Skip to content

Commit dd9c5b9

Browse files
cbruno10cbruno10
authored
Harden GitHub Actions workflows (#92)
- Upgrade actions/checkout to v6 and disable persisted credentials where safe. - Pin external actions, reusable workflow dependencies, tool versions, and container images to immutable refs. - Replace runtime latest-tag resolution in release workflows with fixed commit or tag pins.
1 parent 78f8c24 commit dd9c5b9

13 files changed

+214
-562
lines changed

‎.github/workflows/assign-issue-to-project.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
runs-on: ubuntu-latest
1616
steps:
1717
- name: Add issue to project
18-
uses: actions/add-to-project@v1.0.2
18+
uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
1919
with:
2020
project-url: https://github.com/orgs/turbot/projects/34
2121
github-token: ${{ secrets.GH_PROJECT_PAT }}

‎.github/workflows/golangci-lint.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,13 @@ jobs:
1515
steps:
1616
- name: Checkout code
1717
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
18+
with:
19+
persist-credentials: false
20+
1821
- uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
1922
with:
2023
go-version: '1.26.*'
24+
2125
- name: golangci-lint
2226
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
2327
with:

‎.github/workflows/registry-publish-ghcr-azuread-large-runners.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,9 @@ jobs:
3636
echo "PIPELING_NAME=${{ inputs.pipeling }}" >> $GITHUB_ENV
3737
3838
- name: Checkout
39-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
39+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4040
with:
41+
persist-credentials: false
4142
path: ${{ inputs.pipeling }}-plugin
4243
fetch-depth: 0
4344

@@ -97,15 +98,15 @@ jobs:
9798

9899
# ---- Build: Linux (clean first) ----
99100
- name: Run GoReleaser (Linux)
100-
uses: goreleaser/goreleaser-action@v5 # Latest version
101+
uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5
101102
with:
102103
workdir: ${{ inputs.pipeling }}-plugin
103104
version: latest
104105
args: release --clean --skip=publish --timeout=${{ inputs.releaseTimeout }} -f .goreleaser.linux.yml
105106

106107
# ---- Build: Darwin (no clean; keep Linux artifacts) ----
107108
- name: Run GoReleaser (Darwin)
108-
uses: goreleaser/goreleaser-action@v5 # Latest version
109+
uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5
109110
with:
110111
workdir: ${{ inputs.pipeling }}-plugin
111112
version: latest

‎.github/workflows/registry-publish-ghcr-large-runners.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ env:
2424
CR_PREFIX: turbot/${{ inputs.pipeling }}/plugins
2525
CONFIG_SCHEMA_VERSION: "2020-11-18"
2626
ORAS_VERSION: 1.3.0
27-
GOLANG_CROSS_VERSION: v1.26
2827

2928
jobs:
3029
build-deploy:
@@ -40,8 +39,9 @@ jobs:
4039
echo "PIPELING_NAME=${{ inputs.pipeling }}" >> $GITHUB_ENV
4140
4241
- name: Checkout
43-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
42+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4443
with:
44+
persist-credentials: false
4545
path: ${{ inputs.pipeling }}-plugin
4646
fetch-depth: 0
4747

@@ -114,7 +114,7 @@ jobs:
114114
115115
- name: Run GoReleaser (steampipe)
116116
if: ${{ inputs.useCgo == false || inputs.useCgo == 'false' }}
117-
uses: goreleaser/goreleaser-action@v5 # Latest version
117+
uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5
118118
with:
119119
workdir: ${{ inputs.pipeling }}-plugin
120120
version: latest
@@ -132,13 +132,14 @@ jobs:
132132
if: ${{ inputs.useCgo == true || inputs.useCgo == 'true' }}
133133
run: |-
134134
cd ${{ inputs.pipeling }}-plugin
135+
# goreleaser-cross v1.26
135136
docker run \
136137
--rm \
137138
-e CGO_ENABLED=1 \
138139
-v /var/run/docker.sock:/var/run/docker.sock \
139140
-v $PWD:/go/src/plugin \
140141
-w /go/src/plugin \
141-
ghcr.io/goreleaser/goreleaser-cross:${GOLANG_CROSS_VERSION} \
142+
ghcr.io/goreleaser/goreleaser-cross@sha256:e76ed3b998f05e4599445e674b6190d037e5550ebd60894b8ab9a152e665976c \
142143
release --clean --skip=publish --skip=validate --timeout=${{ inputs.releaseTimeout }}
143144
144145
- name: List Build Artifacts
@@ -211,7 +212,7 @@ jobs:
211212
# Upload build artifacts for inspection
212213
- name: Upload build artifacts
213214
if: always() # Run even if previous steps fail
214-
uses: actions/upload-artifact@v4
215+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
215216
with:
216217
name: plugin-archives-${{ env.VERSION }}
217218
path: |

‎.github/workflows/registry-publish-ghcr.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ env:
2424
CR_PREFIX: turbot/${{ inputs.pipeling }}/plugins
2525
CONFIG_SCHEMA_VERSION: "2020-11-18"
2626
ORAS_VERSION: 1.3.0
27-
GOLANG_CROSS_VERSION: v1.26
2827

2928
jobs:
3029
build-deploy:
@@ -39,8 +38,9 @@ jobs:
3938
echo "PIPELING_NAME=${{ inputs.pipeling }}" >> $GITHUB_ENV
4039
4140
- name: Checkout
42-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
41+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4342
with:
43+
persist-credentials: false
4444
path: ${{ inputs.pipeling }}-plugin
4545
fetch-depth: 0
4646

@@ -97,7 +97,7 @@ jobs:
9797

9898
- name: Run GoReleaser (steampipe)
9999
if: ${{ inputs.useCgo == false || inputs.useCgo == 'false' }}
100-
uses: goreleaser/goreleaser-action@v5 # Latest version
100+
uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5
101101
with:
102102
workdir: ${{ inputs.pipeling }}-plugin
103103
version: latest
@@ -107,13 +107,14 @@ jobs:
107107
if: ${{ inputs.useCgo == true || inputs.useCgo == 'true' }}
108108
run: |-
109109
cd ${{ inputs.pipeling }}-plugin
110+
# goreleaser-cross v1.26
110111
docker run \
111112
--rm \
112113
-e CGO_ENABLED=1 \
113114
-v /var/run/docker.sock:/var/run/docker.sock \
114115
-v $PWD:/go/src/plugin \
115116
-w /go/src/plugin \
116-
ghcr.io/goreleaser/goreleaser-cross:${GOLANG_CROSS_VERSION} \
117+
ghcr.io/goreleaser/goreleaser-cross@sha256:e76ed3b998f05e4599445e674b6190d037e5550ebd60894b8ab9a152e665976c \
117118
release --clean --skip=publish --skip=validate --timeout=${{ inputs.releaseTimeout }}
118119
119120
- name: List Build Artifacts

0 commit comments

Comments
 (0)