allowlist: add Cargo-Rail-Action v10.0.0

[loadingalias]

Apache Iggy needs the Cargo-Rail planner for apache/iggy#3999. The GHA installs Cargo-Rail and produces a validated named-work plan for CI routing. Planning failures restore Iggy's full workspace or all image fallback.

This request covers only the root planner Action. It does not request approval for the repository's nested setup, cache, reporting, or release Actions.

Name of action: Cargo-Rail planner

URL of action: https://github.com/loadingalias/cargo-rail-action

Version to pin to (hash only):e706767c343acb6a2ab1917f243b1616ae9eb05b

Permissions

The planner requires only contents: read. Its repository-token input defaults to github.token and is only used when missing Git history must be fetched from the same repo.

The token is not placed in URLs, command arguments, Git config, Action outputs, summaries, or unrelated child processes. The planner requires no repo write permission or OIDC token and has no post step.

Related Actions

No currently approved Action provides Cargo-graph-aware named-work planning w/ validated Cargo, target, and variant selectors.

Installing Cargo-Rail directly supplies the CLI, but it does not provide GitHub-event comparison selection, bounded history acquisition, independent plan validation, or bounded GitHub Action outputs.

Security review

Cargo-Rail Action v10.0.0 and its default Cargo-Rail v0.28.1 release are immutable and have GitHub build-provenance attestations:

• https://github.com/loadingalias/cargo-rail-action/releases/tag/v10.0.0
• https://github.com/loadingalias/cargo-rail/releases/tag/v0.28.1

The composite bootstrap downloads its release manifest and platform runtime over HTTPS, enforces size bounds, verifies the runtime SHA-256 digest, and runs a version and target self-check. The runtime installs the selected Cargo-Rail archive and verifies it against that release's SHA256SUMS.

The installer does not verify attestations at runtime. Release immutability and the attestations above are the reviewed publication trust anchors.

Checklist

• The action is listed in the GitHub Actions Marketplace
• The action is not already on the list of approved actions
• The action has a sufficient number of contributors or has contributors within the ASF community
• The action has a clearly defined license
• The action is actively developed or maintained
• The action has CI/unit tests configured
• Compiled JavaScript in dist/ matches a clean rebuild (verify with uv run utils/verify-action-build.py org/repo@hash)

---

Drafted: @loadingalias; Automated Review by Codex (Sol-xhigh)