diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 214ec932c..cb4771564 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -7,6 +7,8 @@ on: branches: - main +permissions: {} + env: CODE_COVERAGE_FILE_NAME: "coverage.out" # must be the same as in Makefile CODE_COVERAGE_ARTIFACT_NAME: "code-coverage" @@ -17,10 +19,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7.0.1 - + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Install go - uses: actions/setup-go@v7.0.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: "go.mod" cache: true @@ -36,7 +40,7 @@ jobs: run: make test - name: Archive code coverage results - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ env.CODE_COVERAGE_ARTIFACT_NAME }} path: ${{ env.CODE_COVERAGE_FILE_NAME }} @@ -47,10 +51,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Check GoReleaser - uses: goreleaser/goreleaser-action@v7.3.0 + uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0 with: args: check @@ -65,7 +71,7 @@ jobs: pull-requests: write # write permission needed to comment on PR steps: - name: Check new code coverage - uses: fgrosse/go-coverage-report@v1.5.0 + uses: fgrosse/go-coverage-report@c4bf7e78d1379325814b4dd42d80e526082e788b # v1.5.0 continue-on-error: true # Add this line to prevent pipeline failures in forks with: coverage-artifact-name: ${{ env.CODE_COVERAGE_ARTIFACT_NAME }} diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml index b81772964..25f9d7e75 100644 --- a/.github/workflows/labeler.yaml +++ b/.github/workflows/labeler.yaml @@ -7,6 +7,8 @@ on: # run every full hour (to still label PRs from forks) - cron: '0 * * * *' +permissions: {} + jobs: # this job runs when the workflow was triggered by the 'pull_request' event pr-labeler: @@ -20,7 +22,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Labeler action - uses: actions/labeler@v7 + uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0 with: sync-labels: false @@ -49,7 +51,7 @@ jobs: - name: Labeler action if: ${{ steps.fetch-prs.outputs.numbers != '' }} - uses: actions/labeler@v7 + uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0 with: sync-labels: false pr-number: ${{ steps.fetch-prs.outputs.numbers }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 76cdf4c8b..09c395fd8 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -10,33 +10,33 @@ on: - "v[0-9]+.[0-9]+.[0-9]+-*" workflow_dispatch: -# Releases need permissions to read and write the repository contents. -# GitHub considers creating releases and uploading assets as writing contents. -permissions: - contents: write - issues: write +permissions: {} jobs: goreleaser: name: Release runs-on: macOS-latest + permissions: + contents: write # Create releases and upload assets. + issues: write # Notify maintainers about the Homebrew PR. env: SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_TOKEN }} steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false # Allow goreleaser to access older tag information. fetch-depth: 0 - name: Install go - uses: actions/setup-go@v7.0.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: "go.mod" - cache: true + cache: false # Do not consume CI caches when building release artifacts. - name: Import GPG key - uses: crazy-max/ghaction-import-gpg@v7 + uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 id: import_gpg with: gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} @@ -72,15 +72,15 @@ jobs: SIGNING_CERTIFICATE_BASE64: ${{ secrets.APPLICATION_ID_CERT }} AUTHKEY_BASE64: ${{ secrets.APPLE_API_KEY }} - name: Install Snapcraft - uses: samuelmeuli/action-snapcraft@v3 + uses: samuelmeuli/action-snapcraft@fceeb3c308e76f3487e72ef608618de625fb7fe8 # v3.0.1 - name: Run GoReleaser - uses: goreleaser/goreleaser-action@v7.3.0 + uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0 with: args: release --clean env: # GITHUB_TOKEN is used to create the GitHub release in this repository. - # It uses the workflow-level permissions defined above. + # It uses the job-level contents: write permission. GITHUB_TOKEN: ${{ github.token }} # HOMEBREW_RELEASE_TOKEN is a PAT belonging to the `stackit-pipeline` user. # It is used by GoReleaser to push to the tap fork and open the upstream Homebrew PR. @@ -105,7 +105,7 @@ jobs: rm -f "$GPG_KEY_PATH" - name: Upload artifacts to workflow - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: goreleaser-dist-temp path: dist @@ -121,11 +121,13 @@ jobs: AWS_SECRET_ACCESS_KEY: ${{ secrets.OBJECT_STORAGE_SECRET_ACCESS_KEY }} steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false # use the artifacts from the "goreleaser" job - name: Download artifacts from workflow - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: goreleaser-dist-temp path: dist @@ -134,7 +136,7 @@ jobs: run: brew install aptly - name: Import GPG key - uses: crazy-max/ghaction-import-gpg@v7 + uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 id: import_gpg with: gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} @@ -159,10 +161,12 @@ jobs: AWS_ENDPOINT_URL: https://object.storage.eu01.onstackit.cloud steps: - name: Checkout - uses: actions/checkout@v7.0.1 - + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Download artifacts from workflow - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: goreleaser-dist-temp path: dist @@ -173,7 +177,7 @@ jobs: sudo apt-get install -y createrepo-c - name: Import GPG key - uses: crazy-max/ghaction-import-gpg@v7 + uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 id: import_gpg with: gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml index 82624c58e..0a756afa8 100644 --- a/.github/workflows/stale.yaml +++ b/.github/workflows/stale.yaml @@ -13,18 +13,18 @@ env: DAYS_BEFORE_PR_CLOSE: 14 EXEMPT_PR_LABELS: "ignore-stale" -permissions: - issues: write - pull-requests: write +permissions: {} jobs: stale: name: "Stale" runs-on: ubuntu-latest timeout-minutes: 10 + permissions: + pull-requests: write steps: - name: "Mark old PRs as stale" - uses: actions/stale@v11.0.0 + uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-pr-message: "This PR was marked as stale after ${{ env.DAYS_BEFORE_PR_STALE }} days of inactivity and will be closed after another ${{ env.DAYS_BEFORE_PR_CLOSE }} days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it." diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml new file mode 100644 index 000000000..defc19d5f --- /dev/null +++ b/.github/workflows/zizmor.yaml @@ -0,0 +1,28 @@ +name: GitHub Actions Security + +on: + pull_request: + workflow_dispatch: + push: + branches: + - main + +permissions: {} + +jobs: + zizmor: + name: zizmor + runs-on: ubuntu-latest + permissions: + security-events: write # Upload SARIF to GitHub code scanning. + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + # SARIF findings are enforced through code-scanning policies, not this job's exit status. + - name: Run zizmor + uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1 + with: + version: v1.32.0