ci: add ASF allowlist check for GitHub Actions

Adds a workflow running apache/infrastructure-actions/allowlist-check on
PRs touching .github/** (which is what Dependabot's github-actions
updater modifies) so that bumps to actions not on the ASF allowlist are
caught before merge. Also marks asf-allowlist-check as a required status
check on master via .asf.yaml so such PRs are blocked from merging.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: rzo1

.asf.yaml

@@ -7,7 +7,12 @@ github:
   homepage: https://storm.apache.org/
   protected_branches:
     # Prevent force pushes to primary branches
-    master: {}
+    master:
+      # Block merges when the ASF allowlist check fails (e.g. a Dependabot
+      # PR that bumps a GitHub Action to a version not on the ASF allowlist).
+      required_status_checks:
+        contexts:
+          - asf-allowlist-check
   custom_subjects:
     new_pr: "[PR] {title} ({repository})"
     close_pr: "Re: [PR] {title} ({repository})"

.github/workflows/asf-allowlist-check.yml

@@ -0,0 +1,42 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: ASF Allowlist Check
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/**"
+  push:
+    branches: [ "master", "2.x" ]
+    paths:
+      - ".github/**"
+
+permissions:
+  contents: read
+
+jobs:
+  asf-allowlist-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: apache/infrastructure-actions/allowlist-check@main
+        with:
+          # Storm uses both .yml and .yaml workflow files.
+          scan-glob: ".github/**/*.{yml,yaml}"