Skip to content

Commit bea0037

Browse files
smlxsmlx
authored
Merge pull request #57 from smlx/safe-actions
fix: improve the safety of github action
2 parents 43143a8 + eaf2a66 commit bea0037

File tree

11 files changed

+135
-156
lines changed

11 files changed

+135
-156
lines changed

‎.github/dependabot.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
version: 2
22
updates:
3-
- package-ecosystem: docker
3+
- package-ecosystem: github-actions
44
directory: /
55
schedule:
6-
interval: daily
7-
- package-ecosystem: github-actions
6+
interval: weekly
7+
- package-ecosystem: docker
88
directory: /
99
schedule:
1010
interval: daily

‎.github/workflows/actionlint.yaml‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎.github/workflows/build.yaml‎

Lines changed: 26 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,68 +1,71 @@
11
name: Build
2-
on: pull_request
2+
permissions: read-all
3+
on:
4+
pull_request:
5+
branches:
6+
- main
37
jobs:
4-
build:
8+
build-binaries:
9+
permissions:
10+
contents: read
11+
actions: write
512
runs-on: ubuntu-latest
613
steps:
7-
- name: Checkout
8-
uses: actions/checkout@v4
14+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
915
with:
1016
ref: ${{ github.event.pull_request.head.sha }}
11-
- name: Install Go
12-
uses: actions/setup-go@v5
17+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
1318
with:
1419
go-version: stable
15-
- name: Set up environment
16-
run: echo "GOVERSION=$(go version)" >> "$GITHUB_ENV"
17-
- name: Run GoReleaser
18-
uses: goreleaser/goreleaser-action@v5
20+
- run: echo "GOVERSION=$(go version)" >> "$GITHUB_ENV"
21+
- uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
1922
with:
2023
version: latest
2124
args: build --snapshot --clean
22-
- name: Tar up binaries
25+
- name: Upload binary artifacts
2326
# work around limitations in the upload/download artifact actions
2427
# https://github.com/actions/download-artifact#limitations
2528
run: tar -cvf dist.tar dist
2629
- name: Upload binaries tar file
27-
uses: actions/upload-artifact@v3
30+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
2831
with:
2932
name: dist.tar
3033
path: dist.tar
31-
buildimage:
34+
build-images:
3235
permissions:
36+
contents: read
37+
actions: read
3338
packages: write
3439
id-token: write
3540
if: ${{ !startsWith(github.head_ref, 'dependabot/') }}
3641
strategy:
3742
matrix:
3843
binary:
3944
- go-cli-github
40-
needs: build
45+
needs: build-binaries
4146
runs-on: ubuntu-latest
4247
steps:
43-
- name: Checkout
44-
uses: actions/checkout@v4
45-
- name: Download binaries tar file
46-
uses: actions/download-artifact@v3
48+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
49+
- name: Download binary artifacts
50+
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
4751
with:
4852
name: dist.tar
4953
- name: Untar binaries
5054
run: tar -xvf dist.tar
5155
- name: Login to GHCR
52-
uses: docker/login-action@v3
56+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
5357
with:
5458
registry: ghcr.io
5559
username: ${{ github.repository_owner }}
5660
password: ${{ secrets.GITHUB_TOKEN }}
57-
- name: Docker metadata
58-
# this id is namespaced per matrix run
61+
- name: Get Docker metadata
5962
id: docker_metadata
60-
uses: docker/metadata-action@v5
63+
uses: docker/metadata-action@31cebacef4805868f9ce9a0cb03ee36c32df2ac4 # v5.3.0
6164
with:
6265
images: ghcr.io/${{ github.repository }}/${{ matrix.binary }}
6366
- name: Build and push ${{ matrix.binary }} container image
6467
id: docker_build
65-
uses: docker/build-push-action@v5
68+
uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
6669
with:
6770
push: true
6871
tags: ${{ steps.docker_metadata.outputs.tags }}

‎.github/workflows/codeql-analysis.yaml‎

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,28 @@
1-
name: "CodeQL"
2-
1+
name: CodeQL
32
on:
43
push:
54
branches:
65
- main
76
pull_request:
87
branches:
98
- main
10-
9+
permissions:
10+
actions: read
11+
contents: read
12+
security-events: write
1113
jobs:
1214
analyze:
13-
name: Analyze
1415
runs-on: ubuntu-latest
15-
permissions:
16-
actions: read
17-
contents: read
18-
security-events: write
1916
strategy:
2017
fail-fast: false
2118
matrix:
2219
language:
2320
- go
2421
steps:
25-
- name: Checkout repository
26-
uses: actions/checkout@v4
22+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
2723
- name: Initialize CodeQL
28-
uses: github/codeql-action/init@v2
24+
uses: github/codeql-action/init@c0d1daa7f7e14667747d73a7dbbe8c074bc8bfe2 # v2.22.9
2925
with:
3026
languages: ${{ matrix.language }}
3127
- name: Perform CodeQL Analysis
32-
uses: github/codeql-action/analyze@v2
28+
uses: github/codeql-action/analyze@c0d1daa7f7e14667747d73a7dbbe8c074bc8bfe2 # v2.22.9

‎.github/workflows/coverage.yaml‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,28 +3,27 @@ on:
33
push:
44
branches:
55
- main
6-
6+
permissions:
7+
contents: read
78
jobs:
89
coverage:
910
runs-on: ubuntu-latest
1011
steps:
11-
- name: Checkout repository
12-
uses: actions/checkout@v4
12+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
1313
- name: Configure git
1414
run: |
1515
git config --global user.name "$GITHUB_ACTOR"
1616
git config --global user.email "$GITHUB_ACTOR@users.noreply.github.com"
17-
- name: Set up go
18-
uses: actions/setup-go@v5
17+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
1918
with:
2019
go-version: stable
2120
- name: Calculate coverage
2221
run: |
2322
go test -v -covermode=count -coverprofile=coverage.out.raw -coverpkg=./... ./...
2423
grep -v mock_ coverage.out.raw > coverage.out
2524
- name: Convert coverage to lcov
26-
uses: jandelgado/gcov2lcov-action@v1
27-
- name: Coveralls
28-
uses: coverallsapp/github-action@v2.2.3
25+
uses: jandelgado/gcov2lcov-action@c680c0f7c7442485f1749eb2a13e54a686e76eb5 # v1.0.9
26+
- name: Upload coverage to Coveralls
27+
uses: coverallsapp/github-action@3dfc5567390f6fa9267c0ee9c251e4c8c3f18949 # v2.2.3
2928
with:
3029
github-token: ${{ secrets.github_token }}

‎.github/workflows/dependabot-automerge.yaml‎

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,26 @@
11
# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#enable-auto-merge-on-a-pull-request
22
name: Dependabot auto-merge
3-
on: pull_request
4-
3+
on:
4+
pull_request:
5+
branches:
6+
- main
57
permissions:
68
contents: write
79
pull-requests: write
8-
910
jobs:
10-
dependabot:
11+
dependabot-automerge:
1112
runs-on: ubuntu-latest
1213
if: github.actor == 'dependabot[bot]'
1314
steps:
14-
- name: Dependabot metadata
15-
id: metadata
16-
uses: dependabot/fetch-metadata@v1
17-
with:
18-
github-token: "${{ secrets.GITHUB_TOKEN }}"
19-
- name: Enable auto-merge for Dependabot PRs
20-
if: ! contains(steps.metadata.outputs.package-ecosystem, 'github-actions')
21-
run: gh pr merge --auto --merge "$PR_URL"
22-
env:
23-
PR_URL: ${{github.event.pull_request.html_url}}
24-
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
15+
- name: Fetch dependabot metadata
16+
id: metadata
17+
uses: dependabot/fetch-metadata@c9c4182bf1b97f5224aee3906fd373f6b61b4526 # v1.6.0
18+
with:
19+
github-token: "${{ secrets.GITHUB_TOKEN }}"
20+
- name: Auto-merge Dependabot PRs
21+
# don't auto-merge action updates to appease OpenSSF scorecard
22+
if: ! contains(steps.metadata.outputs.package-ecosystem, 'github-actions')
23+
run: gh pr merge --auto --merge "$PR_URL"
24+
env:
25+
PR_URL: ${{github.event.pull_request.html_url}}
26+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

‎.github/workflows/dependency-review.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
1-
name: 'Dependency Review'
1+
name: Dependency Review
22
on:
3-
- pull_request
3+
pull_request:
4+
branches:
5+
- main
46
permissions:
57
contents: read
68
jobs:
79
dependency-review:
810
runs-on: ubuntu-latest
911
steps:
10-
- name: 'Checkout Repository'
11-
uses: actions/checkout@v4
12-
- name: Dependency Review
13-
uses: actions/dependency-review-action@v3
12+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
13+
- uses: actions/dependency-review-action@01bc87099ba56df1e897b6874784491ea6309bc4 # v3.1.4
1414
with:
15-
config-file: '.github/dependency-review-config.yml'
15+
config-file: .github/dependency-review-config.yml

‎.github/workflows/lint.yaml‎

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,32 @@
11
name: Lint
2-
on: pull_request
2+
on:
3+
pull_request:
4+
branches:
5+
- main
6+
permissions:
7+
contents: read
38
jobs:
4-
golangci-lint:
5-
name: lint
9+
lint-go:
610
runs-on: ubuntu-latest
711
steps:
8-
- name: Checkout
9-
uses: actions/checkout@v4
10-
- name: Install Go
11-
uses: actions/setup-go@v5
12+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
13+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
1214
with:
1315
go-version: stable
14-
- name: golangci-lint
15-
uses: golangci/golangci-lint-action@v3
16+
- uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
1617
with:
1718
args: --timeout=180s
18-
commitlint:
19+
lint-commits:
1920
runs-on: ubuntu-latest
2021
steps:
21-
- name: Checkout
22-
uses: actions/checkout@v4
22+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
2323
with:
2424
fetch-depth: 0
25-
- name: Lint commit messages
26-
uses: wagoid/commitlint-github-action@v5
25+
- uses: wagoid/commitlint-github-action@0d749a1a91d4770e983a7b8f83d4a3f0e7e0874e # v5.4.4
26+
lint-actions:
27+
runs-on: ubuntu-latest
28+
steps:
29+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
30+
- uses: docker://rhysd/actionlint:latest@sha256:2eb91a78b5a19140be099c7b4262d298c2567f2a9f27e10ed2a4323c5bcface8
31+
with:
32+
args: -color

‎.github/workflows/ossf-scorecard.yaml‎

Lines changed: 0 additions & 35 deletions
This file was deleted.

0 commit comments

Comments
 (0)