[Xuanwo]

Request for adding a new GitHub Action to the allow list

Overview

Name of action: azure/login

URL of action: https://github.com/Azure/login

Version to pin to (hash only): 7ddb5af1ef8758cf1353cf3b42f940aee27ba21c

Apache reqsign uses azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 in its Azure live-test workflows (see #830/#833). Dependabot proposes bumping to v3.0.2, which resolves to commit 7ddb5af1ef8758cf1353cf3b42f940aee27ba21c. This PR adds that new version to the allowlist so the bump can land.

Permissions

This PR only allowlists a new version of the already-approved action ref. Workflow permissions remain defined by the consuming reqsign workflows (id-token: write for OIDC login, no persistent credentials).

Related Actions

This is a patch release of the existing, already approved azure/login action (v3.0.0 → v3.0.2); no alternative is needed.

Checklist

• The action is listed in the GitHub Actions Marketplace
• The action is not already on the list of approved actions (v3.0.0 is already allowlisted; this is a version addition)
• The action has a sufficient number of contributors or has contributors within the ASF community
• The action has a clearly defined license
• The action is actively developed or maintained
• The action has CI/unit tests configured
• Compiled JavaScript in dist/ matches a clean rebuild (verify with uv run utils/verify-action-build.py org/repo@hash) — not applicable: composite action, no compiled JS