Conversation
When projects pin the allowlist-check action to a specific commit hash, the action was reading the approved_patterns.yml bundled at that commit. This meant newly approved actions/versions added to the allowlist after that commit would not be recognized, causing false-positive failures for projects that had not yet bumped their pin. Now the action fetches approved_patterns.yml from the main branch at runtime via curl, so the check always uses the most up-to-date allowlist regardless of which version of the action the caller has pinned. Generated-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Member
Author
|
cc: @kevinjqliu |
potiuk
added a commit
to potiuk/airflow
that referenced
this pull request
Apr 4, 2026
Temporary switch to the latest commit of infrastructure-actions allowlist-check until apache/infrastructure-actions#662 is merged, which will provide a proper tagged release.
1 task
Member
Author
|
Example failure in Airflow: python3 "/home/runner/work/_actions/apache/infrastructure-actions/493edcdbd80d9e78a767f256a877b1cc6c9712ba/allowlist-check/check_asf_allowlist.py"
"/home/runner/work/_actions/apache/infrastructure-actions/493edcdbd80d9e78a767f256a877b1cc6c9712ba/allowlist-check/../approved_patterns.yml" |
potiuk
added a commit
to apache/airflow
that referenced
this pull request
Apr 4, 2026
Temporary switch to the latest commit of infrastructure-actions allowlist-check until apache/infrastructure-actions#662 is merged, which will provide a proper tagged release.
github-actions bot
pushed a commit
to apache/airflow
that referenced
this pull request
Apr 4, 2026
…4713) Temporary switch to the latest commit of infrastructure-actions allowlist-check until apache/infrastructure-actions#662 is merged, which will provide a proper tagged release. (cherry picked from commit 04b3dd0) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
potiuk
added a commit
to apache/airflow
that referenced
this pull request
Apr 4, 2026
…4713) (#64717) Temporary switch to the latest commit of infrastructure-actions allowlist-check until apache/infrastructure-actions#662 is merged, which will provide a proper tagged release. (cherry picked from commit 04b3dd0) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
Contributor
|
make sense, thanks! This would allow projects to pin I was previously just pinning the action to |
Member
Author
Yeah, and we might in the future even release the action then :) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
allowlist-checkaction to a specific commit hash (as recommended by GitHub for security), the action was reading theapproved_patterns.ymlbundled at that pinned commit. This meant any actions/versions approved after that commit were not recognized, causing false-positive check failures until the project bumped their pin.approved_patterns.ymlfrom themainbranch at runtime viacurl, so the allowlist check always uses the most up-to-date list regardless of which version of the action the caller has pinned.Test plan
approved_patterns.ymlsuccessfully fromraw.githubusercontent.comat runtime🤖 Generated with Claude Code