From 592e504d550584e02103fbabd58b860af7df0434 Mon Sep 17 00:00:00 2001
From: Lari Hotari <lhotari@apache.org>
Date: Sun, 13 Sep 2026 22:14:29 +0300
Subject: [PATCH 1/2] [improve][ci] Check ASF action allowlist in preconditions

---
 .github/workflows/pulsar-ci.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pulsar-ci.yaml b/.github/workflows/pulsar-ci.yaml
index 89ec00ca91e4a..908c3de291e43 100644
--- a/.github/workflows/pulsar-ci.yaml
+++ b/.github/workflows/pulsar-ci.yaml
@@ -115,9 +115,14 @@ jobs:
           echo "jdk_major_version=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.jdk_major_version || '25'}}" >> $GITHUB_OUTPUT
 
       - name: checkout
-        if: ${{ github.event_name == 'pull_request' }}
         uses: actions/checkout@v6
 
+      - name: Check ASF action allowlist
+        if: ${{ (github.event.pull_request.base.repo.owner.login || github.repository_owner) == 'apache' }}
+        uses: apache/infrastructure-actions/allowlist-check@main
+        with:
+          scan-glob: '.github/**/*.y*ml'
+
       - name: Detect changed files
         if: ${{ github.event_name == 'pull_request' }}
         id:   changes

From 02aa8dbc1f3e4aebd4f8a21b41f8d76465a6aaf5 Mon Sep 17 00:00:00 2001
From: Lari Hotari <lhotari@apache.org>
Date: Sun, 13 Sep 2026 23:12:50 +0300
Subject: [PATCH 2/2] [fix][ci] Update pinned Gradle actions to latest
 ASF-approved version

---
 .github/actions/setup-gradle/action.yml                | 4 ++--
 .github/workflows/ci-gradle-dependency-submission.yaml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/actions/setup-gradle/action.yml b/.github/actions/setup-gradle/action.yml
index 17bd794263582..a718f65b23332 100644
--- a/.github/actions/setup-gradle/action.yml
+++ b/.github/actions/setup-gradle/action.yml
@@ -54,7 +54,7 @@ runs:
 
     - name: Setup Gradle with Develocity
       if: ${{ inputs.develocity-access-key != '' && inputs.build-scan-publish == 'true' && github.event.repository.visibility == 'public' }}
-      uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
       with:
         develocity-injection-enabled: true
         develocity-url: https://develocity.apache.org
@@ -66,7 +66,7 @@ runs:
 
     - name: Setup Gradle
       if: ${{ !(inputs.develocity-access-key != '' && inputs.build-scan-publish == 'true' && github.event.repository.visibility == 'public') }}
-      uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
       with:
         build-scan-publish: ${{ inputs.build-scan-publish == 'true' && github.event.repository.visibility == 'public' }}
         build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
diff --git a/.github/workflows/ci-gradle-dependency-submission.yaml b/.github/workflows/ci-gradle-dependency-submission.yaml
index 97b293feb666f..33ebddd5dab9a 100644
--- a/.github/workflows/ci-gradle-dependency-submission.yaml
+++ b/.github/workflows/ci-gradle-dependency-submission.yaml
@@ -67,4 +67,4 @@ jobs:
           cache-read-only: false
 
       - name: Generate and submit dependency graph
-        uses: gradle/actions/dependency-submission@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e
\ No newline at end of file
+        uses: gradle/actions/dependency-submission@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
\ No newline at end of file