ci: check GitHub Actions against ASF allowlist - #3612
Merged
Merged
Conversation
git-hulk
approved these changes
Sep 10, 2026
jihuayu
approved these changes
Sep 10, 2026
git-hulk
enabled auto-merge (squash)
September 10, 2026 07:13
10 tasks
chaokunyang
added a commit
to apache/fory
that referenced
this pull request
Sep 27, 2026
## Why? The [ASF allowlist job](https://github.com/apache/fory/actions/runs/36290519259/job/108539571389) fails because the three `graalvm/setup-graalvm@6f3fa030c4b8f77c1f554a860f593a654538fa38` references are no longer allowlisted. ## What does this PR do? - Update all three GraalVM setup references to the ASF-approved v1.6.6 commit `0426e2e191540e8514dff98dc52a5f5146a2a276`. - Add Dependabot for GitHub Actions, following [apache/kvrocks#3612](apache/kvrocks#3612): weekly grouped version updates, a four-day cooldown, separate security-update grouping, and the `ci` commit prefix. ## Validation - Run the exact ASF checker used by the failing job against a frozen current allowlist: the baseline reproduces all three rejections; this change passes with all 30 unique action references approved. - Yamllint passes across all 46 YAML files, with existing comment-spacing warnings only. - Dependabot schema validation, Prettier checks for both changed files, and `git diff --check` pass. - Both fresh reviewers report no actionable findings. [Review results and validation evidence](https://gist.github.com/chaokunyang/65d9191831e5955390ed8d00530bed7d). ## AI Usage Disclosure - substantial_ai_assistance: yes - scope: CI diagnosis, configuration changes, local validation, and review - affected_files_or_subsystems: `.github/workflows/ci.yml` and `.github/dependabot.yml` - ai_review: assistant line-by-line self-review completed, followed by fresh Fory-guided and independent general reviewers; both reported no actionable findings on the final patch in `1bf4b7ce380749785274f5154d9b46b22fa0ce74` - ai_review_artifacts: [Fory-guided and independent review results](https://gist.github.com/chaokunyang/65d9191831e5955390ed8d00530bed7d) - human_verification: the checks above were executed and their results reviewed by the assistant; human contributor verification is not asserted by this automated record - performance_verification: not applicable; CI configuration only - provenance_license_confirmation: Dependabot configuration follows the Apache-licensed Kvrocks reference and preserves its ASF license header; no runtime or third-party code is introduced ## AI Contribution Checklist - [x] Substantial AI assistance was used: yes. - [x] Scope, affected files, validation, provenance, and review evidence are disclosed above. - [x] Assistant self-review completed before the two fresh reviews. - [x] A fresh Fory-guided reviewer followed `AGENTS.md` and `.agents/ci-and-pr.md`. - [x] A separate fresh independent reviewer did not use the Fory-specific review guide. - [x] Both reviewers reported no further actionable comments on the final patch; their results are linked above. - [x] Relevant local checks passed and are recorded above. - [x] No public API, binary protocol, runtime behavior, or performance change requires additional runtime tests or benchmarks. - [x] Apache-2.0-compatible configuration provenance and the required license header are preserved. - [ ] Human contributor has personally reviewed the patch and validation results, can explain the change, and confirms submission accountability.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows apache/asyncband#178 to add ASF allowlist checks for GitHub Actions and configure weekly grouped Dependabot updates with a four-day cooldown. Adapts the checks to Kvrocks'
unstablebranch and both.ymland.yamlfiles.assisted-by: codex/gpt6