(grails-core) branch fix/forge-aws-allowlist-7.1 created (now 769204caa0)

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jamesfredley pushed a change to branch fix/forge-aws-allowlist-7.1
in repository https://gitbox.apache.org/repos/asf/grails-core.git


      at 769204caa0 Pin Forge AWS credentials action to an ASF-approved SHA

This branch includes the following new commits:

     new 769204caa0 Pin Forge AWS credentials action to an ASF-approved SHA

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(grails-core) 01/01: Pin Forge AWS credentials action to an ASF-approved SHA

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jamesfredley pushed a commit to branch fix/forge-aws-allowlist-7.1
in repository https://gitbox.apache.org/repos/asf/grails-core.git

commit 769204caa086bb889533c0fa6882813e32008c1b
Author: James Fredley <ja...@users.noreply.github.com>
AuthorDate: Fri Aug 28 11:32:17 2026 -0400

    Pin Forge AWS credentials action to an ASF-approved SHA
    
    Use aws-actions/configure-aws-credentials v6.2.0 from
    apache/infrastructure-actions approved_patterns.yml. The previous
    v5.1.0 pin is not on the allowlist and fails workflow startup.
    
    Document the allowlist in AGENTS.md so future workflow edits copy an
    approved SHA instead of a newer unlisted tag.
---
 .github/workflows/forge-deploy-aws.yml |  2 +-
 AGENTS.md                              | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/forge-deploy-aws.yml b/.github/workflows/forge-deploy-aws.yml
index 101e54fcb6..9033033319 100644
--- a/.github/workflows/forge-deploy-aws.yml
+++ b/.github/workflows/forge-deploy-aws.yml
@@ -192,7 +192,7 @@ jobs:
           fi
 
       - name: "Configure AWS credentials through OIDC"
-        uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
         with:
           role-to-assume: ${{ env.DEPLOY_ROLE_ARN }}
           aws-region: ${{ inputs.aws_region }}
diff --git a/AGENTS.md b/AGENTS.md
index 4e0eee64db..02dd976900 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -52,6 +52,7 @@ export GRADLE_OPTS="-Xms2G -Xmx5G"
 9. **Test via public APIs** - Tests must exercise behavior through the same APIs an end user calls; never invoke internal implementations, package-private methods, or bypass the public surface directly
 10. **Always review and extend tests** - Review existing unit and functional tests before making changes; every code change must include new or enhanced tests that cover the affected behavior
 11. **The BOM must manage the latest version** - `validateDependencyVersions` enforces that the BOM (`dependencies.gradle`) manages a version `>=` every transitively-resolved version. When it fails, **bump the version in `dependencies.gradle`** so the BOM wins — never silence it with `allowedBomOverrides` or an exclusion unless there is an explicit, documented conflict or an agreed-upon workaround. See [Dependency Management](#dependency-management).
+12. **GitHub Actions must use ASF-approved pins** - Every third-party action SHA must appear in the ASF allowlist. See [GitHub Actions](#github-actions).
 
 ## Available Skills
 
@@ -224,6 +225,21 @@ class MyService { }
 | Build docs | `./gradlew :grails-doc:publishGuide -x aggregateGroovydoc` |
 | Debug | `./gradlew bootRun --debug-jvm` |
 
+## GitHub Actions
+
+Apache GitHub Actions policy blocks third-party actions unless they are on the organization allowlist. A workflow that uses an unlisted `uses:` SHA fails at **startup** before any job runs.
+
+The allowlist source of truth is:
+
+https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml
+
+Rules:
+
+- Pin every third-party action to a **full commit SHA** that appears in that file, with a trailing `# version` comment.
+- `actions/*`, `github/*`, and `apache/*` are allowed by namespace. Still SHA-pin them for supply-chain consistency.
+- Do not use a newer SHA, tag, or major version until it is on the allowlist. If you need a new pin, open a PR against `apache/infrastructure-actions` (`actions.yml`, not the generated `approved_patterns.yml`).
+- Before adding or bumping a `uses:` line, search `approved_patterns.yml` for that action and copy an approved SHA.
+
 ## Branch Naming (Auto-Labels PRs)
 
 | Prefix | Label |