ci: add ASF allowlist check for GitHub Actions (Dependabot guard)

[rzo1]

What

Adds a CI check that validates every referenced GitHub Action against the ASF allowlist, and wires it in as a required status check on master.

Why

Dependabot's github-actions ecosystem updater opens PRs that bump action versions. Without this guard, an update could point us at an action that is not on the ASF allowlist, which would only surface later (or get merged). This makes the violation fail fast on the PR.

How

• New workflow .github/workflows/asf-allowlist-check.yml
  • Runs apache/infrastructure-actions/allowlist-check@main.
  • Triggers on pull_request (and push to master/2.x) limited to paths: .github/** — exactly the files Dependabot's github-actions updater touches.
  • scan-glob: ".github/**/*.{yml,yaml}" because Storm mixes both .yml and .yaml workflow files (the action's default only matches .yml).
  • permissions: contents: read, persist-credentials: false per ASF guidance.
• .asf.yaml: adds asf-allowlist-check to required_status_checks.contexts on master so failing PRs are blocked from merging (branch protection on ASF repos is managed via .asf.yaml, not the GitHub UI).

[GGraziadei]

Hi @rzo1, thanks for jumping in so quickly to support!

I checked the logs for the allowlist action, and it looks like it isn't actually scanning any files. It returns Checking 0 unique action ref(s), even though the workflows exist:

RUN python3 "/home/runner/work/_actions/apache/infrastructure-actions/main/allowlist-check/check_asf_allowlist.py" "/home/runner/work/_temp/approved_patterns.yml"
...
env:
  GITHUB_YAML_GLOB: .github/**/*.{yml,yaml}
Checking 0 unique action ref(s) against the ASF allowlist:

All 0 unique action refs are on the ASF allowlist

I suspect the glob pattern might be the issue here. Could this syntax be incorrect for this specific python script?

scan-glob: ".github/**/*.{yml,yaml}"

It seems that the py doesn't expand the {yml,yaml}

[rzo1]

Should be fine now @GGraziadei

[GGraziadei]

Thank you for the quick fix!