothing about that allow-list: it resolves the newest
+  # upstream tag and opens a PR whether or not ASF has reviewed the release
+  # yet. The allow-list is only updated when infra merges the matching
+  # Dependabot PR in apache/infrastructure-actions, so a bump proposed here
+  # before that review has landed cannot run and cannot be merged (PR #9116
+  # proposed docker/setup-qemu-action v4.3.0 on 2026-09-05, while the allow-list
+  # still stopped at v4.2.0). The cooldown below is the ASF-recommended way to
+  # let that review land first; `.github/workflows/asf-allowlist-check.yml`
+  # turns any remaining race into a visible failing check instead of a silent
+  # "Startup failure" at run time.
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
       day: monday
       time: "06:00"
       timezone: Etc/UTC
+    cooldown:
+      default: 4
     open-pull-requests-limit: 5
     commit-message:
       prefix: build(deps)

.github/workflows/asf-allowlist-check.yml

@@ -0,0 +1,61 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Verifies that every `uses:` ref in .github/workflows is on the ASF
+# Infrastructure allow list (apache/infrastructure-actions). GitHub blocks
+# actions outside that list at the organisation level, and the resulting job
+# dies with "Startup failure": no logs, no annotation, and a PR that looks
+# green because no check ever ran.
+#
+# This check moves that failure to PR time. It also warns (without failing)
+# when a pinned action's approved version is about to expire, which is how
+# superseded pins are removed from the allow list roughly three months after
+# their replacement is approved.
+#
+# Dependabot covers version bumps; see the github-actions block in
+# .github/dependabot.yml for the cooldown that lets ASF review a release
+# before a bump is proposed here.
+
+name: asf-allowlist-check
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/**"
+
+permissions:
+  contents: read
+
+jobs:
+  asf-allowlist-check:
+    name: ASF action allowlist
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      # `apache/*` is implicitly trusted, but pinning keeps the run reproducible
+      # and lets Dependabot track the monorepo's per-action tag prefix.
+      - uses: apache/infrastructure-actions/allowlist-check@47b297bbe90f580139129bee531bd84bd95b7f5d # allowlist-check/v1.0.4
+        with:
+          scan-glob: ".github/workflows/*.yml"