Skip to content

Commit 7781eb0

Browse files
jotakjotak
committed
GH workflows: Remove trigger on pull_request_target
Replaced with pull_request + workflow_run Although the risk of pwn request attacks was mitigated with the ok-to-test label protection, this was still human-error prone. This workflow increases security by not running any code with secret access privileges.
1 parent 8f1c2ea commit 7781eb0

File tree

3 files changed

+79
-33
lines changed

3 files changed

+79
-33
lines changed

‎.github/workflows/build_image_pr.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: Build PR image and upload artifact
2+
on:
3+
pull_request:
4+
types: [labeled]
5+
6+
env:
7+
WF_REGISTRY: quay.io/netobserv
8+
WF_IMAGE: network-observability-cli
9+
10+
jobs:
11+
build-pr-image:
12+
if: ${{ github.event.label.name == 'ok-to-test' }}
13+
name: Build PR image and upload artifact
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@v3
17+
- name: Install make
18+
run: sudo apt -y install make
19+
- name: get short sha
20+
run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
21+
- name: build and save image
22+
run: OCI_BUILD_OPTS="--label quay.expires-after=2w" IMAGE=${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}:${{ env.short_sha }} CLEAN_BUILD=1 make tar-image
23+
- name: make commands
24+
run: USER=netobserv VERSION=${{ env.short_sha }} make commands
25+
- name: upload commands
26+
id: artifact-upload-step
27+
uses: actions/upload-artifact@v4
28+
with:
29+
name: commands
30+
path: build/
31+
- name: save PR number
32+
run: |
33+
echo ${{ github.event.number }} > ./out/pr-id
34+
echo ${{ env.short_sha }} > ./out/short-sha
35+
echo ${{ steps.artifact-upload-step.outputs.artifact-url }} > ./out/commands-url
36+
- name: upload artifacts
37+
uses: actions/upload-artifact@v4
38+
with:
39+
name: pr
40+
path: out/

‎.github/workflows/push_image_pr.yml‎

Lines changed: 31 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,64 @@
1-
name: Build and push PR image to quay.io
1+
name: Push PR image to quay.io
22
on:
3-
pull_request_target:
4-
types: [labeled]
3+
workflow_run:
4+
workflows: ["Build PR image and upload artifact"]
5+
types:
6+
- completed
57

68
env:
79
WF_REGISTRY_USER: netobserv+github_ci
8-
WF_REGISTRY: quay.io/netobserv
9-
WF_IMAGE: network-observability-cli
10-
WF_ORG: netobserv
1110

1211
jobs:
1312
push-pr-image:
14-
if: ${{ github.event.label.name == 'ok-to-test' }}
13+
if: >
14+
github.event.workflow_run.event == 'pull_request' &&
15+
github.event.workflow_run.conclusion == 'success'
1516
name: push PR image
1617
runs-on: ubuntu-latest
1718
steps:
18-
- name: install make
19-
run: sudo apt-get install make
20-
- name: set up go 1.x
21-
uses: actions/setup-go@v3
19+
- name: download artifact
20+
uses: actions/download-artifact@v5
2221
with:
23-
go-version: '1.25'
24-
- name: checkout
25-
uses: actions/checkout@v3
26-
with:
27-
ref: "refs/pull/${{ github.event.number }}/merge"
22+
name: pr
23+
run-id: ${{github.event.workflow_run.id }}
24+
github-token: ${{secrets.GITHUB_TOKEN}}
25+
- name: load images
26+
run: |
27+
docker load --input ./image.tar
2828
- name: docker login to quay.io
2929
uses: docker/login-action@v2
3030
with:
3131
username: ${{ env.WF_REGISTRY_USER }}
3232
password: ${{ secrets.QUAY_SECRET }}
3333
registry: quay.io
34-
- name: get short sha
35-
run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
36-
- name: build and push manifest with images
37-
run: OCI_BUILD_OPTS="--label quay.expires-after=2w" IMAGE_ORG=${{ env.WF_ORG }} IMAGE=${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}:${{ env.short_sha }} CLEAN_BUILD=1 make images
38-
- name: make commands
39-
run: USER=netobserv VERSION=${{ env.short_sha }} make commands
40-
- name: upload commands
41-
id: artifact-upload-step
42-
uses: actions/upload-artifact@v4
43-
with:
44-
name: commands
45-
path: build
34+
- name: push images
35+
run: |
36+
DOCKER_BUILDKIT=1 docker push $(cat ./name)
4637
- uses: actions/github-script@v6
4738
with:
4839
github-token: ${{secrets.GITHUB_TOKEN}}
4940
script: |
41+
var fs = require('fs');
42+
var issueNumber = Number(fs.readFileSync('./pr-id'));
43+
var shortSha = String(fs.readFileSync('./short-sha')).trim();
44+
var mainImage = fs.readFileSync('./name');
45+
var commandsURL = fs.readFileSync('./commands-url');
5046
github.rest.issues.createComment({
51-
issue_number: context.issue.number,
47+
issue_number: issueNumber,
5248
owner: context.repo.owner,
5349
repo: context.repo.repo,
5450
body: `New image:
55-
${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}:${{ env.short_sha }}
51+
\`\`\`bash
52+
${mainImage}
53+
\`\`\`
5654
57-
It will expire after two weeks.
55+
It will expire in two weeks.
5856
5957
To use this build, update your commands using:
6058
\`\`\`bash
61-
USER=netobserv VERSION=${{ env.short_sha }} make commands
59+
USER=netobserv VERSION=${shortSha} make commands
6260
\`\`\`
6361
64-
or [download the updated commands](${{ steps.artifact-upload-step.outputs.artifact-url }}).
62+
or [download the updated commands](${commandsURL}).
6563
`
6664
})

‎Makefile‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,14 @@ else
242242
DOCKER_BUILDKIT=1 $(OCI_BIN) manifest push ${IMAGE} docker://${IMAGE};
243243
endif
244244

245+
.PHONY: tar-image
246+
tar-image: MULTIARCH_TARGETS=amd64
247+
tar-image: image-build ## Build single arch (amd64) and save as a tar
248+
$(OCI_BIN) tag $(IMAGE)-amd64 $(IMAGE)
249+
mkdir -p ./out
250+
$(OCI_BIN) save -o out/image.tar $(IMAGE)
251+
echo $(IMAGE) > ./out/name
252+
245253
.PHONY: help
246254
help: ## Display this help.
247255
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)

0 commit comments

Comments
 (0)