Skip to content

Commit 35aa208

Browse files
AlexanderBarabanovAlexanderBarabanov
authored
chore(ci): update Renovate config and increasing OpenSSF score (#1604)
Signed-off-by: Barabanov, Alexander <[email protected]>
1 parent c5fb55c commit 35aa208

File tree

12 files changed

+142
-71
lines changed

12 files changed

+142
-71
lines changed

‎.github/renovate.json5‎

Lines changed: 35 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252
postUpdateOptions: ["gomodTidy", "gomodUpdateImportPaths"],
5353

5454
packageRules: [
55-
// Enable pinning for container images
55+
// Enable pinning for container images (main and supported release branches)
5656
// https://docs.renovatebot.com/presets-docker/#dockerpindigests
5757
{
5858
enabled: true,
@@ -63,7 +63,7 @@
6363
schedule: ["* * * * 0"], // weekly
6464
},
6565

66-
// Base images from dev_tools/builder_images
66+
// Base images from dev_tools/builder_images (main branch)
6767
// are upgraded separately as it requires two steps
6868
{
6969
enabled: true,
@@ -73,6 +73,16 @@
7373
groupSlug: "pin-builders",
7474
schedule: ["* * 1 * *"], // every month
7575
matchPaths: ["dev_tools/builder_images/**"],
76+
matchBaseBranches: ["main"],
77+
},
78+
79+
// Disable dev_tools/builder_images images upgrades
80+
// for non-main branch
81+
{
82+
enabled: false,
83+
matchDatasources: ["docker"],
84+
matchPaths: ["dev_tools/builder_images/**"],
85+
matchBaseBranches: ["!main"],
7686
},
7787

7888
// Disable non-security upgrades for go and npm.
@@ -155,14 +165,22 @@
155165
matchUpdateTypes: ["major", "minor", "patch"],
156166
},
157167

158-
// Group GitHub Actions updates
168+
// Group GitHub Actions updates for main branch
159169
{
160170
enabled: true,
161171
separateMajorMinor: false,
162172
groupName: "GitHub Actions",
163173
matchManagers: ["github-actions"],
164174
matchPackagePatterns: ["*"],
165175
schedule: ["* * 1,15 * *"], // twice a month
176+
matchBaseBranches: ["main"],
177+
},
178+
179+
// Disable upgrades for non-main branches
180+
{
181+
enabled: false,
182+
matchManagers: ["github-actions"],
183+
matchBaseBranches: ["!main"],
166184
},
167185

168186
// Go version used in GitHub Actions is updated manually
@@ -190,14 +208,27 @@
190208
matchUpdateTypes: ["major", "minor", "patch"],
191209
},
192210

193-
// Group Go version upgrades
211+
// Group Go version upgrades for main branch
194212
{
195213
enabled: true,
196214
matchPackageNames: ["golang", "go"],
197215
allowedVersions: "<1.25",
198216
groupName: "Go version",
199217
groupSlug: "go-version",
200218
schedule: ["* * * * 0"], // weekly
219+
matchBaseBranches: ["main"],
220+
},
221+
222+
// Group Go version upgrades for supported release branch
223+
// with necessary restrictions
224+
{
225+
enabled: true,
226+
matchPackageNames: ["golang", "go"],
227+
allowedVersions: "<1.24",
228+
groupName: "Go version",
229+
groupSlug: "go-version",
230+
schedule: ["* * * * 0"], // weekly
231+
matchBaseBranches: ["release-2.13"],
201232
},
202233

203234
// Restrict uv version used in workflows, it will be updated manually

‎.github/workflows/cleanup-old-packages.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
# GHCR cleanup workflow
22
#
33
# This workflow deletes untagged and old package daily builds from GHCR registry.
4-
#
4+
#
55
# Key Features:
66
# - Deletes untagged and old package daily builds from GHCR registry
77
# - Can be triggered manually or by other workflows
88
# - Supports dry run mode to preview changes
9-
#
9+
#
1010
# Process Stages:
1111
# 1. Prepare list of package versions to delete
1212
# 2. Delete old package versions
@@ -59,17 +59,17 @@ on:
5959
type: boolean
6060
default: true
6161

62-
permissions:
63-
contents: read
64-
packages: write
62+
permissions: {} # No permissions by default on workflow level
6563

6664
jobs:
6765
prepare-vars:
6866
runs-on: ubuntu-latest
67+
permissions:
68+
contents: read
6969
steps:
7070
- name: Prepare list of package ids to delete
7171
id: prepare-versions
72-
env:
72+
env:
7373
MIN_VERSIONS_TO_KEEP: ${{ github.event.inputs.min_versions_to_keep }}
7474
PACKAGE_NAME: ${{ github.event.inputs.package_name }}
7575
GH_TOKEN: ${{ secrets.GHCR_CLEANUP_TOKEN }}
@@ -112,18 +112,18 @@ jobs:
112112
113113
- name: Cleanup old packages
114114
if: ${{ github.event.inputs.dry_run != 'true' && steps.prepare-versions.outputs.package_version_ids != '' }}
115-
uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0
115+
uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0
116116
with:
117-
package-name: '${{ github.event.inputs.package_name }}'
118-
package-type: 'container'
119-
package-version-ids: '${{ steps.prepare-versions.outputs.package_version_ids }}'
117+
package-name: "${{ github.event.inputs.package_name }}"
118+
package-type: "container"
119+
package-version-ids: "${{ steps.prepare-versions.outputs.package_version_ids }}"
120120
token: ${{ secrets.GHCR_CLEANUP_TOKEN }}
121121

122122
- name: Cleanup untagged packages
123123
if: ${{ github.event.inputs.dry_run != 'true' }}
124-
uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0
124+
uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0
125125
with:
126-
package-name: '${{ github.event.inputs.package_name }}'
127-
package-type: 'container'
126+
package-name: "${{ github.event.inputs.package_name }}"
127+
package-type: "container"
128128
token: ${{ secrets.GHCR_CLEANUP_TOKEN }}
129129
delete-only-untagged-versions: true

‎.github/workflows/collect-source.yml‎

Lines changed: 56 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,22 @@ jobs:
6565
TARGET: ${{ matrix.target }}
6666
run: |
6767
# install Syft
68-
curl -sSfL https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/bin
68+
69+
VERSION=1.38.2
70+
OS=linux
71+
ARCH=amd64
72+
BASE_URL="https://github.com/anchore/syft/releases/download/v${VERSION}"
73+
curl -sL "${BASE_URL}/syft_${VERSION}_${OS}_${ARCH}.tar.gz" > syft_${VERSION}_${OS}_${ARCH}.tar.gz
74+
curl -sL "${BASE_URL}/syft_${VERSION}_checksums.txt" | grep -E "syft_${VERSION}_${OS}_${ARCH}\\.tar\\.gz$" > checkSum.txt
75+
if [ -s checkSum.txt ]; then
76+
sha256sum -c checkSum.txt
77+
else
78+
echo "Checksum file not found or empty"
79+
exit 1
80+
fi
81+
tar -zxvf syft_${VERSION}_${OS}_${ARCH}.tar.gz -C /usr/local/bin/ syft
82+
echo "Syft $(syft --version) installed successfully"
83+
6984
NAME=$(echo "$TARGET" | cut -d'/' -f 4 | cut -d':' -f 1)
7085
echo "name=$NAME" >> $GITHUB_ENV
7186
@@ -118,43 +133,43 @@ jobs:
118133
container:
119134
image: debian:bookworm-slim@sha256:b4aa902587c2e61ce789849cb54c332b0400fe27b1ee33af4669e1f7e7c3e22f
120135
steps:
121-
- name: Add apt sources for deb-src
122-
shell: bash
123-
run: |
124-
sed -Ei "s/^Types: deb$/Types: deb deb-src/" /etc/apt/sources.list.d/debian.sources
125-
apt-get update
126-
127-
- name: Find GPL/MPL licensed packages
128-
shell: bash
129-
env:
130-
PACKAGES: ${{ needs.get-unique-names.outputs.unique_package_names_oneline }}
131-
run: |
132-
OUTPUT_DIR="output"
133-
ARCHIVE_NAME="source_code.tar.gz"
134-
mkdir -p "$OUTPUT_DIR"
135-
cd "$OUTPUT_DIR"
136-
# Split comma-separated list into an array
137-
IFS=',' read -r -a PACKAGES_ARR <<< "$PACKAGES"
138-
# Collect missing packages
139-
# Install GNU Parallel for faster downloads
140-
apt-get update && apt-get install -y parallel
141-
142-
# Download sources for GPL/MPL packages in parallel with error handling
143-
if [ ${#PACKAGES_ARR[@]} -gt 0 ]; then
144-
export OUTPUT_DIR
145-
printf "%s\n" "${PACKAGES_ARR[@]}" | parallel --jobs 4 '
146-
echo "Downloading source for {}"
147-
if ! apt-get source -q --download-only "{}"; then
148-
echo "Warning: Source not available for {}" >&2
149-
fi
150-
'
151-
fi
152-
cd ..
153-
tar -czf "$ARCHIVE_NAME" -C "$OUTPUT_DIR" .
154-
155-
- name: Upload source code archive
156-
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
157-
with:
158-
name: source-code-archive
159-
path: source_code.tar.gz
160-
retention-days: 3
136+
- name: Add apt sources for deb-src
137+
shell: bash
138+
run: |
139+
sed -Ei "s/^Types: deb$/Types: deb deb-src/" /etc/apt/sources.list.d/debian.sources
140+
apt-get update
141+
142+
- name: Find GPL/MPL licensed packages
143+
shell: bash
144+
env:
145+
PACKAGES: ${{ needs.get-unique-names.outputs.unique_package_names_oneline }}
146+
run: |
147+
OUTPUT_DIR="output"
148+
ARCHIVE_NAME="source_code.tar.gz"
149+
mkdir -p "$OUTPUT_DIR"
150+
cd "$OUTPUT_DIR"
151+
# Split comma-separated list into an array
152+
IFS=',' read -r -a PACKAGES_ARR <<< "$PACKAGES"
153+
# Collect missing packages
154+
# Install GNU Parallel for faster downloads
155+
apt-get update && apt-get install -y parallel
156+
157+
# Download sources for GPL/MPL packages in parallel with error handling
158+
if [ ${#PACKAGES_ARR[@]} -gt 0 ]; then
159+
export OUTPUT_DIR
160+
printf "%s\n" "${PACKAGES_ARR[@]}" | parallel --jobs 4 '
161+
echo "Downloading source for {}"
162+
if ! apt-get source -q --download-only "{}"; then
163+
echo "Warning: Source not available for {}" >&2
164+
fi
165+
'
166+
fi
167+
cd ..
168+
tar -czf "$ARCHIVE_NAME" -C "$OUTPUT_DIR" .
169+
170+
- name: Upload source code archive
171+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
172+
with:
173+
name: source-code-archive
174+
path: source_code.tar.gz
175+
retention-days: 3

‎.github/workflows/component.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ jobs:
7171
runs-on: ubuntu-latest
7272
permissions:
7373
contents: read
74-
packages: write
74+
packages: write # to publish packages
7575
timeout-minutes: 30
7676
env:
7777
TAG: ${{ inputs.build_version || github.sha }}

‎.github/workflows/main.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ jobs:
204204
needs: get-vars
205205
permissions:
206206
contents: read
207-
packages: write
207+
packages: write # to publish packages
208208
uses: ./.github/workflows/component.yml
209209
if: ${{ !contains(needs.get-vars.outputs.filtered-components-list, '[]') }}
210210
strategy:
@@ -224,7 +224,7 @@ jobs:
224224
needs: get-vars
225225
permissions:
226226
contents: read
227-
packages: write
227+
packages: write # to publish packages
228228
uses: ./.github/workflows/web-ui.yml
229229
if: ${{ contains(needs.get-vars.outputs.components-list, 'web_ui') }}
230230
with:
@@ -240,7 +240,7 @@ jobs:
240240
- web-ui-workflow
241241
permissions:
242242
contents: read
243-
packages: write
243+
packages: write # to publish packages
244244
uses: ./.github/workflows/package-distribution.yaml
245245
with:
246246
build_all: ${{ fromJSON(needs.get-vars.outputs.build_all) }} # fromJSON is required to cast string to boolean
@@ -257,7 +257,7 @@ jobs:
257257
- web-ui-workflow
258258
- package-distribution-workflow
259259
permissions:
260-
discussions: write
260+
discussions: write # to publish discussion/daily build
261261
runs-on: ubuntu-latest
262262
if: ${{ always() && !cancelled() }}
263263
env:

‎.github/workflows/package-distribution.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ jobs:
6060
if: ${{ inputs.build_all }}
6161
permissions:
6262
contents: read
63-
packages: write
63+
packages: write # to publish packages
6464
env:
6565
TAG: ${{ inputs.build_version }}
6666
PLATFORM_VERSION: ${{ inputs.platform_version }}

‎.github/workflows/pr-security-scan.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747
uses: open-edge-platform/geti-ci/actions/bandit@3cdaaaa0fc400b63f52f4dbb007fa0b69939e0ab
4848
with:
4949
scan-scope: "changed"
50-
severity-level: "HIGH"
51-
confidence-level: "HIGH"
50+
severity-level: "LOW"
51+
confidence-level: "LOW"
5252
config_file: ".github/bandit_config.yml"
5353
fail-on-findings: true

‎.github/workflows/security-scan.yml‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ jobs:
5959
fail-on-findings: false # reports only
6060

6161
# TODO: unify approach and migrate to reusable workflows/composite actions
62-
trivy-scan:
62+
trivy-scan-config:
6363
runs-on: ubuntu-latest
6464
permissions:
6565
contents: read
@@ -85,3 +85,27 @@ jobs:
8585
uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
8686
with:
8787
sarif_file: "trivy-results.sarif"
88+
89+
trivy-scan-lock:
90+
runs-on: ubuntu-latest
91+
permissions:
92+
contents: read
93+
steps:
94+
- name: Harden the runner (audit all outbound calls)
95+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
96+
with:
97+
egress-policy: audit
98+
- name: Checkout code
99+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
100+
with:
101+
persist-credentials: false
102+
- name: Run Trivy vulnerability scanner in vuln/secret modes
103+
uses: open-edge-platform/geti-ci/actions/trivy@3cdaaaa0fc400b63f52f4dbb007fa0b69939e0ab
104+
with:
105+
scan_type: "fs"
106+
scan-scope: all
107+
severity: "LOW"
108+
scanners: "vuln,secret"
109+
format: "table" # Use plain text output format to omit uploading code scanning results to Security tab
110+
timeout: "15m"
111+
ignore_unfixed: "true"

‎.github/workflows/web-ui.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -270,7 +270,7 @@ jobs:
270270
needs: [lint, unit-tests, merge-playwright-reports]
271271
permissions:
272272
contents: read # to checkout code
273-
packages: write
273+
packages: write # to publish packages
274274
uses: ./.github/workflows/component.yml
275275
with:
276276
build_version: ${{ inputs.build_version }}

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ LIMITED EDGE SOFTWARE DISTRIBUTION LICENSE
2121
[![python](https://img.shields.io/badge/python-3.10%2B-green)]()
2222
[![pytorch](https://img.shields.io/badge/pytorch-2.5%2B-orange)]()
2323
[![openvino](https://img.shields.io/badge/openvino-2025.1.0-purple)]()
24+
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/open-edge-platform/geti/badge)](https://securityscorecards.dev/viewer/?uri=github.com/open-edge-platform/geti)
2425

2526
</div>
2627

0 commit comments

Comments
 (0)