Hi all, Wanted to share some ongoing work to harden our GitHub Actions workflows across Iceberg subprojects, following recent supply chain attacks targeting GitHub Actions (e.g., the Trivy workflow compromise).
We've already made a couple of improvements: - Added CodeQL scanning for workflow definitions (#15348) - Enforced least-privilege permissions on all workflows (#15409) Next steps: - Pin all GitHub Actions to a full commit SHA (rather than mutable tags), using only actions allowlisted by apache/infrastructure-actions - Disable Dependabot auto-updates for GitHub Actions — unreviewed version bumps can cause workflows to silently fail if the action isn't yet on the ASF allowlist (see infrastructure-actions#574) - Enforce SHA pinning via CI checks on all new and modified workflow files More details are in the GitHub tracking issue: https://github.com/apache/iceberg/issues/15742 A few callouts: 1. ASF Infra has tightened the allowlist for approved GitHub Actions over the past week. Some previously allowed actions are now blocked. Importantly, a blocked action run is NOT counted as a failure — it is silently ignored. I've audited the CI pipelines across all subprojects and fixed the affected cases. 2. Because of this silent failure behavior, we need to disable Dependabot auto-updates for GitHub Actions. Without this, an auto-update could introduce a newly blocked action and cause CI to silently fail again. 3. We can enforce pinning GitHub Actions to a commit SHA using `zizmor`. The plan is to fix all relevant workflows and then add enforcement as a CI check. Happy to discuss if you have any questions or feedback. Best, Kevin Liu
