Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[StepSecurity] ci: Harden GitHub Actions #3304

Merged
merged 2 commits into from
Nov 14, 2024
Merged

[StepSecurity] ci: Harden GitHub Actions #3304

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b74f947
[StepSecurity] ci: Harden GitHub Actions
step-security-bot Nov 13, 2024
417d6d0
Merge branch 'main' into stepsecurity_remediation_1731516709
BupycHuk Nov 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 13 additions & 10 deletions .github/workflows/admin.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@ on:
- "update/**"
- "vmproxy/**"

permissions:
contents: read

jobs:
test:
name: Tests
Expand All @@ -31,16 +34,16 @@ jobs:

steps:
- name: Check out code
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Set up Go release
uses: actions/setup-go@v5
uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
with:
go-version-file: ${{ github.workspace }}/go.mod
cache: false

- name: Enable Go build cache
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/.cache/go-build
key: ${{ runner.os }}-go-build-${{ github.ref }}-${{ hashFiles('**') }}
Expand All @@ -49,7 +52,7 @@ jobs:
${{ runner.os }}-go-build-

- name: Enable Go modules cache
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-modules-${{ hashFiles('**/go.sum') }}
Expand All @@ -65,7 +68,7 @@ jobs:
run: make test-cover

- name: Upload coverage results
uses: codecov/codecov-action@v4
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
with:
file: cover.out
flags: admin
Expand Down Expand Up @@ -94,16 +97,16 @@ jobs:

steps:
- name: Check out code
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Set up Go release
uses: actions/setup-go@v5
uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
with:
go-version-file: ${{ github.workspace }}/go.mod
cache: false

- name: Enable Go build cache
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/.cache/go-build
key: ${{ runner.os }}-go-build-${{ github.ref }}-${{ hashFiles('**') }}
Expand All @@ -112,7 +115,7 @@ jobs:
${{ runner.os }}-go-build-

- name: Enable Go modules cache
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-modules-${{ hashFiles('**/go.sum') }}
Expand Down Expand Up @@ -152,7 +155,7 @@ jobs:

- name: Attach the report on failure
if: failure()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: "report-${{ matrix.go-version }}-${{ matrix.test-type }}"
path: ${{ github.workspace }}/cli-tests/playwright-report/
Expand Down
13 changes: 8 additions & 5 deletions .github/workflows/agent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,9 @@ on:
- "update/**"
- "vmproxy/**"

permissions:
contents: read

jobs:
test:
name: Tests
Expand Down Expand Up @@ -63,16 +66,16 @@ jobs:

steps:
- name: Check out code
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Set up Go release
uses: actions/setup-go@v5
uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
with:
go-version-file: ${{ github.workspace }}/go.mod
cache: false

- name: Enable Go build cache
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/.cache/go-build
key: ${{ runner.os }}-go-build-${{ github.ref }}-${{ hashFiles('**') }}
Expand All @@ -81,7 +84,7 @@ jobs:
${{ runner.os }}-go-build-

- name: Enable Go modules cache
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-modules-${{ hashFiles('**/go.sum') }}
Expand All @@ -102,7 +105,7 @@ jobs:
run: make test-cover

- name: Upload coverage results
uses: codecov/codecov-action@v4
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
with:
file: cover.out
flags: agent
Expand Down
9 changes: 6 additions & 3 deletions .github/workflows/api-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,9 @@ on:
required: true
type: string

permissions:
contents: read

jobs:
test:
name: Tests
Expand All @@ -74,12 +77,12 @@ jobs:

steps:
- name: Check out code
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ env.BRANCH }}

- name: Login to docker.io registry
uses: docker/login-action@v3
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
with:
registry: docker.io
username: ${{ secrets.DOCKERHUB_USERNAME }}
Expand Down Expand Up @@ -144,7 +147,7 @@ jobs:

- name: Upload the logs on failure
if: ${{ failure() }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: "logs.zip"
path: ${{ github.workspace }}/logs.zip
Expand Down
11 changes: 7 additions & 4 deletions .github/workflows/clean.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ on:
# run every Saturday
- cron: "0 12 * * 6"

permissions:
contents: read

jobs:
clean:
name: Clean caches
Expand Down Expand Up @@ -36,7 +39,7 @@ jobs:
env:
# to avoid error due to `go version` accepting -v flag with an argument since 1.15
GOFLAGS: ""
uses: actions/setup-go@v5
uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
with:
go-version: ${{ matrix.go.version }}

Expand All @@ -52,19 +55,19 @@ jobs:
echo "GOROOT=$HOME/gotip" >> $GITHUB_ENV
echo "$HOME/gotip/bin" >> $GITHUB_PATH
- name: Check out code into the Go module directory
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
lfs: true

- name: Enable Go modules cache
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/go/pkg/mod
key: ${{ matrix.os }}-go-${{ matrix.go.version }}-modules-${{ hashFiles('**/go.sum') }}
restore-keys: |
${{ matrix.os }}-go-${{ matrix.go.version }}-modules-
- name: Enable Go build cache
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/.cache/go-build
key: ${{ matrix.os }}-go-${{ matrix.go.version }}-build-${{ github.ref }}-${{ hashFiles('**') }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
steps:
- name: Dependabot metadata
id: metadata
uses: dependabot/fetch-metadata@v2
uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"

Expand Down
13 changes: 8 additions & 5 deletions .github/workflows/devcontainer.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ on:
required: true
type: string

permissions:
contents: read

jobs:
devcontainer:
name: Build
Expand All @@ -31,29 +34,29 @@ jobs:

steps:
- name: Check out code
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.event.inputs.branch }}

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

- name: Login to ghcr.io registry
uses: docker/login-action@v3
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Login to docker.io registry
uses: docker/login-action@v3
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
with:
registry: docker.io
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_PASSWORD }}

- name: Build and push to registries
uses: docker/build-push-action@v6
uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
with:
file: ./devcontainer.Dockerfile
push: true
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/doc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:

steps:
- name: Check out code
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Detect PMM version and API ID
run: |
Expand All @@ -33,11 +33,11 @@ jobs:
echo "ID=$ID" >> $GITHUB_ENV

- name: API
uses: readmeio/rdme@v8
uses: readmeio/rdme@51a80867c45de15e2b41af0c4bd5bbc61b932804 # v8.6.6
with:
rdme: openapi ./api/swagger/swagger.json --id=${{ env.ID }} --key=${{ secrets.README_TOKEN }}

- name: Markdown docs
uses: readmeio/rdme@v8
uses: readmeio/rdme@51a80867c45de15e2b41af0c4bd5bbc61b932804 # v8.6.6
with:
rdme: docs docs/api --version=${{ env.VERSION }} --key=${{ secrets.README_TOKEN }}
6 changes: 3 additions & 3 deletions .github/workflows/dockerhub-readme.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,18 +12,18 @@ jobs:
runs-on: ubuntu-latest
environment: Production
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Update Docker Hub Readme for perconalab/pmm-server
uses: peter-evans/dockerhub-description@v4
uses: peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae # v4.0.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_PASSWORD }}
repository: perconalab/pmm-server
readme-filepath: ./build/docker/server/README.md

- name: Update Docker Hub Readme for percona/pmm-server
uses: peter-evans/dockerhub-description@v4
uses: peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae # v4.0.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_PASSWORD }}
Expand Down
16 changes: 8 additions & 8 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,16 +19,16 @@ jobs:

steps:
- name: Check out code
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Set up Go release
uses: actions/setup-go@v5
uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
with:
go-version-file: ${{ github.workspace }}/go.mod
cache: false

- name: Enable Go build cache
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/.cache/go-build
key: ${{ runner.os }}-go-build-${{ github.ref }}-${{ hashFiles('**') }}
Expand All @@ -37,7 +37,7 @@ jobs:
${{ runner.os }}-go-build-

- name: Enable Go modules cache
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-modules-${{ hashFiles('**/go.sum') }}
Expand Down Expand Up @@ -81,7 +81,7 @@ jobs:
run: bin/go-sumtype ./...

- name: Run linters
uses: reviewdog/action-golangci-lint@v2
uses: reviewdog/action-golangci-lint@7708105983c614f7a2725e2172908b7709d1c3e4 # v2.6.2
with:
github_token: ${{ secrets.ROBOT_TOKEN || secrets.GITHUB_TOKEN }}
go_version_file: ${{ github.workspace }}/go.mod
Expand Down Expand Up @@ -127,7 +127,7 @@ jobs:
runs-on: ubuntu-22.04
steps:
- name: Run Merge Gatekeeper
uses: upsidr/[email protected]
uses: upsidr/merge-gatekeeper@09af7a82c1666d0e64d2bd8c01797a0bcfd3bb5d # v1.2.1
with:
self: Merge Gatekeeper
token: ${{ secrets.GITHUB_TOKEN }}
Expand All @@ -151,7 +151,7 @@ jobs:

steps:
- name: Slack Notification
uses: rtCamp/[email protected]
uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990 # v2.3.2

workflow_failure:
if: ${{ failure() }}
Expand All @@ -169,4 +169,4 @@ jobs:

steps:
- name: Slack Notification
uses: rtCamp/[email protected]
uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990 # v2.3.2
Loading
Loading