DevFW-CICD/ingress-nginx-helm
16
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pinned GitHub workflows by SHA (#8334)

Browse source 
- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
- Included permissions for some of the actions. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

Dependabot can upgrade pinned version of actions.
This commit is contained in:
Naveen 2022-03-14 10:29:58 -05:00 committed by GitHub
parent e1eff78160
commit 974d038c2a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 50 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

58
.github/workflows/ci.yaml vendored
View file

@ -9,9 +9,15 @@ on:
branches: branches:
- main - main
permissions:
contents: read
jobs: jobs:
changes: changes:
permissions:
contents: read # for dorny/paths-filter to fetch a list of changed files
pull-requests: read # for dorny/paths-filter to read pull requests
runs-on: ubuntu-latest runs-on: ubuntu-latest
outputs: outputs:
go: ${{ steps.filter.outputs.go }} go: ${{ steps.filter.outputs.go }}
@ -20,9 +26,9 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v2 uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
- uses: dorny/paths-filter@v2 - uses: dorny/paths-filter@b2feaf19c27470162a626bd6fa8438ae5b263721 # v2
id: filter id: filter
with: with:
token: ${{ secrets.GITHUB_TOKEN }} token: ${{ secrets.GITHUB_TOKEN }}
@ -43,10 +49,10 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v2 uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
- name: Run Gosec Security Scanner - name: Run Gosec Security Scanner
uses: securego/gosec@master uses: securego/gosec@b99b5f7838e43a4104354ad92a6a1774302ee1f9 # master
with: with:
# G601 for zz_generated.deepcopy.go # G601 for zz_generated.deepcopy.go
# G306 TODO: Expect WriteFile permissions to be 0600 or less # G306 TODO: Expect WriteFile permissions to be 0600 or less
@ -61,17 +67,17 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v2 uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
- name: Set up Go 1.17 - name: Set up Go 1.17
id: go id: go
uses: actions/setup-go@v2 uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2
with: with:
go-version: '1.17.6' go-version: '1.17.6'
- name: Set up Docker Buildx - name: Set up Docker Buildx
id: buildx id: buildx
uses: crazy-max/ghaction-docker-buildx@v1 uses: crazy-max/ghaction-docker-buildx@e01797ad2ea9a981005ad58c99afa8d842e3d3eb # v1
with: with:
buildx-version: latest buildx-version: latest
qemu-version: latest qemu-version: latest
@ -104,7 +110,7 @@ jobs:
| pigz > docker.tar.gz | pigz > docker.tar.gz
- name: cache - name: cache
uses: actions/upload-artifact@v2 uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2
with: with:
name: docker.tar.gz name: docker.tar.gz
path: docker.tar.gz path: docker.tar.gz
@ -121,15 +127,15 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v2 uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
- name: Setup Go - name: Setup Go
uses: actions/setup-go@v2 uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2
with: with:
go-version: '1.17.6' go-version: '1.17.6'
- name: cache - name: cache
uses: actions/download-artifact@v2 uses: actions/download-artifact@f023be2c48cc18debc3bacd34cb396e0295e2869 # v2
with: with:
name: docker.tar.gz name: docker.tar.gz
@ -162,12 +168,12 @@ jobs:
- name: Create Kubernetes cluster - name: Create Kubernetes cluster
id: kind id: kind
uses: engineerd/setup-kind@v0.5.0 uses: engineerd/setup-kind@aa272fe2a7309878ffc2a81c56cfe3ef108ae7d0 # v0.5.0
with: with:
version: v0.11.1 version: v0.11.1
image: kindest/node:v1.21.1 image: kindest/node:v1.21.1
- uses: geekyeggo/delete-artifact@v1 - uses: geekyeggo/delete-artifact@a6ab43859c960a8b74cbc6291f362c7fb51829ba # v1
with: with:
name: docker.tar.gz name: docker.tar.gz
failOnError: false failOnError: false
@ -202,22 +208,22 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v2 uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
- name: cache - name: cache
uses: actions/download-artifact@v2 uses: actions/download-artifact@f023be2c48cc18debc3bacd34cb396e0295e2869 # v2
with: with:
name: docker.tar.gz name: docker.tar.gz
- name: Create Kubernetes ${{ matrix.k8s }} cluster - name: Create Kubernetes ${{ matrix.k8s }} cluster
id: kind id: kind
uses: engineerd/setup-kind@v0.5.0 uses: engineerd/setup-kind@aa272fe2a7309878ffc2a81c56cfe3ef108ae7d0 # v0.5.0
with: with:
version: v0.11.1 version: v0.11.1
config: test/e2e/kind.yaml config: test/e2e/kind.yaml
image: kindest/node:${{ matrix.k8s }} image: kindest/node:${{ matrix.k8s }}
- uses: geekyeggo/delete-artifact@v1 - uses: geekyeggo/delete-artifact@a6ab43859c960a8b74cbc6291f362c7fb51829ba # v1
with: with:
name: docker.tar.gz name: docker.tar.gz
failOnError: false failOnError: false
@ -245,14 +251,17 @@ jobs:
make kind-e2e-test make kind-e2e-test
test-image-build: test-image-build:
permissions:
contents: read # for dorny/paths-filter to fetch a list of changed files
pull-requests: read # for dorny/paths-filter to read pull requests
runs-on: ubuntu-latest runs-on: ubuntu-latest
env: env:
PLATFORMS: linux/amd64 PLATFORMS: linux/amd64
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v2 uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
- uses: dorny/paths-filter@v2 - uses: dorny/paths-filter@b2feaf19c27470162a626bd6fa8438ae5b263721 # v2
id: filter-images id: filter-images
with: with:
token: ${{ secrets.GITHUB_TOKEN }} token: ${{ secrets.GITHUB_TOKEN }}
@ -302,14 +311,17 @@ jobs:
cd images/kube-webhook-certgen && make build cd images/kube-webhook-certgen && make build
test-image: test-image:
permissions:
contents: read # for dorny/paths-filter to fetch a list of changed files
pull-requests: read # for dorny/paths-filter to read pull requests
runs-on: ubuntu-latest runs-on: ubuntu-latest
env: env:
PLATFORMS: linux/amd64 PLATFORMS: linux/amd64
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v2 uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
- uses: dorny/paths-filter@v2 - uses: dorny/paths-filter@b2feaf19c27470162a626bd6fa8438ae5b263721 # v2
id: filter-images id: filter-images
with: with:
token: ${{ secrets.GITHUB_TOKEN }} token: ${{ secrets.GITHUB_TOKEN }}
@ -320,7 +332,7 @@ jobs:
- name: Create Kubernetes cluster - name: Create Kubernetes cluster
id: kind id: kind
if: ${{ steps.filter-images.outputs.kube-webhook-certgen == 'true' }} if: ${{ steps.filter-images.outputs.kube-webhook-certgen == 'true' }}
uses: engineerd/setup-kind@v0.5.0 uses: engineerd/setup-kind@aa272fe2a7309878ffc2a81c56cfe3ef108ae7d0 # v0.5.0
with: with:
version: v0.11.1 version: v0.11.1
image: kindest/node:v1.21.1 image: kindest/node:v1.21.1
@ -328,7 +340,7 @@ jobs:
- name: Set up Go 1.17 - name: Set up Go 1.17
id: go id: go
if: ${{ steps.filter-images.outputs.kube-webhook-certgen == 'true' }} if: ${{ steps.filter-images.outputs.kube-webhook-certgen == 'true' }}
uses: actions/setup-go@v2 uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2
with: with:
go-version: '1.17.6' go-version: '1.17.6'

13
.github/workflows/docs.yaml vendored
View file

@ -8,6 +8,9 @@ on:
jobs: jobs:
changes: changes:
permissions:
contents: read # for dorny/paths-filter to fetch a list of changed files
pull-requests: read # for dorny/paths-filter to read pull requests
runs-on: ubuntu-latest runs-on: ubuntu-latest
if: | if: |
(github.repository == 'kubernetes/ingress-nginx') (github.repository == 'kubernetes/ingress-nginx')
@ -18,15 +21,15 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v2 uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
- uses: dorny/paths-filter@v2 - uses: dorny/paths-filter@b2feaf19c27470162a626bd6fa8438ae5b263721 # v2
id: filter id: filter
with: with:
token: ${{ secrets.GITHUB_TOKEN }} token: ${{ secrets.GITHUB_TOKEN }}
filters: | filters: |
docs: docs:
- 'docs/**/*' - 'docs/**/*'
docs: docs:
name: Update name: Update
@ -43,9 +46,9 @@ jobs:
steps: steps:
- name: Checkout master - name: Checkout master
uses: actions/checkout@v2 uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
- name: Deploy - name: Deploy
uses: ./.github/actions/mkdocs uses: ./.github/actions/mkdocs
env: env:
PERSONAL_TOKEN: "${{ secrets.GITHUB_TOKEN }}" PERSONAL_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

11
.github/workflows/helm.yaml vendored
View file

@ -9,6 +9,9 @@ on:
jobs: jobs:
changes: changes:
permissions:
contents: read # for dorny/paths-filter to fetch a list of changed files
pull-requests: read # for dorny/paths-filter to read pull requests
runs-on: ubuntu-latest runs-on: ubuntu-latest
if: | if: |
(github.repository == 'kubernetes/ingress-nginx') (github.repository == 'kubernetes/ingress-nginx')
@ -19,9 +22,9 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v2 uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
- uses: dorny/paths-filter@v2 - uses: dorny/paths-filter@b2feaf19c27470162a626bd6fa8438ae5b263721 # v2
id: filter id: filter
with: with:
token: ${{ secrets.GITHUB_TOKEN }} token: ${{ secrets.GITHUB_TOKEN }}
@ -46,7 +49,7 @@ jobs:
steps: steps:
- name: Checkout master - name: Checkout master
uses: actions/checkout@v2 uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
with: with:
# Fetch entire history. Required for chart-releaser; see https://github.com/helm/chart-releaser-action/issues/13#issuecomment-602063896 # Fetch entire history. Required for chart-releaser; see https://github.com/helm/chart-releaser-action/issues/13#issuecomment-602063896
fetch-depth: 0 fetch-depth: 0
@ -58,7 +61,7 @@ jobs:
git config --global user.email "$GITHUB_ACTOR@users.noreply.github.com" git config --global user.email "$GITHUB_ACTOR@users.noreply.github.com"
- name: Run chart-releaser - name: Run chart-releaser
uses: helm/chart-releaser-action@v1.2.1 uses: helm/chart-releaser-action@c25b74a986eb925b398320414b576227f375f946 # v1.2.1
env: env:
CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
CR_RELEASE_NAME_TEMPLATE: "helm-chart-{{ .Version }}" CR_RELEASE_NAME_TEMPLATE: "helm-chart-{{ .Version }}"