Skip to content

Commit d5b8dd3

Browse files
morri-sonmorri-son
committed
exchange versions with pinned commits
1 parent 9130456 commit d5b8dd3

File tree

9 files changed

+104
-58
lines changed

9 files changed

+104
-58
lines changed

‎.github/workflows/blackduck_scan.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: Blackduck SCA Scan
2+
on:
3+
#push:
4+
# branches: [ "main" ]
5+
#pull_request:
6+
# branches: [ "main" ]
7+
schedule:
8+
- cron: '8 0 * * 0'
9+
workflow_dispatch:
10+
11+
permissions:
12+
contents: read
13+
checks: write
14+
15+
jobs:
16+
build:
17+
runs-on: [ ubuntu-latest ]
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
21+
22+
- name: Setup Go
23+
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
24+
with:
25+
go-version-file: '${{ github.workspace }}/go.mod'
26+
cache: false
27+
28+
- name: Get go environment for use with cache
29+
run: |
30+
echo "go_cache=$(go env GOCACHE)" >> $GITHUB_ENV
31+
echo "go_modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV
32+
# This step will only reuse the go mod and build cache from main made during the Build,
33+
# see push_ocm.yaml => "ocm-cli-latest" Job
34+
# This means it never caches by itself and PRs cannot cause cache pollution / thrashing
35+
# This is because we have huge storage requirements for our cache because of the mass of dependencies
36+
37+
- name: Restore / Reuse Cache from central build
38+
id: cache-golang-restore
39+
uses: actions/cache/restore@0c907a75c2c80ebcb7f088228285e798b750cf8f # Only Restore, not build another cache (too big)
40+
with:
41+
path: |
42+
${{ env.go_cache }}
43+
${{ env.go_modcache }}
44+
key: ${{ env.cache_name }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-${{ hashFiles('**/go.mod') }}
45+
restore-keys: |
46+
${{ env.cache_name }}-${{ runner.os }}-go-
47+
env:
48+
cache_name: ocm-cli-latest-go-cache # needs to be the same key in the end as in the build step
49+
50+
- name: Run Black Duck Full SCA Scan (Manual Trigger and Scheduled)
51+
if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
52+
uses: blackduck-inc/black-duck-security-scan@805cbd09e806b01907bbea0f990723c2bb85abe9
53+
env:
54+
DETECT_PROJECT_USER_GROUPS: opencomponentmodel
55+
DETECT_PROJECT_VERSION_DISTRIBUTION: opensource
56+
DETECT_SOURCE_PATH: ./
57+
DETECT_EXCLUDED_DIRECTORIES: .bridge
58+
DETECT_BLACKDUCK_SIGNATURE_SCANNER_ARGUMENTS: '--min-scan-interval=0'
59+
NODE_TLS_REJECT_UNAUTHORIZED: true
60+
with:
61+
github_token: ${{ secrets.GITHUB_TOKEN }}
62+
blackducksca_url: ${{ secrets.BLACKDUCK_URL }}
63+
blackducksca_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
64+
blackducksca_scan_full: true
65+
66+
- name: Run Black Duck SCA Scan (Pull Request or Push)
67+
if: github.event_name != 'workflow_dispatch'
68+
# The action sets blackducksca_scan_full internally: for pushes to true and PRs to false
69+
uses: blackduck-inc/[email protected]
70+
env:
71+
DETECT_PROJECT_USER_GROUPS: opencomponentmodel
72+
DETECT_PROJECT_VERSION_DISTRIBUTION: opensource
73+
DETECT_SOURCE_PATH: ./
74+
DETECT_EXCLUDED_DIRECTORIES: .bridge
75+
NODE_TLS_REJECT_UNAUTHORIZED: true
76+
with:
77+
github_token: ${{ secrets.GITHUB_TOKEN }}
78+
blackducksca_url: ${{ secrets.BLACKDUCK_URL }}
79+
blackducksca_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
80+
blackducksca_prComment_enabled: true

‎.github/workflows/blackduck_scan_scheduled.yaml‎

Lines changed: 0 additions & 34 deletions
This file was deleted.

‎.github/workflows/check-manifest-generation-diff.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,18 +9,18 @@ jobs:
99
runs-on: ubuntu-latest
1010
steps:
1111
- name: Checkout
12-
uses: actions/checkout@v4
12+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
1313
with:
1414
fetch-depth: 0
1515
- name: Make manifests && generate
1616
run: |
1717
make manifests && make generate
1818
- name: Setup Go
19-
uses: actions/setup-go@v5
19+
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
2020
with:
2121
go-version-file: '${{ github.workspace }}/go.mod'
2222
- name: Restore Go cache
23-
uses: actions/cache@v4
23+
uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f
2424
with:
2525
path: /home/runner/work/_temp/_github_home/go/pkg/mod
2626
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}

‎.github/workflows/codeql.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
5858
steps:
5959
- name: Checkout repository
60-
uses: actions/checkout@v4
60+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
6161

6262
# Add any setup steps before running the `github/codeql-action/init` action.
6363
# This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -67,7 +67,7 @@ jobs:
6767

6868
# Initializes the CodeQL tools for scanning.
6969
- name: Initialize CodeQL
70-
uses: github/codeql-action/init@v3
70+
uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
7171
with:
7272
languages: ${{ matrix.language }}
7373
build-mode: ${{ matrix.build-mode }}
@@ -80,6 +80,6 @@ jobs:
8080
# queries: security-extended,security-and-quality
8181

8282
- name: Perform CodeQL Analysis
83-
uses: github/codeql-action/analyze@v3
83+
uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
8484
with:
8585
category: "/language:${{matrix.language}}"

‎.github/workflows/components.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@ jobs:
1818
runs-on: large_runner
1919
steps:
2020
- name: Checkout
21-
uses: actions/checkout@v4
21+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
2222
with:
2323
ref: ${{ github.event.pull_request.head.sha }}
2424
fetch-depth: 0
2525
- name: Cache go-build and mod
26-
uses: actions/cache@v4
26+
uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f
2727
with:
2828
path: |
2929
~/.cache/go-build/
@@ -32,7 +32,7 @@ jobs:
3232
restore-keys: |
3333
go-
3434
- name: Setup Go
35-
uses: actions/setup-go@v5
35+
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
3636
with:
3737
go-version-file: '${{ github.workspace }}/go.mod'
3838
- name: CTF

‎.github/workflows/e2e.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,13 @@ jobs:
2323
runs-on: ubuntu-latest
2424
steps:
2525
- name: Checkout
26-
uses: actions/checkout@v4
26+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
2727
- name: Setup Go
28-
uses: actions/setup-go@v5
28+
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
2929
with:
3030
go-version-file: '${{ github.workspace }}/go.mod'
3131
- name: Restore Go cache
32-
uses: actions/cache@v4
32+
uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f
3333
with:
3434
path: /home/runner/work/_temp/_github_home/go/pkg/mod
3535
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}

‎.github/workflows/mend_scan.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,21 +28,21 @@ jobs:
2828

2929
steps:
3030
- name: Checkout Code
31-
uses: actions/checkout@v4
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
3232

3333
- name: Set up Java 17
34-
uses: actions/setup-java@v4
34+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12
3535
with:
3636
java-version: '17'
3737
distribution: 'temurin'
3838

3939
- name: Setup Go
40-
uses: actions/setup-go@v5
40+
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
4141
with:
4242
go-version-file: '${{ github.workspace }}/go.mod'
4343

4444
- name: 'Setup jq'
45-
uses: dcarbone/install-jq-action@v3.0.1
45+
uses: dcarbone/install-jq-action@e397bd87438d72198f81efd21f876461183d383a
4646
with:
4747
version: '1.7'
4848

@@ -171,14 +171,14 @@ jobs:
171171
echo "status=white_check_mark" >> $GITHUB_OUTPUT
172172
fi
173173
- name: Check if PR exists
174-
uses: 8BitJonny/gh-get-current-pr@3.0.0
174+
uses: 8BitJonny/gh-get-current-pr@08e737c57a3a4eb24cec6487664b243b77eb5e36
175175
id: pr_exists
176176
with:
177177
filterOutClosed: true
178178
sha: ${{ github.event.pull_request.head.sha }}
179179
- name: Comment Mend Status on PR
180180
if: ${{ github.event_name != 'schedule' && steps.pr_exists.outputs.pr_found == 'true' }}
181-
uses: thollander/actions-comment-pull-request@v3.0.1
181+
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b
182182
with:
183183
message: |
184184
## Mend Scan Summary: :${{ steps.report.outputs.status }}:

‎.github/workflows/release.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,15 @@ jobs:
3131
packages: 'write'
3232
steps:
3333
- name: Checkout
34-
uses: actions/checkout@v4
34+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
3535
with:
3636
fetch-depth: 0
3737
- name: Setup Go
38-
uses: actions/setup-go@v5
38+
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
3939
with:
4040
go-version-file: '${{ github.workspace }}/go.mod'
4141
- name: Cache go-build and mod
42-
uses: actions/cache@v4
42+
uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f
4343
with:
4444
path: |
4545
~/.cache/go-build/

‎.github/workflows/tests.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,16 +20,16 @@ jobs:
2020
runs-on: ubuntu-latest
2121
steps:
2222
- name: Checkout
23-
uses: actions/checkout@v4
23+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
2424
- name: Setup Go
25-
uses: actions/setup-go@v5
25+
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
2626
with:
2727
go-version-file: '${{ github.workspace }}/go.mod'
2828
- uses: acifani/setup-tinygo@v2
2929
with:
3030
tinygo-version: '0.31.2'
3131
- name: Restore Go cache
32-
uses: actions/cache@v4
32+
uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f
3333
with:
3434
path: /home/runner/work/_temp/_github_home/go/pkg/mod
3535
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}

0 commit comments

Comments
 (0)