dennismdejong opened a new pull request, #13705: URL: https://github.com/apache/gravitino/pull/13705
### What changes were proposed in this pull request? Per the ASF GitHub Actions policy (https://infra.apache.org/github-actions-policy.html), third-party actions such as `pnpm/action-setup` must be referred to by commit hash **and** kept up-to-date by automation such as Dependabot. This PR closes the remaining gap: 1. `web-ui-tests.yml` was already hash-pinned (`#12899`), but to the superseded v6.0.10 (`0977fd99...`), whose ASF allowlist entry carries `expires_at: 2026-12-01`. It is bumped to the currently approved v6.1.0 (`ea17c68df8912ef543352723c149a84f56e3d413`) — the same revision the closed Dependabot PR #13645 proposed. The trailing `# v6.1.0` comment is preserved so Dependabot can keep tracking the pin. 2. `dependabot.yml` now documents that the `github-actions` entry with `directory: "/"` is what scans `.github/workflows/` (and root action files) for these pins, and adds the cooldown ASF recommends for downstream projects: ASF only permits the exact revisions its allowlist has approved, so a bump proposed before the approval lands fails `asf-allowlist-check` and cannot be merged (today's closed #13644/#13646). ### Why are the changes needed? The policy is enforced for `pnpm/action-setup` since apache/infrastructure-actions#1193 tightened its allowlist entry from a wildcard to explicit SHAs. Once v6.0.10 is removed from the allowlist, `web-ui-tests.yml` would fail at workflow startup, and every `.github/**` PR would fail `asf-allowlist-check`. Fix: #12567 ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? - Ran `apache/infrastructure-actions/allowlist-check/check_asf_allowlist.py` locally against the current `approved_patterns.yml` and `actions.yml` with `GITHUB_YAML_GLOB='.github/**/*.y*ml'`: all 19 unique action refs pass, including `pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413`. - Negative control: the same checker rejects an unapproved `pnpm/action-setup` SHA, confirming the pass is meaningful. - Validated `.github/dependabot.yml` against the `dependabot-2.0` JSON schema (cooldown key accepted) and re-parsed both edited files as YAML; `git diff --check` is clean. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
