[PR] [2.x] Add ASF allowlist-check workflow for GitHub Actions (opennlp)

["rzo1 (via GitHub)" <gi...@apache.org>]

rzo1 opened a new pull request, #1134:
URL: https://github.com/apache/opennlp/pull/1134

   Backport of the `ASF Allowlist Check` workflow to the `opennlp-2.x` branch.
   
   ## Change
   
   Adds a new `ASF Allowlist Check` workflow (`.github/workflows/allowlist-check.yml`)
   that runs [`apache/infrastructure-actions/allowlist-check`](https://github.com/apache/infrastructure-actions/tree/main/allowlist-check).
   
   The action scans the `uses:` references in `.github/**/*.yml` against ASF's
   approved-actions allowlist and fails if a disallowed GitHub Action is referenced.
   
   ## Why
   
   Dependabot's `github-actions` ecosystem opens PRs that modify our workflow files.
   This check ensures such updates (and any other workflow change) cannot introduce a
   GitHub Action that is not on the ASF allowlist before it gets merged.
   
   ## Triggers
   
   - `pull_request` touching `.github/**` (covers Dependabot Actions PRs)
   - `push` to `main` / `opennlp-2.x` touching `.github/**`
   - manual `workflow_dispatch`
   
   Runs with `contents: read` only; `actions/checkout` is SHA-pinned with
   `persist-credentials: false`. The ASF action is referenced at `@main` per ASF infra
   guidance (it is itself allowlisted, so it won't trip its own check).
   
   > [!NOTE]
   > To make this *block* merges, `asf-allowlist-check` should be added as a required
   > status check in the branch protection rules for `main`.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@opennlp.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org