Repository navigation
Allow projects to verify their actions usage #482
Description
When authoring GH workflows, people may add new or change action references (uses:).
Also dependabot and Renovate change action references.
If the workflows/jobs/steps are not run when such an action reference is added or changed, either by humans or bots, those are not validated against the set of allowed actions.
It would be nice for ASF projects to be able to validate their workflow files before a change is being merged, as part of their usual CI jobs.
I can imagine, that a workflow in the apache/infrastructure-actions could provide the necessary logic to check all uses: against the allowed actions. That workflow could then be called, via workflow_call, from projects' workflows, so those do not need to copy any code.
Activity
Workflow to check any ASF project's action usage
Workflow to check any ASF project's action usage
kevinjqliu commentedon Mar 25, 2026
oh hey @snazy looks like we're trying to solve a very similar problem (in slightly different ways)
When GH workflows are blocked by ASF Infra, they are failing silently (#574).
I opened #587 to create a new action that projects can use to turn the silent failure into an actual error, by adding
Would love to get your thoughts on it!
jbonofre commentedon Mar 26, 2026
Maybe we can also consider a check async (not as part of the GH Action). I think it would be a good alternative to explicitly defining an action. Just my €0.01 ;)