From 1c9e07eaa8147a028565bda080080ccaedcce021 Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Mon, 11 May 2026 03:17:06 +0200 Subject: [PATCH] allowlist: add carabiner-dev install/{ampel,bnd} transitive deps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit carabiner-dev/actions/ampel/verify@v1.2.0 (already approved) calls carabiner-dev/actions/install/ampel and install/bnd at v1.1.7 SHA 2a11d59a135c5e291f305f249a92ad7903e3ee0f. GitHub Actions validates every transitive `uses:` against the org allowlist, so these two need to be approved too — without them, check-for-transitive-failures fails every hour with "action ... is not allowed". Generated-by: Claude Opus 4.7 (1M context) --- actions.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/actions.yml b/actions.yml index 6799d0fe0..78e073998 100644 --- a/actions.yml +++ b/actions.yml @@ -166,6 +166,14 @@ bytedeco/javacpp-presets: carabiner-dev/actions/ampel/verify: e0e3b8149dafed833431095bc148d50e7eade4e8: tag: v1.2.0 +carabiner-dev/actions/install/ampel: + 2a11d59a135c5e291f305f249a92ad7903e3ee0f: + # transitive dep of carabiner-dev/actions/ampel/verify @ v1.2.0 + tag: v1.1.7 +carabiner-dev/actions/install/bnd: + 2a11d59a135c5e291f305f249a92ad7903e3ee0f: + # transitive dep of carabiner-dev/actions/ampel/verify @ v1.2.0 + tag: v1.1.7 carloscastrojumo/github-cherry-pick-action: 503773289f4a459069c832dc628826685b75b4b3: tag: v1.0.10