GitHubActions

In the quarkusio org, we plan to have an approve list of actions you can use in your GitHub Actions workflows.

This list will be extremely limited by default and we will need a VERY good reason to extend it. We might allow actions from very trusted vendors (and even that will have to be discussed) but definitely not actions coming from individuals.

This is to reduce our exposure to supply chain attacks.

The plan is to enforce these restrictions on April 30th.

@gsmet will coordinate this initiative so if you have a question, contact him.

Actions that we consider safe enough

Are considered safe the following actions:

• actions/*

• quarkusio/*

• azure/*

• dependabot/*

• docker/*

• graalvm/*

• gradle/*

• jbangdev/*

• jreleaser/*

• manusa/* - but I wonder if these should be moved to an official org?

• oracle-actions/*

• quarkiverse/*

• redhat-actions/*

• ruby/setup-ruby

Note that I will probably not allow the whole prefix but rather point to the current actions we are using (except for actions/ and quarkusio/)

Actions that requires clarification

We are not sure how safe these actions are and if we need to find alternatives, people using them should reach out to us:

• container-tools/kind-action

• huang195/actions-install-istio - this one, I’m pretty sure I want to drop but I don’t know if we need an alternative

• ilammy/msvc-dev-cmd - I’m not sure what this one does but I’m pretty sure we should drop it too

• ishworkh/container-image-artifact-download/upload - a bit worried about these ones too

• JamesIves/github-pages-deploy-action - do we actually need an external action for that?

• limjh16/jekyll-action-ts - I think we should probably use Jekyll right away

• peaceiris/actions-gh-pages - we need to clarify why this is used and I would be for dropping it

• sibiraj-s/action-eslint - we need to clarify why this is used and I would be for dropping it

• softprops/action-gh-release - we need to clarify why this is used and I would be for dropping it

• stefanzweifel/git-auto-commit-action - we need to clarify why this is used and I would be for dropping it

Actions that will for sure go away and alternatives

This list is non exhaustive and will be amended in the future.

If you have tips on how to replace a specific action, please contribute.

Action	Alternative
actions-cool/maintain-one-comment	use our own, see https://github.com/quarkusio/quarkusio.github.io/blob/main/.github/workflows/preview.yml#L46-L70
ad-m/github-push-action	use gh CLI
christian-korneck/delete-run-artifacts-action	not sure what it is used for, needs an alternative
crazy-max/ghaction-import-gpg	in most cases, setup-java now handles that fine. If not covered, please raise an issue
dawidd6/action-download-artifact	the standard upload-artifact/download-artifact should have all the features we need nowadays, if not, please raise an issue
dcarbone/install-yq-action	if I’m not mistaken, yq is now available on action runners by default, if not it should be easy to install with apt
errata-ai/vale-action	I think we are not using this anymore? I plan to drop it.
peter-evans/create-pull-request	use gh CLI

List of actions per repositories

Please have a look at this list if you are a maintainer of a repository under the quarkusio org.

--- actions-cool/maintain-one-comment ---
  quarkusio/quarkus-workshops

--- ad-m/github-push-action ---
  quarkusio/resteasy-reactive-testsuite

--- Azure/docker-login ---
  quarkusio/registry.quarkus.io

--- azure/setup-helm ---
  quarkusio/search.quarkus.io

--- Azure/static-web-apps-deploy ---
  quarkusio/quarkus-super-heroes

--- christian-korneck/delete-run-artifacts-action ---
  quarkusio/quarkus-super-heroes

--- container-tools/kind-action ---
  quarkusio/quarkus

--- crazy-max/ghaction-import-gpg ---
  quarkusio/code.quarkus.io

--- dawidd6/action-download-artifact ---
  quarkusio/quarkus-workshops

--- dcarbone/install-yq-action ---
  quarkusio/quarkus-devtools-compat
  quarkusio/quarkus-updates

--- dependabot/fetch-metadata ---
  quarkusio/quarkus-super-heroes
  quarkusio/spring-quarkus-perf-comparison

--- docker/build-push-action ---
  quarkusio/quarkus-super-heroes
  quarkusio/spring-quarkus-perf-comparison

--- docker/login-action ---
  quarkusio/quarkus
  quarkusio/quarkus-super-heroes
  quarkusio/search.quarkus.io
  quarkusio/spring-quarkus-perf-comparison

--- docker/setup-buildx-action ---
  quarkusio/quarkus-super-heroes
  quarkusio/spring-quarkus-perf-comparison

--- docker/setup-qemu-action ---
  quarkusio/quarkus-super-heroes
  quarkusio/spring-quarkus-perf-comparison

--- dorny/test-reporter ---
  quarkusio/quarkus-devtools-compat

--- errata-ai/vale-action ---
  quarkusio/quarkus

--- graalvm/setup-graalvm ---
  quarkusio/quarkus
  quarkusio/quarkus-super-heroes

--- gradle/actions/setup-gradle ---
  quarkusio/quarkus

--- gradle/develocity-actions/maven-publish-build-scan ---
  quarkusio/quarkus

--- gradle/develocity-actions/setup-maven ---
  quarkusio/quarkus

--- huang195/actions-install-istio ---
  quarkusio/quarkus

--- ilammy/msvc-dev-cmd ---
  quarkusio/quarkus

--- ishworkh/container-image-artifact-download ---
  quarkusio/quarkus-super-heroes

--- ishworkh/container-image-artifact-upload ---
  quarkusio/quarkus-super-heroes

--- JamesIves/github-pages-deploy-action ---
  quarkusio/extensions

--- jbangdev/jbang-action ---
  quarkusio/extensions
  quarkusio/quarkus-release

--- jbangdev/setup-jbang ---
  quarkusio/.github
  quarkusio/quarkus-extension-catalog
  quarkusio/quarkusio.github.io
  quarkusio/quarkus-reveal
  quarkusio/spring-quarkus-perf-comparison

--- jreleaser/release-action ---
  quarkusio/code.quarkus.io
  quarkusio/quarkus-release

--- limjh16/jekyll-action-ts ---
  quarkusio/quarkus
  quarkusio/quarkusio.github.io

--- manusa/actions-setup-minikube ---
  quarkusio/quarkus

--- manusa/actions-setup-openshift ---
  quarkusio/quarkus

--- oracle-actions/setup-java ---
  quarkusio/quarkus

--- peaceiris/actions-gh-pages ---
  quarkusio/quarkusio.github.io
  quarkusio/quarkus-workshop-agentic
  quarkusio/quarkus-workshop-langchain4j
  quarkusio/quarkus-workshops

--- peter-evans/create-pull-request ---
  quarkusio/quarkus-super-heroes

--- quarkiverse/.github/.github/workflows/perform-release.yml ---
  quarkusio/quarkus

--- quarkiverse/.github/.github/workflows/prepare-release.yml ---
  quarkusio/quarkus

--- quarkiverse/.github/.github/workflows/pre-release.yml ---
  quarkusio/quarkus

--- redhat-actions/oc-login ---
  quarkusio/quarkus-github-lottery
  quarkusio/registry-db-dump
  quarkusio/registry.quarkus.io
  quarkusio/search.quarkus.io

--- redhat-actions/openshift-tools-installer ---
  quarkusio/quarkus-github-lottery
  quarkusio/search.quarkus.io

--- redhat-actions/podman-login ---
  quarkusio/quarkus-images

--- ruby/setup-ruby ---
  quarkusio/quarkus
  quarkusio/quarkus.dev
  quarkusio/quarkusio.github.io

--- sibiraj-s/action-eslint ---
  quarkusio/extensions

--- softprops/action-gh-release ---
  quarkusio/quarkus-agent-mcp
  quarkusio/quarkus-reveal

--- stefanzweifel/git-auto-commit-action ---
  quarkusio/quarkus-agent-mcp