[CI] Fix problematic CI jobs #49724

Activity

1. thisisnic

   added

   Type: bug

   on Apr 14, 2026
2. github-actions

   added

   Component: Continuous Integration

   on Apr 14, 2026
3. thisisnic

   added sub-issues on Apr 14, 2026

   • [CI] Use environment variables instead of template expressions in workflow run blocks #49725
   • [CI] Review pull_request_target workflow triggers #49726
   • [CI] Pin GitHub Actions to commit SHAs instead of tags #49727
   • [CI] Set persist-credentials: false in checkout actions #49728
   • [CI] Scope workflow permissions and secret inheritance #49729
   • [CI] Add cache-poisoning mitigations for actions/cache #49730
   • [CI] Add cooldown configuration to Dependabot #49731
   • [CI] should we use zizmor in CI to scan jobs for problems? #49732
4. pitrou commented on Apr 14, 2026

   

   pitrou

   on Apr 14, 2026

   Member

   More actions

   @kou FYI
5. kevinjqliu commented on Apr 14, 2026

   

   kevinjqliu

   on Apr 14, 2026

   Contributor

   More actions

   Thanks for creating the umbrella issue. I've applied the following fixes to all the apache/iceberg* repos. And looking to add these to the ASF infra page as best practice.

   TLDR; we added these 3 github actions in all apache/iceberg* repos

   • zizmor.yml enforces github action best practice
   • codeql.yml runs CodeQL github action check (recommended by GitHub)
   • asf-allowlist-check.yml warns when a workflow is disallowed by ASF Infra, otherwise the workflow will be silently skipped

   We can copy/paste over both asf-allowlist-check.yml and codeql.yml, there's no pre-reqs for them to run. asf-allowlist-check.yml will fail if any current workflows are disallowed. codeql.yml will not fail, it only creates warnings and add to the "Security" tab on Github.

   The zizmor.yml check requires all current warning to be resolved. We can fix forward all warnings in a single PR. Run uvx zizmor --offline .github/ inside the repo to see warnings

   I would love to create a SKILL to speed this up. Esp for projects with multiple repos (arrow/datafusion/)