add Apache third party allow list check and doc (#39392)

* add third party allow list check and doc

* add python action and shift validate further down

* fix two workflow/action issues caught during test run

* reuse setup environment step per comment

Author: derrickaw

.github/actions/setup-k8s-access/action.yml

@@ -68,7 +68,7 @@ runs:
     run: |
       kubectl config set-context --current --namespace=${{ steps.replace_namespace.outputs.TEST_NAMESPACE }}
   - name: Post cleanup
-    uses: pyTooling/Actions/with-post-step@v4.2.2
+    uses: pytooling/actions/with-post-step@42e17fae05f224e5ac3d79d021a4e3577878efe5 # v4.2.2
     with:
       main: echo "Post Cleanup"
       post: |

.github/workflows/README.md

@@ -58,6 +58,7 @@ On top of normal Actions workflow steps, all new CI workflows (excluding release
 4) A set of GitHub token permissions
 5) Concurrency Groups
 6) Comment Triggering Support
+7) Allowed Actions (See below)
 
 Each of these is described in more detail below.
 ## Name and Phrase
@@ -165,6 +166,14 @@ In order to make it easier for non-committers to interact with workflows, workfl
 
 **Note:** Comment triggering is found not scalable ([#28909](https://github.com/apache/beam/issues/28909)) and is currently limited to a subset of suites. For more information see the [Running Workflows Manually](#running-workflows-manually) section.
 
+## Allowed Actions
+
+GitHub Actions under the trusted namespaces `actions/*`, `github/*`, and `apache/*` are automatically approved. Any third-party actions outside of these namespaces must be explicitly approved and added to the ASF-wide allowlist before use.
+
+Additionally, third-party actions must be pinned to a specific Git commit SHA (e.g., `zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02`) instead of a version tag or branch name to comply with ASF security policy.
+
+For details on the allowlist and how to request new actions, see the [ASF Infrastructure Actions Allowlist Check Documentation](https://github.com/apache/infrastructure-actions/blob/main/allowlist-check/README.md).
+
 # Testing new workflows or workflow updates
 
 ## Testing New Workflows

.github/workflows/beam_Infrastructure_UsersPermissions.yml

@@ -52,7 +52,7 @@ jobs:
       - name: Setup gcloud
         uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
       - name: Install Terraform
-        uses: hashicorp/setup-terraform@v4
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           terraform_version: 1.12.2
       - name: Initialize Terraform

.github/workflows/beam_PreCommit_GHA.yml

@@ -80,15 +80,19 @@ jobs:
         comment_phrase: ${{ matrix.job_phrase }}
         github_token: ${{ secrets.GITHUB_TOKEN }}
         github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
-    - name: Run zizmor
-      uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
-      with:
-        advanced-security: true
     - name: Setup environment
       uses: ./.github/actions/setup-environment-action
       with:
         java-version: default
         go-version: default
+        python-version: default
+    # For details on the ASF GHA allowlist, see: https://github.com/apache/infrastructure-actions/blob/main/allowlist-check/README.md
+    - name: Validate GHA Allowlist
+      uses: apache/infrastructure-actions/allowlist-check@main # zizmor: ignore[unpinned-uses]
+    - name: Run zizmor
+      uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+      with:
+        advanced-security: true
     - name: run GHA PreCommit script
       uses: ./.github/actions/gradle-command-self-hosted-action
       with: