You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@asyncband.apache.org by ti...@apache.org on 2026/08/23 16:36:01 UTC
(asyncband) branch main updated: ci: check GitHub Actions against ASF allowlist (#178)
This is an automated email from the ASF dual-hosted git repository.
tisonkun pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/asyncband.git
The following commit(s) were added to refs/heads/main by this push:
new 0f4013a ci: check GitHub Actions against ASF allowlist (#178)
0f4013a is described below
commit 0f4013ab5be93679bd0a274fcafeed8bffd52a63
Author: tison <wa...@gmail.com>
AuthorDate: Mon Aug 24 00:35:56 2026 +0800
ci: check GitHub Actions against ASF allowlist (#178)
---
.github/dependabot.yml | 36 +++++++++++++++++++++++++
.github/workflows/asf-allowlist-check.yml | 45 +++++++++++++++++++++++++++++++
.github/workflows/ci.yml | 14 +++++-----
.github/workflows/release.yml | 6 ++---
4 files changed, 91 insertions(+), 10 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..27079d1
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,36 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+version: 2
+updates:
+ - package-ecosystem: github-actions
+ directory: "/"
+ schedule:
+ interval: weekly
+ # Give ASF Infrastructure time to approve new action releases first.
+ cooldown:
+ default-days: 4
+ commit-message:
+ prefix: ci
+ groups:
+ github-actions:
+ patterns:
+ - "*"
+ github-actions-security:
+ applies-to: security-updates
+ patterns:
+ - "*"
diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml
new file mode 100644
index 0000000..7a79c71
--- /dev/null
+++ b/.github/workflows/asf-allowlist-check.yml
@@ -0,0 +1,45 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: ASF Allowlist Check
+
+on:
+ workflow_dispatch:
+ # Detect allowlist removals and expiry warnings even without workflow changes.
+ schedule:
+ - cron: "17 3 * * 1"
+ pull_request:
+ paths:
+ - ".github/**"
+ push:
+ branches:
+ - main
+ paths:
+ - ".github/**"
+
+permissions:
+ contents: read
+
+jobs:
+ asf-allowlist-check:
+ runs-on: ubuntu-24.04
+ timeout-minutes: 10
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+ - uses: apache/infrastructure-actions/allowlist-check@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # allowlist-check/v1.0.0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3c123d3..566de0d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,7 +47,7 @@ jobs:
env:
RUSTUP_TOOLCHAIN: nightly
steps:
- - uses: actions/checkout@v7
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install nightly toolchain
run: >-
rustup toolchain install nightly
@@ -56,8 +56,8 @@ jobs:
--component clippy
--allow-downgrade
--no-self-update
- - uses: Swatinem/rust-cache@v2
- - uses: taiki-e/install-action@v2
+ - uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+ - uses: taiki-e/install-action@6cd13508893c0e7eab5f273c2575d3859bd7229a # v2.86.6
with:
tool: typos-cli,taplo-cli,hawkeye
- run: cargo x lint
@@ -76,13 +76,13 @@ jobs:
env:
RUSTUP_TOOLCHAIN: ${{ matrix.rust-version }}
steps:
- - uses: actions/checkout@v7
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Rust ${{ matrix.rust-version }}
run: >-
rustup toolchain install ${{ matrix.rust-version }}
--profile minimal
--no-self-update
- - uses: Swatinem/rust-cache@v2
+ - uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
- name: Run unit tests
run: cargo x test --no-capture
shell: bash
@@ -94,13 +94,13 @@ jobs:
env:
RUSTUP_TOOLCHAIN: stable
steps:
- - uses: actions/checkout@v7
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install stable toolchain
run: >-
rustup toolchain install stable
--profile minimal
--no-self-update
- - uses: Swatinem/rust-cache@v2
+ - uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
- run: cargo x bench
required:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fc2de17..62edbc6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -42,7 +42,7 @@ jobs:
outputs:
version: ${{ steps.package.outputs.version }}
steps:
- - uses: actions/checkout@v7
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
- name: Install stable toolchain
@@ -101,7 +101,7 @@ jobs:
contents: read
id-token: write
steps:
- - uses: actions/checkout@v7
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install stable toolchain
run: >-
rustup toolchain install stable
@@ -109,7 +109,7 @@ jobs:
--no-self-update
- id: auth
name: Authenticate with crates.io
- uses: rust-lang/crates-io-auth-action@v1
+ uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
- name: Publish asyncband
run: cargo publish --package asyncband --locked
env:
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For additional commands, e-mail: commits-help@asyncband.apache.org