From fd8173f43cf67a799a1a33d6430e58f43bb0e651 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 5 Aug 2026 07:10:20 +0100 Subject: [PATCH] fix(allowlist): admit eight actions the estate already depends on MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The governance gate's Allowlist Preflight is a real gate doing its job — it exits 1 on an uncovered `uses:` and 0 when clean, which I verified directly rather than inferring. Its failures across the estate are genuine findings, not a broken check. Measured by running the check locally against 124 repository checkouts: 22 fail, and they cluster into just eight actions: SonarSource/sonarqube-scan-action 15 refs — SonarCloud runs estate-wide julia-actions/julia-runtest 4 julia-actions/julia-buildpkg 3 JuliaRegistries/TagBot 2 julia-actions/CompatHelper 1 oven-sh/setup-bun 1 Bogdanp/setup-racket 1 anchore/sbom-action 1 The SonarSource one is the striking case: SonarCloud is a required status check in a large part of the estate, so the allowlist was rejecting an action the governance rules elsewhere insist upon. Each is the ecosystem's canonical action for its job, and each was already in use before this change — this admits what is depended on rather than widening the surface: SonarSource for SonarCloud, julia-actions/JuliaRegistries for the .jl family, oven-sh/setup-bun (which the Bun-over-Deno ruling makes load- bearing), Bogdanp/setup-racket as the de facto Racket action, and anchore/sbom-action alongside anchore/scan-action, which was already allowed. NOT added, because it is a different defect: metadatastician/paint-type calls governance-reusable.yml and scorecard-reusable.yml from `metadatastician/ standards`, which returns 404. That is a wrong-org reference to a repository that does not exist, and it belongs in paint-type, not here. Co-Authored-By: Claude Fable 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .../actions-allowlist/allowed-actions.json | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/rhodium-standard-repositories/actions-allowlist/allowed-actions.json b/rhodium-standard-repositories/actions-allowlist/allowed-actions.json index df501c0c..02bb7a06 100644 --- a/rhodium-standard-repositories/actions-allowlist/allowed-actions.json +++ b/rhodium-standard-repositories/actions-allowlist/allowed-actions.json @@ -6,6 +6,7 @@ "actions-rust-lang/setup-rust-toolchain@*", "ad-m/github-push-action@*", "alire-project/setup-alire@*", + "anchore/sbom-action@*", "anchore/scan-action@*", "android-actions/setup-android@*", "anthropics/claude-code-action@*", @@ -14,6 +15,7 @@ "awalsh128/cache-apt-pkgs-action@*", "azure/webapps-deploy@*", "benchmark-action/github-action-benchmark@*", + "Bogdanp/setup-racket@*", "cachix/install-nix-action@*", "cbrgm/cleanup-stale-branches-action@*", "codecov/codecov-action@*", @@ -53,8 +55,12 @@ "ionos-deploy-now/template-renderer-action@*", "jetli/wasm-pack-action@*", "julia-actions/cache@*", + "julia-actions/CompatHelper@*", + "julia-actions/julia-buildpkg@*", "julia-actions/julia-processcoverage@*", + "julia-actions/julia-runtest@*", "julia-actions/setup-julia@*", + "JuliaRegistries/TagBot@*", "KSXGitHub/github-actions-deploy-aur@*", "ludeeus/action-shellcheck@*", "lycheeverse/lychee-action@*", @@ -62,6 +68,7 @@ "ocaml/setup-ocaml@*", "orhun/git-cliff-action@*", "ossf/scorecard-action@*", + "oven-sh/setup-bun@*", "peaceiris/actions-gh-pages@*", "peaceiris/actions-hugo@*", "peter-evans/create-pull-request@*", @@ -78,6 +85,7 @@ "snyk/actions@*", "softprops/action-gh-release@*", "SonarSource/sonarcloud-github-action@*", + "SonarSource/sonarqube-scan-action@*", "Swatinem/rust-cache@*", "taiki-e/install-action@*", "trufflesecurity/trufflehog@*",