Repository navigation

ASF Allowlist Check

[StepSecurity] Apply security best practices #5

Sign in to view logs

Triggered via pull request November 13, 2026 03:23

stepsecurity-app[bot]

opened #139

chore/GHA-130323-stepsecurity-remediation

Status Failure

Total duration 23s

Artifacts –

asf-allowlist-check.yml

on: pull_request

asf-allowlist-check

Annotations

10 errors and 2 notices

asf-allowlist-check: .github/workflows/merge-conflict-checker.yml#L0

step-security/harden-runner@v2 is not on the ASF allowlist

asf-allowlist-check: .github/workflows/main-sonar-check.yml#L0

step-security/harden-runner@v2 is not on the ASF allowlist

asf-allowlist-check: .github/workflows/copilot-token-health.yml#L0

step-security/harden-runner@v2 is not on the ASF allowlist

asf-allowlist-check: .github/workflows/copilot-token-health.yml#L0

step-security/harden-runner@v2 is not on the ASF allowlist

asf-allowlist-check: .github/workflows/codeql-analysis.yml#L0

step-security/harden-runner@v2 is not on the ASF allowlist

asf-allowlist-check: .github/workflows/ci.yml#L0

step-security/harden-runner@v2 is not on the ASF allowlist

asf-allowlist-check: .github/workflows/ci.yml#L0

step-security/harden-runner@v2 is not on the ASF allowlist

asf-allowlist-check: .github/workflows/build.yml#L0

step-security/harden-runner@v2 is not on the ASF allowlist

asf-allowlist-check: .github/workflows/asf-allowlist-check.yml#L0

step-security/harden-runner@v2 is not on the ASF allowlist

asf-allowlist-check

Found 14 action ref(s) not on the ASF allowlist:

asf-allowlist-check

Please create one PR per action. You can create the PRs by running the commands below:

asf-allowlist-check

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"