Skip to content

Commit 1a2f1d2

Browse files
markscott-msmarkscott-ms
authored
Merge pull request #1488 from rocketstack-matt/security-patch
Resolve security warnings for Actions workflows having no restrictions
2 parents e1130c1 + 6d00e00 commit 1a2f1d2

19 files changed

+625
-571
lines changed

‎.github/workflows/auto-comment.yml‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
name: Auto Comment
2+
3+
permissions:
4+
contents: read
5+
26
on: [pull_request]
37
jobs:
4-
run:
5-
runs-on: ubuntu-latest
6-
steps:
7-
- uses: wow-actions/auto-comment@v1
8-
with:
9-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
10-
pullRequestOpened: |
11-
THIS SOFTWARE IS CONTRIBUTED SUBJECT TO THE TERMS OF THE FINOS Corporate Contributor License Agreement.
12-
13-
THIS SOFTWARE IS LICENSED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTY OF NON-INFRINGEMENT, ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. THIS SOFTWARE MAY BE REDISTRIBUTED TO OTHERS ONLY BY EFFECTIVELY USING THIS OR ANOTHER EQUIVALENT DISCLAIMER IN ADDITION TO ANY OTHER REQUIRED LICENSE TERMS.
8+
run:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: wow-actions/auto-comment@v1
12+
with:
13+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
14+
pullRequestOpened: |
15+
THIS SOFTWARE IS CONTRIBUTED SUBJECT TO THE TERMS OF THE FINOS Corporate Contributor License Agreement.
16+
17+
THIS SOFTWARE IS LICENSED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTY OF NON-INFRINGEMENT, ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. THIS SOFTWARE MAY BE REDISTRIBUTED TO OTHERS ONLY BY EFFECTIVELY USING THIS OR ANOTHER EQUIVALENT DISCLAIMER IN ADDITION TO ANY OTHER REQUIRED LICENSE TERMS.

‎.github/workflows/build-calm-hub-coverage.yml‎

Lines changed: 34 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,43 @@
11
name: Build Calm Hub For Unit Test Coverage
22

3+
permissions:
4+
contents: read
5+
36
on:
4-
pull_request:
5-
branches:
6-
- "main"
7-
push:
8-
branches:
9-
- "main"
7+
pull_request:
8+
branches:
9+
- 'main'
10+
push:
11+
branches:
12+
- 'main'
1013

1114
jobs:
12-
build:
13-
name: Build Calm Hub
14-
runs-on: ubuntu-latest
15+
build:
16+
name: Build Calm Hub
17+
runs-on: ubuntu-latest
1518

16-
steps:
17-
# Step 1: Checkout PR Branch
18-
- name: Checkout PR Branch
19-
uses: actions/checkout@v4
19+
steps:
20+
# Step 1: Checkout PR Branch
21+
- name: Checkout PR Branch
22+
uses: actions/checkout@v4
2023

21-
# Step 2: Set up JDK
22-
- name: Set up JDK
23-
uses: actions/setup-java@v4
24-
with:
25-
distribution: 'temurin'
26-
java-version: '21'
24+
# Step 2: Set up JDK
25+
- name: Set up JDK
26+
uses: actions/setup-java@v4
27+
with:
28+
distribution: 'temurin'
29+
java-version: '21'
2730

28-
# Step 3: Cache Maven Dependencies
29-
- name: Cache Maven Dependencies
30-
uses: actions/cache@v4
31-
with:
32-
path: ~/.m2
33-
key: ${{ runner.os }}-m2-${{ hashFiles('calm-hub/pom.xml') }}
34-
restore-keys: |
35-
${{ runner.os }}-m2-
31+
# Step 3: Cache Maven Dependencies
32+
- name: Cache Maven Dependencies
33+
uses: actions/cache@v4
34+
with:
35+
path: ~/.m2
36+
key: ${{ runner.os }}-m2-${{ hashFiles('calm-hub/pom.xml') }}
37+
restore-keys: |
38+
${{ runner.os }}-m2-
3639
37-
# Step 4: Build and Test
38-
- name: Build and Test
39-
working-directory: calm-hub
40-
run: mvn clean verify
40+
# Step 4: Build and Test
41+
- name: Build and Test
42+
working-directory: calm-hub
43+
run: mvn clean verify

‎.github/workflows/build-calm-hub-ui.yml‎

Lines changed: 27 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,38 @@
11
name: Build CALM Hub UI
22

3+
permissions:
4+
contents: read
5+
36
on:
4-
pull_request:
5-
branches:
6-
- "main"
7-
push:
8-
branches:
9-
- "main"
7+
pull_request:
8+
branches:
9+
- 'main'
10+
push:
11+
branches:
12+
- 'main'
1013

1114
jobs:
12-
shared:
13-
name: Build, Test, and Lint Shared Module
14-
runs-on: ubuntu-latest
15+
shared:
16+
name: Build, Test, and Lint Shared Module
17+
runs-on: ubuntu-latest
1518

16-
steps:
17-
- name: Checkout PR Branch
18-
uses: actions/checkout@v4
19+
steps:
20+
- name: Checkout PR Branch
21+
uses: actions/checkout@v4
1922

20-
- name: Setup Node.js
21-
uses: actions/setup-node@v4
22-
with:
23-
node-version: v22
23+
- name: Setup Node.js
24+
uses: actions/setup-node@v4
25+
with:
26+
node-version: v22
2427

25-
- name: Install workspace
26-
run: npm ci
28+
- name: Install workspace
29+
run: npm ci
2730

28-
- name: Lint Shared Module
29-
run: npm run lint --workspace=calm-hub-ui
31+
- name: Lint Shared Module
32+
run: npm run lint --workspace=calm-hub-ui
3033

31-
- name: Build workspace
32-
run: npm run build --workspace=calm-hub-ui
34+
- name: Build workspace
35+
run: npm run build --workspace=calm-hub-ui
3336

34-
- name: Run tests for Shared
35-
run: npm run test --workspace=calm-hub-ui
37+
- name: Run tests for Shared
38+
run: npm run test --workspace=calm-hub-ui

‎.github/workflows/build-calm-hub.yml‎

Lines changed: 42 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,47 @@
11
name: Build Calm Hub with Integration Tests and Coverage
22

3+
permissions:
4+
contents: read
5+
36
on:
4-
pull_request:
5-
branches:
6-
- "main"
7-
push:
8-
branches:
9-
- "main"
7+
pull_request:
8+
branches:
9+
- 'main'
10+
push:
11+
branches:
12+
- 'main'
1013

1114
jobs:
12-
build:
13-
name: Build Calm Hub
14-
runs-on: ubuntu-latest
15-
16-
steps:
17-
# Step 1: Checkout PR Branch
18-
- name: Checkout PR Branch
19-
uses: actions/checkout@v4
20-
21-
# Step 2: Set up JDK
22-
- name: Set up JDK
23-
uses: actions/setup-java@v4
24-
with:
25-
distribution: 'temurin'
26-
java-version: '21'
27-
28-
# Step 3: Cache Maven Dependencies
29-
- name: Cache Maven Dependencies
30-
uses: actions/cache@v4
31-
with:
32-
path: ~/.m2
33-
key: ${{ runner.os }}-m2-${{ hashFiles('calm-hub/pom.xml') }}
34-
restore-keys: |
35-
${{ runner.os }}-m2-
36-
37-
# Step 4: Set up Docker (Required for Testcontainers)
38-
- name: Set up Docker
39-
uses: docker/setup-buildx-action@v3
40-
41-
# Step 5: Build and Test
42-
- name: Build and Test
43-
working-directory: calm-hub
44-
run: mvn -P integration clean verify
15+
build:
16+
name: Build Calm Hub
17+
runs-on: ubuntu-latest
18+
19+
steps:
20+
# Step 1: Checkout PR Branch
21+
- name: Checkout PR Branch
22+
uses: actions/checkout@v4
23+
24+
# Step 2: Set up JDK
25+
- name: Set up JDK
26+
uses: actions/setup-java@v4
27+
with:
28+
distribution: 'temurin'
29+
java-version: '21'
30+
31+
# Step 3: Cache Maven Dependencies
32+
- name: Cache Maven Dependencies
33+
uses: actions/cache@v4
34+
with:
35+
path: ~/.m2
36+
key: ${{ runner.os }}-m2-${{ hashFiles('calm-hub/pom.xml') }}
37+
restore-keys: |
38+
${{ runner.os }}-m2-
39+
40+
# Step 4: Set up Docker (Required for Testcontainers)
41+
- name: Set up Docker
42+
uses: docker/setup-buildx-action@v3
43+
44+
# Step 5: Build and Test
45+
- name: Build and Test
46+
working-directory: calm-hub
47+
run: mvn -P integration clean verify

‎.github/workflows/build-cli.yml‎

Lines changed: 27 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,38 @@
11
name: Build CLI
22

3+
permissions:
4+
contents: read
5+
36
on:
4-
pull_request:
5-
branches:
6-
- "main"
7-
push:
8-
branches:
9-
- "main"
7+
pull_request:
8+
branches:
9+
- 'main'
10+
push:
11+
branches:
12+
- 'main'
1013

1114
jobs:
12-
cli:
13-
name: Build, Test, and Lint CLI Module
14-
runs-on: ubuntu-latest
15+
cli:
16+
name: Build, Test, and Lint CLI Module
17+
runs-on: ubuntu-latest
1518

16-
steps:
17-
- name: Checkout PR Branch
18-
uses: actions/checkout@v4
19+
steps:
20+
- name: Checkout PR Branch
21+
uses: actions/checkout@v4
1922

20-
- name: Setup Node.js
21-
uses: actions/setup-node@v4
22-
with:
23-
node-version: v22
23+
- name: Setup Node.js
24+
uses: actions/setup-node@v4
25+
with:
26+
node-version: v22
2427

25-
- name: Install workspace
26-
run: npm ci
28+
- name: Install workspace
29+
run: npm ci
2730

28-
- name: Lint CLI Module
29-
run: npm run lint --workspace=cli
31+
- name: Lint CLI Module
32+
run: npm run lint --workspace=cli
3033

31-
- name: Build workspace
32-
run: npm run build:cli
34+
- name: Build workspace
35+
run: npm run build:cli
3336

34-
- name: Run tests with coverage for CLI
35-
run: npm run test --workspace=cli
37+
- name: Run tests with coverage for CLI
38+
run: npm run test --workspace=cli

‎.github/workflows/build-docs.yml‎

Lines changed: 25 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,34 @@
11
name: Build Docs
22

3+
permissions:
4+
contents: read
5+
36
on:
4-
pull_request:
5-
branches:
6-
- "main"
7-
push:
8-
branches:
9-
- "main"
7+
pull_request:
8+
branches:
9+
- 'main'
10+
push:
11+
branches:
12+
- 'main'
1013

1114
jobs:
12-
docs:
13-
name: Build Docs Module
14-
runs-on: ubuntu-latest
15+
docs:
16+
name: Build Docs Module
17+
runs-on: ubuntu-latest
1518

16-
steps:
17-
- name: Checkout PR Branch
18-
uses: actions/checkout@v4
19+
steps:
20+
- name: Checkout PR Branch
21+
uses: actions/checkout@v4
1922

20-
- name: Setup Node.js
21-
uses: actions/setup-node@v4
22-
with:
23-
node-version: v22
24-
cache: npm
25-
cache-dependency-path: package-lock.json
23+
- name: Setup Node.js
24+
uses: actions/setup-node@v4
25+
with:
26+
node-version: v22
27+
cache: npm
28+
cache-dependency-path: package-lock.json
2629

27-
- name: Install workspace
28-
run: npm ci
30+
- name: Install workspace
31+
run: npm ci
2932

30-
- name: Build Docs
31-
run: npm run build:docs
33+
- name: Build Docs
34+
run: npm run build:docs

0 commit comments

Comments
 (0)