nevzheng opened a new issue, #13513:
URL: https://github.com/apache/gravitino/issues/13513
## Version
main branch
## Describe what's wrong
The ASF allowlist check now fails against current `main`
(`f5c061de70e19d553ca4f73a8be37bd9f03ebfe3`) because two pinned GitHub Action
revisions expired and were removed from the ASF allowlist on September 27, 2026.
The workflow only runs when `.github/**` changes but scans the entire
`.github/**/*.y*ml` tree. Any new workflow-related pull request will therefore
fail on these existing references.
## Error message and/or stacktrace
The checker reports 15 violations:
- `astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39`: 1 occurrence
- `dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d`: 14
occurrences
The final error is:
```text
::error::Found 15 action ref(s) not on the ASF allowlist
```
## How to reproduce
1. Check out Apache Gravitino commit
`f5c061de70e19d553ca4f73a8be37bd9f03ebfe3`.
2. Check out the current `apache/infrastructure-actions` main branch.
3. Install `ruyaml`.
4. Run `allowlist-check/check_asf_allowlist.py` with:
- `GITHUB_YAML_GLOB='.github/**/*.y*ml'`
- current `approved_patterns.yml`
- current `actions.yml`
5. Observe exit code 1 and 15 violations.
## Additional context
The latest recorded allowlist run on `main` succeeded on September 25,
before the pins expired. Closed Dependabot PRs #12801 and #12806 proposed newer
versions, but the expired revisions remain on `main`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
