@@ -47,6 +47,10 @@ github:
     main:
       required_status_checks:
         strict: true
+        # Mirrored from the contributor fork by the Fork CI Status workflows.
+        contexts:
+          - Fork CI
+          - ASF Allowlist Check
       required_pull_request_reviews:
         dismiss_stale_reviews: true
         required_approving_review_count: 1
 
@@ -0,0 +1,139 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Checkout and sync
+description: Check out the upstream base branch and merge the contributor branch for fork CI.
+
+inputs:
+  base-ref:
+    description: Fixed upstream branch selected by Fork CI.
+    required: false
+    default: ''
+  base-sha:
+    description: Fixed upstream commit selected by Fork CI.
+    required: false
+    default: ''
+  head-repository:
+    description: Repository containing the contributor commit.
+    required: false
+    default: ''
+  head-sha:
+    description: Fixed contributor commit to test.
+    required: false
+    default: ''
+  sync:
+    description: Whether to merge the contributor commit onto the fixed base.
+    required: false
+    default: ''
+  persist-credentials:
+    description: Whether to keep the token in the git config of the checkout.
+    required: false
+    default: 'false'
+
+outputs:
+  base-ref:
+    description: Upstream branch used as the comparison base.
+    value: ${{ steps.base.outputs.base_ref }}
+  base-sha:
+    description: Upstream commit checked out before merging contributor changes.
+    value: ${{ steps.upstream.outputs.base_sha }}
+  head-sha:
+    description: Commit tested after contributor changes are merged.
+    value: ${{ steps.head.outputs.head_sha }}
+  synced:
+    description: Whether contributor changes were merged onto the upstream base.
+    value: ${{ steps.base.outputs.should_sync }}
+  pull-request:
+    description: Whether a pull request is tested, through Fork CI or a pull_request event.
+    value: ${{ steps.base.outputs.should_sync == 'true' || github.event_name == 'pull_request' }}
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve pull request base branch
+      id: base
+      shell: bash
+      env:
+        EVENT_BASE_REF: ${{ github.base_ref }}
+        GH_TOKEN: ${{ github.token }}
+        HEAD_OWNER: ${{ github.repository_owner }}
+        HEAD_BRANCH: ${{ github.ref_name }}
+        HEAD_REPOSITORY: ${{ inputs.head-repository || github.repository }}
+        HEAD_SHA: ${{ inputs.head-sha || github.sha }}
+        FIXED_BASE_REF: ${{ inputs.base-ref }}
+        FIXED_BASE_SHA: ${{ inputs.base-sha }}
+        FIXED_SYNC: ${{ inputs.sync }}
+      run: |
+        set -euo pipefail
+        if [[ -n "${FIXED_BASE_SHA}" ]]; then
+          [[ "${FIXED_BASE_SHA}" =~ ^[0-9a-f]{40}$ ]] || exit 1
+          git check-ref-format "refs/heads/${FIXED_BASE_REF}"
+          [[ "${FIXED_SYNC}" == "true" || "${FIXED_SYNC}" == "false" ]] || exit 1
+          echo "base_ref=${FIXED_BASE_REF}" >> "${GITHUB_OUTPUT}"
+          echo "should_sync=${FIXED_SYNC}" >> "${GITHUB_OUTPUT}"
+        else
+          # Legacy direct/manual/nightly callers test their own checkout. Fork CI always
+          # supplies the context resolved once by eligibility; suites never re-query PRs.
+          echo "base_ref=${EVENT_BASE_REF:-${GITHUB_REF_NAME}}" >> "${GITHUB_OUTPUT}"
+          echo "should_sync=false" >> "${GITHUB_OUTPUT}"
+        fi
+
+    - name: Checkout upstream base branch
+      if: steps.base.outputs.should_sync == 'true'
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+        repository: apache/gravitino
+        ref: ${{ inputs.base-sha }}
+        persist-credentials: ${{ inputs.persist-credentials }}
+
+    - name: Resolve upstream base commit
+      id: upstream
+      shell: bash
+      run: echo "base_sha=$(git rev-parse HEAD)" >> "${GITHUB_OUTPUT}"
+
+    - name: Merge contributor branch
+      if: steps.base.outputs.should_sync == 'true'
+      shell: bash
+      env:
+        BASE_REF: ${{ steps.base.outputs.base_ref }}
+        HEAD_REPOSITORY: ${{ inputs.head-repository || github.repository }}
+        HEAD_SHA: ${{ inputs.head-sha || github.sha }}
+      run: |
+        set -euo pipefail
+
+        [[ "${HEAD_SHA}" =~ ^[0-9a-f]{40}$ ]] || exit 1
+        [[ "${HEAD_REPOSITORY}" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]] || exit 1
+        # Fetch the pushed commit rather than the branch tip, which may have moved since.
+        git fetch "https://github.com/${HEAD_REPOSITORY}.git" "${HEAD_SHA}"
+        if ! git \
+          -c user.name='Apache Gravitino CI' \
+          -c user.email='dev@gravitino.apache.org' \
+          merge --no-commit --no-ff "${HEAD_SHA}"; then
+          git diff --name-only --diff-filter=U | sed 's/^/Conflict: /'
+          echo "::error::${HEAD_SHA} does not merge cleanly into ${BASE_REF}. Merge or rebase onto the latest ${BASE_REF} and push again."
+          exit 1
+        fi
+        git \
+          -c user.name='Apache Gravitino CI' \
+          -c user.email='dev@gravitino.apache.org' \
+          commit --allow-empty -m 'Merge contributor branch for CI'
+
+    - name: Resolve tested commit
+      id: head
+      shell: bash
+      run: echo "head_sha=$(git rev-parse HEAD)" >> "${GITHUB_OUTPUT}"
@@ -0,0 +1,93 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+'use strict';
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const MAX_FILE = 1024 * 1024;
+const MAX_TOTAL = 8 * MAX_FILE;
+
+function yamlEntries(tree) {
+  if (tree.truncated) throw new Error('Refusing a truncated .github tree.');
+  return tree.tree.filter(entry => /\.ya?ml$/.test(entry.path)).map(entry => {
+    if (!['100644', '100755'].includes(entry.mode) || entry.type !== 'blob' ||
+        entry.path.split('/').some(part => part === '..' || part === '.' || !part) ||
+        path.isAbsolute(entry.path) || entry.path.includes('\\') || entry.size > MAX_FILE) {
+      throw new Error('Unsafe or oversized workflow data path.');
+    }
+    return entry;
+  });
+}
+async function prepare({ github, context, core, fetchImpl = fetch, directory = path.join(process.env.RUNNER_TEMP, 'fork-ci-allowlist') }) {
+  let prs;
+  if (context.eventName === 'workflow_dispatch') {
+    const number = context.payload.inputs?.['pull-request'];
+    if (!/^[1-9][0-9]*$/.test(String(number))) throw new Error('A PR number is required.');
+    prs = [(await github.rest.pulls.get({ ...context.repo, pull_number: Number(number) })).data];
+  } else {
+    const sha = context.payload.workflow_run.head_sha;
+    if (!/^[0-9a-f]{40}$/.test(sha)) throw new Error('Invalid signal SHA.');
+    // listPullRequestsAssociatedWithCommit does not return PRs whose head commit is in a fork.
+    const run = context.payload.workflow_run;
+    prs = (await github.paginate(github.rest.pulls.list, { ...context.repo, state: 'open',
+      head: `${run.head_repository.owner.login}:${run.head_branch}`, per_page: 100 }))
+      .filter(pr => pr.head.sha === sha);
+  }
+  prs = prs.filter(pr => pr.state === 'open' && pr.head.repo);
+  if (!prs.length) { core.setOutput('prs', '[]'); return; }
+  if (prs.some(pr => pr.head.sha !== prs[0].head.sha)) throw new Error('Inconsistent signal heads.');
+  const pr = prs[0];
+  const target = { owner: pr.head.repo.owner.login, repo: pr.head.repo.name };
+  const { data: root } = await github.rest.git.getTree({ ...target, tree_sha: pr.head.sha });
+  const entry = root.tree.find(e => e.path === '.github');
+  if (!entry || entry.type !== 'tree') throw new Error('The PR has no .github directory.');
+  const { data: tree } = await github.rest.git.getTree({ ...target, tree_sha: entry.sha, recursive: '1' });
+  await fs.rm(directory, { recursive: true, force: true });
+  let total = 0;
+  for (const file of yamlEntries(tree)) {
+    const url = `https://raw.githubusercontent.com/${target.owner}/${target.repo}/${pr.head.sha}/.github/` +
+      file.path.split('/').map(encodeURIComponent).join('/');
+    const response = await fetchImpl(url, { redirect: 'error', signal: AbortSignal.timeout(30000) });
+    if (!response.ok) throw new Error(`Could not read workflow data: HTTP ${response.status}.`);
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of response.body) {
+      size += chunk.length;
+      total += chunk.length;
+      if (size > MAX_FILE || total > MAX_TOTAL) throw new Error('Workflow data size limit exceeded.');
+      chunks.push(chunk);
+    }
+    const destination = path.join(directory, '.github', file.path);
+    await fs.mkdir(path.dirname(destination), { recursive: true });
+    await fs.writeFile(destination, Buffer.concat(chunks));
+  }
+  // These are data files outside the trusted checkout. Never source, install or execute them.
+  core.setOutput('prs', JSON.stringify(prs.map(pr => ({ number: pr.number, sha: pr.head.sha }))));
+  core.setOutput('scan-glob', `${directory}/.github/**/*.y*ml`);
+}
+async function publish({ github, context, core }) {
+  const prs = JSON.parse(process.env.SCANNED_PRS || '[]');
+  for (const pr of prs) {
+    const { data: current } = await github.rest.pulls.get({ ...context.repo, pull_number: pr.number });
+    if (current.state !== 'open' || current.head.sha !== pr.sha) continue;
+    const success = process.env.SCAN_OUTCOME === 'success';
+    await github.rest.checks.create({ ...context.repo, name: 'ASF Allowlist Check', head_sha: pr.sha,
+      status: 'completed', conclusion: success ? 'success' : 'failure',
+      details_url: `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
+      output: { title: success ? 'Workflow actions are allowlisted' : 'Workflow allowlist scan failed',
+        summary: 'Scanned PR YAML as data with the reviewed default-branch workflow. No PR code was executed.' } });
+  }
+  if (process.env.SCAN_OUTCOME !== 'success' && prs.length) core.setFailed('ASF allowlist scan failed.');
+}
+module.exports = { yamlEntries, prepare, publish };
@@ -0,0 +1,130 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+'use strict';
+const UPSTREAM = { owner: 'apache', repo: 'gravitino' };
+const SUITES = ['build', 'backend', 'spark', 'flink', 'trino', 'iceberg_rest_trino', 'python',
+  'frontend', 'access_control', 'idp_basic', 'mcp', 'maintenance', 'web_ui', 'charts',
+  'contrib_catalog', 'asf_allowlist'];
+const requiredName = (pr, baseSha = pr.base.sha) => `Required CI / ${pr.base.ref} / ${baseSha} / ${pr.head.sha}`;
+const requiredAction = note => ({ status: 'completed', conclusion: 'action_required',
+  title: 'Fork CI needs attention', note });
+
+function evaluate(pr, run, jobs, baseSha = pr.base.sha) {
+  const required = jobs.find(job => job.name === requiredName(pr, baseSha));
+  if (run.status !== 'completed') return { status: 'in_progress', title: 'Fork CI is running' };
+  if (run.conclusion !== 'success') return { status: 'completed',
+    conclusion: ['failure', 'cancelled', 'timed_out', 'action_required'].includes(run.conclusion)
+      ? run.conclusion : 'action_required', title: `Fork CI ${run.conclusion}` };
+  if (!required || required.conclusion !== 'success') {
+    return requiredAction('The run did not finish Required CI for this exact head, base branch and base SHA. ' +
+      'Update the branch and push again, or ask a committer to dispatch a trusted Fork CI run.');
+  }
+  for (const suite of SUITES) {
+    const children = jobs.filter(job => job.name.startsWith(`${suite} / `));
+    if (!children.length || !children.some(job => job.conclusion === 'success') ||
+        children.some(job => !['success', 'skipped'].includes(job.conclusion))) {
+      return requiredAction(`The ${suite} caller did not report successful jobs. Open the run and verify its suites.`);
+    }
+  }
+  return { status: 'completed', conclusion: 'success', title: 'All required suites passed' };
+}
+
+function createService(github) {
+  const definitions = new Map();
+  const trees = new Map();
+  async function ciTree(owner, repo, sha) {
+    const key = `${owner}/${repo}@${sha}`;
+    if (!trees.has(key)) trees.set(key, (async () => {
+      const { data: root } = await github.rest.git.getTree({ owner, repo, tree_sha: sha });
+      const entries = Object.fromEntries(root.tree.map(e => [e.path, e]));
+      const githubTree = entries['.github'];
+      const result = { policy: entries['.asf.yaml']?.sha || null };
+      if (!githubTree) return result;
+      const { data: dirs } = await github.rest.git.getTree({ owner, repo, tree_sha: githubTree.sha });
+      for (const name of ['workflows', 'actions', 'scripts']) result[name] = dirs.tree.find(e => e.path === name)?.sha || null;
+      return result;
+    })());
+    return trees.get(key);
+  }
+  async function unchanged(pr) {
+    const key = `${pr.head.repo.full_name}@${pr.head.sha}:${pr.base.sha}`;
+    if (definitions.has(key)) return definitions.get(key);
+    const [base, head] = await Promise.all([
+      ciTree(UPSTREAM.owner, UPSTREAM.repo, pr.base.sha),
+      ciTree(pr.head.repo.owner.login, pr.head.repo.name, pr.head.sha)
+    ]);
+    const same = JSON.stringify(base) === JSON.stringify(head);
+    definitions.set(key, same);
+    return same;
+  }
+  async function jobsFor(owner, repo, run) {
+    // Partial re-runs retain earlier successful jobs. Take each named job's newest
+    // execution, rather than requiring every caller to execute in the latest attempt.
+    const jobs = await github.paginate('GET /repos/{owner}/{repo}/actions/runs/{run_id}/jobs',
+      { owner, repo, run_id: run.id, filter: 'all', per_page: 100 });
+    const latest = new Map();
+    for (const job of jobs) {
+      if ((job.run_attempt || 1) > run.run_attempt) continue;
+      const previous = latest.get(job.name);
+      if (!previous || (job.run_attempt || 1) > (previous.run_attempt || 1) ||
+          ((job.run_attempt || 1) === (previous.run_attempt || 1) && job.id > previous.id)) {
+        latest.set(job.name, job);
+      }
+    }
+    return [...latest.values()];
+  }
+  async function testedBase(pr, jobs) {
+    // pr.base.sha is not refreshed by later pushes, so runs usually test a newer base commit.
+    // Accept that commit only if it is on the PR base branch. The check can stay green after the
+    // branch moves on; strict branch protection, not this check, requires an up-to-date branch.
+    const prefix = `Required CI / ${pr.base.ref} / `;
+    const suffix = ` / ${pr.head.sha}`;
+    const job = jobs.find(job => job.name.startsWith(prefix) && job.name.endsWith(suffix));
+    const sha = job?.name.slice(prefix.length, -suffix.length);
+    if (!sha || sha === pr.base.sha || !/^[0-9a-f]{40}$/.test(sha)) return pr.base.sha;
+    const { data } = await github.rest.repos.compareCommitsWithBasehead({ ...UPSTREAM,
+      basehead: `${sha}...${pr.base.ref}`, per_page: 1 });
+    return ['ahead', 'identical'].includes(data.status) ? sha : pr.base.sha;
+  }
+  async function findRun(pr, trusted) {
+    const target = trusted ? UPSTREAM : { owner: pr.head.repo.owner.login, repo: pr.head.repo.name };
+    const all = await github.paginate(github.rest.actions.listWorkflowRuns, { ...target, workflow_id: 'fork-ci.yml',
+      event: trusted ? 'workflow_dispatch' : 'push', head_sha: trusted ? pr.base.sha : pr.head.sha, per_page: 100 });
+    const runs = all.filter(run => run.path === '.github/workflows/fork-ci.yml' &&
+      run.head_sha === (trusted ? pr.base.sha : pr.head.sha) &&
+      (!trusted || run.display_title === `Trusted Fork CI #${pr.number}`)).sort((a, b) => b.id - a.id);
+    return runs[0] && { ...target, run: runs[0], trusted };
+  }
+  async function mirror(pr) {
+    if (!pr.head.repo) return { result: requiredAction('The PR head repository no longer exists.') };
+    // Read trusted metadata only. Nothing in the contributor repository is checked out or executed.
+    let ordinary = await findRun(pr, false);
+    const sameDefinitions = await unchanged(pr);
+    const trusted = await findRun(pr, true);
+    let selected = trusted && (!ordinary || (trusted.run.updated_at || trusted.run.created_at) >= (ordinary.run.updated_at || ordinary.run.created_at) || !sameDefinitions)
+      ? trusted : ordinary;
+    if (!selected) return { result: requiredAction('Enable Actions in the fork and push the branch, or dispatch trusted Fork CI.') };
+    const { owner, repo, run } = selected;
+    if (!selected.trusted && !sameDefinitions) return { ...selected, fork: ordinary?.run,
+      result: requiredAction('CI workflow/action/script definitions or branch protection differ from the base. ' +
+        'A committer must dispatch Fork CI from the current upstream default branch with this PR number.') };
+    // A manual upstream run uses the workflow definitions at run.head_sha, not the PR definitions.
+    const jobs = await jobsFor(owner, repo, run);
+    const base = selected.trusted ? pr.base.sha : await testedBase(pr, jobs);
+    return { ...selected, fork: ordinary?.run, base, result: evaluate(pr, run, jobs, base) };
+  }
+  return { mirror, unchanged, findRun };
+}
+module.exports = { SUITES, requiredName, evaluate, createService };