Skip to content

Commit 1d41231

Browse files
Saul-STFCSaul-STFC
authored
ci: Harden worfklows (#8)
1 parent da47006 commit 1d41231

4 files changed

Lines changed: 51 additions & 25 deletions

File tree

‎.github/workflows/scan.yaml‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,26 @@ on:
44
schedule:
55
- cron: '30 2 * * *'
66

7+
permissions: {}
8+
79
jobs:
810
scan_images:
911
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
1014
steps:
11-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
15+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
16+
with:
17+
persist-credentials: false
1218
- name: Init submodules
1319
run: git submodule update --init --recursive
1420
- name: Set up Cosign
15-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
16-
- uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
21+
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
22+
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
1723
with:
1824
python-version: 3.11
1925
- name: Setup Rust
20-
uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2
21-
with:
22-
toolchain: stable
26+
run: rustup toolchain install stable --profile minimal
2327
- name: Run image
2428
uses: abatilo/actions-poetry@3765cf608f2d4a72178a9fc5b918668e542b89b1 # v4.0.0
2529
with:
@@ -31,4 +35,4 @@ jobs:
3135
- name: Install deps
3236
run: poetry install
3337
- name: Scan dev plus current and previous release
34-
run: poetry run python stack_scanner/main.py scan-latest ${{ secrets.SECOBSERVE_API_TOKEN }}
38+
run: poetry run python stack_scanner/main.py scan-latest ${{ secrets.SECOBSERVE_API_TOKEN }}

‎.github/workflows/scan_release.yml‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,22 +7,26 @@ on:
77
required: true
88
default: '0.0.0-dev'
99

10+
permissions: {}
11+
1012
jobs:
1113
scan_release:
1214
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
1317
steps:
14-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
18+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
19+
with:
20+
persist-credentials: false
1521
- name: Init submodules
1622
run: git submodule update --init --recursive
1723
- name: Set up Cosign
18-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
19-
- uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
24+
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
25+
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
2026
with:
2127
python-version: 3.11
2228
- name: Setup Rust
23-
uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2
24-
with:
25-
toolchain: stable
29+
run: rustup toolchain install stable --profile minimal
2630
- name: Run image
2731
uses: abatilo/actions-poetry@3765cf608f2d4a72178a9fc5b918668e542b89b1 # v4.0.0
2832
with:
@@ -35,4 +39,6 @@ jobs:
3539
run: poetry install
3640
- name: Scan release
3741
id: scan
38-
run: poetry run python stack_scanner/main.py scan-release ${{ secrets.SECOBSERVE_API_TOKEN }} ${{ github.event.inputs.release }}
42+
env:
43+
RELEASE: ${{ github.event.inputs.release }}
44+
run: poetry run python stack_scanner/main.py scan-release ${{ secrets.SECOBSERVE_API_TOKEN }} "$RELEASE"

‎.github/workflows/scan_single_image.yml‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,20 @@ on:
1212
description: "Location of the image (example: oci.stackable.tech/sdp/hbase:2.4.17-stackable24.7.0-amd64). Please use the tag for the image itself (usually one including the CPU architecture) and not the tag for the manifest list, since the tag for the manifest list won't have an SBOM attached."
1313
required: true
1414

15+
permissions: {}
16+
1517
jobs:
1618
scan_image:
1719
runs-on: ubuntu-latest
20+
permissions:
21+
contents: read
1822
steps:
19-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
23+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
24+
with:
25+
persist-credentials: false
2026
- name: Set up Cosign
21-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
22-
- uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
27+
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
28+
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
2329
with:
2430
python-version: 3.11
2531
- name: Run image
@@ -30,4 +36,8 @@ jobs:
3036
run: poetry install
3137
- name: Scan image
3238
id: scan
33-
run: poetry run python stack_scanner/main.py scan-image ${{ secrets.SECOBSERVE_API_TOKEN }} ${{ github.event.inputs.image }} ${{ github.event.inputs.product_name }} ${{ github.event.inputs.product_version }}
39+
env:
40+
IMAGE: ${{ github.event.inputs.image }}
41+
PRODUCT_NAME: ${{ github.event.inputs.product_name }}
42+
PRODUCT_VERSION: ${{ github.event.inputs.product_version }}
43+
run: poetry run python stack_scanner/main.py scan-image ${{ secrets.SECOBSERVE_API_TOKEN }} "$IMAGE" "$PRODUCT_NAME" "$PRODUCT_VERSION"

‎.github/workflows/upload_sbom_release.yml‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,22 +7,26 @@ on:
77
required: true
88
default: '0.0.0-dev'
99

10+
permissions: {}
11+
1012
jobs:
1113
scan_release:
1214
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
1317
steps:
14-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
18+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
19+
with:
20+
persist-credentials: false
1521
- name: Init submodules
1622
run: git submodule update --init --recursive
1723
- name: Set up Cosign
18-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
19-
- uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
24+
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
25+
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
2026
with:
2127
python-version: 3.11
2228
- name: Setup Rust
23-
uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2
24-
with:
25-
toolchain: stable
29+
run: rustup toolchain install stable --profile minimal
2630
- name: Run image
2731
uses: abatilo/actions-poetry@3765cf608f2d4a72178a9fc5b918668e542b89b1 # v4.0.0
2832
with:
@@ -35,4 +39,6 @@ jobs:
3539
run: poetry install
3640
- name: Upload SBOMs for release
3741
id: scan
38-
run: poetry run python stack_scanner/main.py upload-sbom-release ${{ secrets.SECOBSERVE_API_TOKEN }} ${{ github.event.inputs.release }}
42+
env:
43+
RELEASE: ${{ github.event.inputs.release }}
44+
run: poetry run python stack_scanner/main.py upload-sbom-release ${{ secrets.SECOBSERVE_API_TOKEN }} "$RELEASE"

0 commit comments

Comments
 (0)