[PR] [improve][ci] Upgrade approved actions and check the ASF allowlist [pulsar-dotpulsar]

["lhotari (via GitHub)" <gi...@apache.org>]

lhotari opened a new pull request, #297:
URL: https://github.com/apache/pulsar-dotpulsar/pull/297

   ### Motivation
   
   Keep CI actions on current revisions and detect ASF allowlist problems before they disrupt future builds. This follows the action upgrades in [apache/pulsar-client-cpp#610](https://github.com/apache/pulsar-client-cpp/pull/610), with the allowlist check included.
   
   ### Modifications
   
   Add `apache/infrastructure-actions/allowlist-check@main` immediately after checkout in the main CI workflow. The added step has no `if:` condition and scans `.github/**/*.y*ml`, covering both workflow and local composite-action YAML files. It uses the default 30-day non-failing expiration warnings and fails on refs missing from the allowlist.
   
   Upgrade GitHub-owned actions to their latest stable majors and pin third-party actions to the latest revisions in [ASF's actions.yml](https://github.com/apache/infrastructure-actions/blob/main/actions.yml), with version comments:
   
   | Action | Previous ref | Updated ref |
   | --- | --- | --- |
   | `actions/checkout` | `v3`, `v4` | `v7` |
   | `actions/setup-dotnet` | `v3`, `v4` | `v6` |
   | `github/codeql-action/analyze` | `v3` | `v4` |
   | `github/codeql-action/init` | `v3` | `v4` |
   
   ### Verifying this change
   
   - `git diff --check` passed.
   - Parsed all `.github` YAML files and verified that the new allowlist step has no condition.
   - Ran the upstream ASF allowlist checker locally against the current allowlist and expiration metadata: all action refs passed.
   - Passed `actionlint -shellcheck= -pyflakes=` on all workflows.
   - CI execution will validate the action upgrades on GitHub-hosted runners; application builds/tests were not run locally for these CI-only changes.
   
   ### Documentation
   
   - [x] `doc-not-needed`: CI maintenance only; no public API or runtime dependency changes.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [improve][ci] Upgrade approved actions and check the ASF allowlist [pulsar-dotpulsar]

["blankensteiner (via GitHub)" <gi...@apache.org>]

blankensteiner merged PR #297:
URL: https://github.com/apache/pulsar-dotpulsar/pull/297


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org