[jira] [Created] (KAFKA-21290) Add ASF allowlist check to CI workflows

["Omnia Ibrahim (Jira)" <ji...@apache.org>]

Omnia Ibrahim created KAFKA-21290:
-------------------------------------

             Summary: Add ASF allowlist check to CI workflows
                 Key: KAFKA-21290
                 URL: https://issues.apache.org/jira/browse/KAFKA-21290
             Project: Kafka
          Issue Type: Improvement
            Reporter: Omnia Ibrahim


When a workflow references a GitHub Action that isn’t on the ASF org-level allowlist, the job dies at startup with no logs and the PR can still look green — nothing actually ran. We’ve been finding out about this the hard way, after the fact, when a pin drifts off the approved list.

ASF Infra ships a composite action for exactly this — {{{}apache/infrastructure-actions/allowlist-check{}}}— that scans every {{uses:}} ref under {{.github/}} and checks it against the approved allowlist (with the GitHub/ASF-owned orgs {{{}actions/*{}}}, {{{}github/*{}}}, {{apache/*}} implicitly trusted). It also warns when an approved pin is nearing its upstream expiry, which is the usual cause of the silent failures.

This adds a small workflow wiring that action in, so we catch an unapproved or expiring action at PR time instead of mid-CI. It runs on PRs and on a weekly schedule — the schedule covers the case where an allowlisted pin expires upstream in a week where we don’t touch {{{}.github/{}}}.

Already in use across other ASF projects (Storm,Lucene, Iceberg), and Infra auto-PRs it into major repos, so this just brings Kafka in line with the standard setup.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)