Verifying the Action in the Marketplace

[EandrewJones]

Hi @slawekjaranowski,

We run an Apache project, flagon-distill, and would like to use this action as a pre-requisite for automating the Release Audit Tool (RAT) as part of our CI pipeline. However, Apache does not allow the inclusion of unverified actions.

s4u/setup-maven-action@v1.9.0 is not allowed to be used in apache/flagon-distill. Actions in this workflow must be: within a repository owned by apache, created by GitHub, verified in the GitHub Marketplace, or matching the following: */*@[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]+, AdoptOpenJDK/install-jdk@*, JamesIves/github-pages-deploy-action@5dc1d5a192aeb5ab5b7d5a77b7d36aea4a7f5c92, TobKed/label-when-approved-action@*, actions-cool/issues-helper@*, actions-rs/*, al-cheb/configure-pagefile-action@*, amannn/action-semantic-pull-request@*, apache/*, burrunan/gradle-cache-action@*, bytedeco/javacpp-presets/.github/actions/*, chromaui/action@*, codecov/codecov-action@*, conda-incubator/setup-miniconda@*, container-tools/kind-action@*, container-tools/microshift-action@*, dawidd6/action-download-artifact@*, delaguardo/setup-graalvm@*, docker://jekyll/jekyll:*, docker://pandoc/core:2.9, eps1lon/actions-label-merge-conflict@*, gaurav-nelson/github-action-markdown-link-che...

Would you mind going through the marketplace verification process if it's not too much of a hassle? These are the docs for the process I believe.

Otherwise, we'll revert to running RAT manually for the time being. There are no verified alternatives to your package.

Thanks

[slawekjaranowski]

Hi @EandrewJones

Mentioned documentation is for verifying organization for publishing a GitHub application not an actions.

There is an information for About badges in GitHub Marketplace

Please keep in mind that this is a composite action - which simply call another actions - so all called actions should be approved by ASF infra team.

[slawekjaranowski]

As I see in https://github.com/apache/flagon-distill/blob/61af38d782afdd8d7560b56377d8eb591bd68ba8/.github/workflows/rat.yml

You should have everything what is needed on GH, simply use https://github.com/actions/setup-java instead of this action

[EandrewJones]

Slawomir,

Thanks. I'll let my teammate take a stab at dropping that in instead.

Best

Evan Jones Website: www.ea-jones.com

On Wed, Sep 27, 2023 at 3:54 PM Slawomir Jaranowski < @.***> wrote:

As I see in https://github.com/apache/flagon-distill/blob/61af38d782afdd8d7560b56377d8eb591bd68ba8/.github/workflows/rat.yml

You should have everything what is needed on GH, simply use https://github.com/actions/setup-java instead of this action

— Reply to this email directly, view it on GitHub https://github.com/s4u/setup-maven-action/issues/61#issuecomment-1737990393, or unsubscribe https://github.com/notifications/unsubscribe-auth/AJ2T6ANS6UHFZI6HU6XKUILX4SAALANCNFSM6AAAAAA5JUO7VE . You are receiving this because you were mentioned.Message ID: @.***>

[slawekjaranowski]

I hope information was provided.