Skip to content

Commit a440e88

Browse files
RalphHightowerRalphHightower
authored
[build](web): Actions(@RalphHightower/blog)
Signed-off-by: Ralph Hightower <[email protected]>
1 parent 8c96611 commit a440e88

17 files changed

+260
-104
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: ci.yml – Continuous Integration
2+
on:
3+
push:
4+
branches:
5+
- main
6+
pull_request:
7+
branches:
8+
- main
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
build:
14+
name: "Test with Jekyll ${{ matrix.jekyll }}"
15+
runs-on: "ubuntu-latest"
16+
strategy:
17+
matrix:
18+
jekyll: ["~> 4.3.4", "~>4.4.1"]
19+
env:
20+
JEKYLL_VERSION: ${{ matrix.jekyll }}
21+
steps:
22+
- name: Harden Runner
23+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
24+
with:
25+
egress-policy: audit
26+
27+
- name: Checkout Repository
28+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
29+
- name: Set Up Ruby 3.4.7
30+
uses: ruby/setup-ruby@4c24fa5ec04b2e79eb40571b1cee2a0d2b705771 # v1.278.0
31+
with:
32+
ruby-version: 3.4.7
33+
bundler-cache: true
34+
# - name: Run tests
35+
# run: script/cibuild

‎.github/workflows/codeql.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -41,16 +41,16 @@ jobs:
4141

4242
steps:
4343
- name: Harden the runner (Audit all outbound calls)
44-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
44+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
4545
with:
4646
egress-policy: audit
4747

4848
- name: Checkout repository
49-
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
49+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
5050

5151
# Initializes the CodeQL tools for scanning.
5252
- name: Initialize CodeQL
53-
uses: github/codeql-action/init@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
53+
uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
5454
with:
5555
languages: ${{ matrix.language }}
5656
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -60,7 +60,7 @@ jobs:
6060
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
6161
# If this step fails, then you should remove it and run the build manually (see below)
6262
- name: Autobuild
63-
uses: github/codeql-action/autobuild@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
63+
uses: github/codeql-action/autobuild@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
6464

6565
# ℹ️ Command-line programs to run using the OS shell.
6666
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -73,6 +73,6 @@ jobs:
7373
# ./location_of_script_within_repo/buildscript.sh
7474

7575
- name: Perform CodeQL Analysis
76-
uses: github/codeql-action/analyze@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
76+
uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
7777
with:
78-
category: "/language:${{matrix.language}}"
78+
category: "/language:${{matrix.language}}"

‎.github/workflows/dependabot.txt‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Basic `dependabot.yml` file with
2+
# minimum configuration for two package managers
3+
4+
version: 2
5+
updates:
6+
permissions:
7+
contents: write
8+
# Enable version updates for npm
9+
- package-ecosystem: "npm"
10+
# Look for `package.json` and `lock` files in the `root` directory
11+
directory: "/"
12+
# Check the npm registry for updates every day (weekdays)
13+
schedule:
14+
interval: "daily"
15+
commit-message:
16+
prefix: "[info](sec) npm:"
17+
18+
# Enable version updates for Ruby
19+
- package-ecosystem: "bundler"
20+
# Look for `Ruby Gems` in the following directories
21+
directories:
22+
- "/"
23+
# - "_plugins"
24+
# Check for updates once a week
25+
schedule:
26+
interval: "daily"
27+
commit-message:
28+
prefix: "[info](sec) bundler:"
29+
30+
- package-ecosystem: github-actions
31+
directory: /
32+
schedule:
33+
interval: daily
34+
commit-message:
35+
prefix: "[info](sec) gh-actions:"

‎.github/workflows/dependency-review.yml‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,26 +2,43 @@
22
#
33
# This Action will scan dependency manifest files that change as part of a Pull Request,
44
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5-
# Once installed, if the workflow run is marked as required,
6-
# PRs introducing known-vulnerable packages will be blocked from merging.
5+
# Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable
6+
# packages will be blocked from merging.
77
#
88
# Source repository: https://github.com/actions/dependency-review-action
9-
name: 'dependency – Dependency Review'
10-
on: [pull_request]
9+
# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
10+
name: 'Dependency review'
11+
on:
12+
pull_request:
13+
branches: [ "main", "main*" ]
1114

15+
# If using a dependency submission action in this workflow this permission will need to be set to:
16+
#
17+
# permissions:
18+
# contents: write
19+
#
20+
# https://docs.github.com/en/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api
1221
permissions:
1322
contents: read
23+
# Write permissions for pull-requests are required for using the `comment-summary-in-pr` option, comment out if you aren't using this option
24+
pull-requests: write
1425

1526
jobs:
1627
dependency-review:
1728
runs-on: ubuntu-latest
1829
steps:
1930
- name: Harden the runner (Audit all outbound calls)
20-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
31+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
2132
with:
2233
egress-policy: audit
2334

24-
- name: 'Checkout Repository'
25-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
35+
- name: 'Checkout repository'
36+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
2637
- name: 'Dependency Review'
27-
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
38+
uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
39+
# Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options.
40+
with:
41+
comment-summary-in-pr: always
42+
# fail-on-severity: moderate
43+
# deny-licenses: GPL-1.0-or-later, LGPL-2.0-or-later
44+
# retry-on-snapshot-warnings: true

‎.github/workflows/issueQuarterlyRelease.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818

1919
steps:
2020
- name: Harden the runner (Audit all outbound calls)
21-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
21+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
2222
with:
2323
egress-policy: audit
2424

@@ -44,4 +44,4 @@ jobs:
4444
- [ ] Create Quarterly Release.
4545
4646
PINNED: false
47-
CLOSE_PREVIOUS: false
47+
CLOSE_PREVIOUS: false

‎.github/workflows/jekyll.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -29,17 +29,17 @@ concurrency:
2929
jobs:
3030
# Build job
3131
build:
32-
runs-on: ubuntu-latest
32+
runs-on: ubuntu-22.04
3333
steps:
3434
- name: Harden Runner
35-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
35+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
3636
with:
3737
egress-policy: audit
3838

3939
- name: Checkout
40-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
40+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
4141
- name: Setup Ruby
42-
uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
42+
uses: ruby/setup-ruby@4c24fa5ec04b2e79eb40571b1cee2a0d2b705771 # v1.278.0
4343
with:
4444
ruby-version: '3.4.7' # Not needed with a .ruby-version file
4545
bundler-cache: true # runs 'bundle install' and caches installed gems automatically
@@ -67,10 +67,10 @@ jobs:
6767
needs: build
6868
steps:
6969
- name: Harden Runner
70-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
70+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
7171
with:
7272
egress-policy: audit
7373

7474
- name: Deploy to GitHub Pages
7575
id: deployment
76-
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
76+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

‎.github/workflows/newYearUpdateCopyright.yml‎

Lines changed: 30 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,40 @@
1-
name: newYearUpdateCopyright.yml – New Year LICENSE Reminder
2-
1+
name: Create Issue to Update Year In Relevant Files
2+
# developer: @RalphHightower
33
on:
44
schedule:
5-
- cron: '0 5 1 1 *' # Midnight EST on Jan 1 America/New_York
5+
- cron: "0 5 1 1 *" # America/New_York (UTC-5:00)
66
#workflow_dispatch:
77

8-
permissions: read-all
9-
8+
permissions:
9+
contents: read
10+
1011
jobs:
11-
create-issue:
12+
create_issue:
13+
name: Create issue to update copyright year
1214
runs-on: ubuntu-latest
1315
permissions:
1416
issues: write
1517
steps:
16-
- name: Harden the runner (Audit all outbound calls)
17-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
18-
with:
19-
egress-policy: audit
18+
- name: Happy New Year!
19+
run: |
20+
new_issue_url=$(gh issue create \
21+
--title "$TITLE" \
22+
--assignee "$ASSIGNEES" \
23+
--label "$LABELS" \
24+
--body "$BODY")
25+
if [[ $PINNED == true ]]; then
26+
gh issue pin "$new_issue_url"
27+
fi
28+
env:
29+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
30+
GH_REPO: ${{ github.repository }}
31+
TITLE: Happy New Year! 🎆 – 🍾 Update License Year
32+
ASSIGNEES: RalphHightower
33+
LABELS: "maintenance"
34+
BODY: |
35+
# New Year's Maintenance
36+
37+
- [ ] Update LICENSE. Add new year to year's span.
2038
21-
- name: Create LICENSE update issue
22-
uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6.0.0
23-
with:
24-
title: "Update LICENSE for the new year"
25-
content-filepath: .github/license-reminder.md
26-
assignees: RalphHightower
27-
labels: |
28-
maintenance
29-
license
39+
PINNED: false
40+
CLOSE_PREVIOUS: false

‎.github/workflows/permission_advisor.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,12 @@ jobs:
2121
advisor:
2222
runs-on: ubuntu-latest
2323
steps:
24-
- name: Harden the runner (Audit all outbound calls)
25-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
24+
- name: Harden Runner
25+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
2626
with:
2727
egress-policy: audit
2828

2929
- uses: GitHubSecurityLab/actions-permissions/advisor@babd69bc8d78e6cdece903dfdcfb72d4e1a4f00d # v1.0.2-beta5
3030
with:
3131
name: ${{ inputs.name }}
32-
count: ${{ inputs.count }}
32+
count: ${{ inputs.count }}

‎.github/workflows/readme-checker.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,18 @@ jobs:
88
lint:
99
runs-on: ubuntu-latest
1010
steps:
11-
- name: Harden the runner (Audit all outbound calls)
12-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
11+
- name: Harden Runner
12+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
1313
with:
1414
egress-policy: audit
1515

1616
- name: Checkout
17-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
17+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
1818
- name: Checking markdown
19-
uses: DavidAnson/markdownlint-cli2-action@05f32210e84442804257b2a6f20b273450ec8265 # v19.1.0
19+
uses: DavidAnson/markdownlint-cli2-action@07035fd053f7be764496c0f8d8f9f41f98305101 # v22.0.0
2020
with:
2121
globs: |
2222
*.md
2323
**/*.md
2424
!test/*.md
25+
!_data/*.md

‎.github/workflows/release-please.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,29 +6,37 @@ on:
66

77
permissions:
88
actions: none
9+
attestations: none
910
checks: none
1011
contents: none
1112
deployments: none
13+
id-token: none
1214
issues: none
15+
discussions: none
1316
packages: none
17+
pages: none
1418
pull-requests: none
1519
repository-projects: none
1620
security-events: none
1721
statuses: none
18-
19-
name: release-please
2022

2123
jobs:
2224
release-please:
2325
runs-on: ubuntu-latest
2426
steps:
25-
- uses: googleapis/[email protected]
27+
- name: Harden Runner
28+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
29+
with:
30+
egress-policy: audit
31+
32+
- uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
2633
with:
2734
contents: write
35+
pull-requests: write
2836
# this assumes that you have created a personal access token
2937
# (PAT) and configured it as a GitHub action secret named
3038
# `MY_RELEASE_PLEASE_TOKEN` (this secret name is not important).
3139
token: ${{ secrets.GITHUB_TOKEN }}
3240
# this is a built-in strategy in release-please, see "Action Inputs"
3341
# for more options
34-
release-type: simple
42+
release-type: simple

0 commit comments

Comments
 (0)