HADOOP-19868: ci: add comments from security review of new actions

[ajfabbri]

Description of PR

No code change; comments only.

Following up on HADOOP-19858, this PR adds # Security: comments to add to our
github actions to explain why each workflow is safe.

How was this patch tested?

Comments only, but CodeQL scanning is now enabled for changes within the .github directory.

For code changes:

• Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
• [na] Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
• [na] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
• [na] If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

AI Tooling

If an AI tool was used:

• [na] The PR includes the phrase "Contains content generated by "
  where is the name of the AI tool used.
• [na] My use of AI contributions follows the ASF legal policy
  https://www.apache.org/legal/generative-tooling.html

[pan3793]

@ajfabbri, thanks for the follow-up. this is the first PR from the forked repo to verify that workflow, and it's good to see it works by design.

Could you convert the Jira ticket to sub-task of HADOOP-19857 so we can collect all GitHub Actions work?

And I just opened another PR (#8451) as promised - leverage cache to speed up the image building. e.g.,

• (no cache, ~15min) https://github.com/ajfabbri/hadoop/actions/runs/24760764395/job/72443729277
• (cache-hit, ~1min) https://github.com/awesome-kyuubi/hadoop/actions/runs/24710635725/job/72274183322

I guess you also want to add such comments to those new YAML files

[hadoop-yetus]

🎊 +1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	5m 10s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+0 🆗	yamllint	0m 0s		yamllint was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
			_ trunk Compile Tests _
+1 💚	shadedclient	38m 17s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	shadedclient	33m 8s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	asflicense	0m 36s		The patch does not generate ASF License warnings.
		78m 57s

Subsystem	Report/Notes
Docker	ClientAPI=1.54 ServerAPI=1.54 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8450/1/artifact/out/Dockerfile
GITHUB PR	#8450
Optional Tests	dupname asflicense codespell detsecrets yamllint
uname	Linux c603ae53ef08 5.15.0-174-generic #184-Ubuntu SMP Fri Mar 13 18:41:50 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / e823d4f
Max. process+thread count	581 (vs. ulimit of 10000)
modules	C: . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8450/1/console
versions	git=2.43.0 maven=3.9.11
Powered by	Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

[hadoop-yetus]

🎊 +1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	4m 7s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+0 🆗	yamllint	0m 0s		yamllint was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
			_ trunk Compile Tests _
+1 💚	shadedclient	38m 25s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	shadedclient	33m 0s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	asflicense	0m 36s		The patch does not generate ASF License warnings.
		77m 59s

Subsystem	Report/Notes
Docker	ClientAPI=1.54 ServerAPI=1.54 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8450/2/artifact/out/Dockerfile
GITHUB PR	#8450
Optional Tests	dupname asflicense codespell detsecrets yamllint
uname	Linux b29d77835a87 5.15.0-174-generic #184-Ubuntu SMP Fri Mar 13 18:41:50 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / e823d4f
Max. process+thread count	571 (vs. ulimit of 10000)
modules	C: . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8450/2/console
versions	git=2.43.0 maven=3.9.11
Powered by	Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.