Allow projects to verify their actions usage

[snazy]

When authoring GH workflows, people may add new or change action references (uses:).
Also dependabot and Renovate change action references.

If the workflows/jobs/steps are not run when such an action reference is added or changed, either by humans or bots, those are not validated against the set of allowed actions.

It would be nice for ASF projects to be able to validate their workflow files before a change is being merged, as part of their usual CI jobs.

I can imagine, that a workflow in the apache/infrastructure-actions could provide the necessary logic to check all uses: against the allowed actions. That workflow could then be called, via workflow_call, from projects' workflows, so those do not need to copy any code.

[kevinjqliu]

oh hey @snazy looks like we're trying to solve a very similar problem (in slightly different ways)

When GH workflows are blocked by ASF Infra, they are failing silently (#574).
I opened #587 to create a new action that projects can use to turn the silent failure into an actual error, by adding

steps:
  - uses: actions/checkout@v4
    with:
      persist-credentials: false
  - uses: apache/infrastructure-actions/allowlist-check@main

Would love to get your thoughts on it!

[jbonofre]

Maybe we can also consider a check async (not as part of the GH Action). I think it would be a good alternative to explicitly defining an action. Just my €0.01 ;)