Skip to content

Commit fdba99a

Browse files
Valswyn-NHSValswyn-NHS
committed
APM-7202-Github-bestpractices
1 parent 7bb107a commit fdba99a

5 files changed

Lines changed: 35 additions & 41 deletions

File tree

‎.github/workflows/apigee-release-pipeline.yml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@ name: apigee-release-pipeline
22
defaults:
33
run:
44
shell: bash # Explicitly sets pipeline to fail if any subprocess fails
5-
on:
6-
push
5+
on: push
76
permissions:
87
contents: read
98

@@ -17,7 +16,7 @@ jobs:
1716
PROXYGEN_API_NAME: hello-world
1817
steps:
1918
- name: Checkout
20-
uses: actions/checkout@v6
19+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2120
with:
2221
fetch-depth: 0
2322

@@ -36,7 +35,7 @@ jobs:
3635
echo PR number - $pr_number
3736
echo "PR_NUMBER=$pr_number" >> $GITHUB_ENV
3837
fi
39-
38+
4039
- name: Set Instance as Temporary
4140
if: github.ref != 'refs/heads/master'
4241
run: |
@@ -63,7 +62,6 @@ jobs:
6362
fi
6463
echo "TITLE=Hello World API" >> $GITHUB_ENV
6564
66-
6765
- name: Update apt repositories
6866
run: sudo apt update
6967

@@ -91,7 +89,7 @@ jobs:
9189
echo "APIGEE_ACCESS_TOKEN=$token" >> $GITHUB_ENV
9290
9391
- name: Install Python 3.10
94-
uses: actions/setup-python@v6
92+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
9593
with:
9694
python-version: "3.10"
9795

@@ -102,7 +100,7 @@ jobs:
102100
run: pip install poetry
103101

104102
- name: Cache poetry packages
105-
uses: actions/cache@v5
103+
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
106104
with:
107105
path: ~/.cache/pypoetry
108106
key: ${{ runner.os }}-build-cache-poetry-packages-${{ hashFiles('**/poetry.lock') }}

‎.github/workflows/continous-integration-workflow.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,12 @@ jobs:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- name: Checkout
13-
uses: actions/checkout@v6
13+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1414
with:
15-
fetch-depth: 0 # This causes all history to be fetched, which is required for calculate-version to function
15+
fetch-depth: 0 # This causes all history to be fetched, which is required for calculate-version to function
1616

1717
- name: Install Python 3.10
18-
uses: actions/setup-python@v6
18+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
1919
with:
2020
python-version: "3.10"
2121

@@ -32,13 +32,13 @@ jobs:
3232
run: pip install poetry
3333

3434
- name: Cache poetry packages
35-
uses: actions/cache@v5
35+
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
3636
with:
3737
path: ~/.cache/pypoetry
3838
key: ${{ runner.os }}-build-cache-poetry-packages-${{ hashFiles('**/poetry.lock') }}
3939

4040
- name: Cache node modules
41-
uses: actions/cache@v5
41+
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
4242
with:
4343
path: ~/.npm
4444
key: ${{ runner.os }}-build-cache-npm-packages-${{ hashFiles('**/package-lock.json') }}
@@ -55,7 +55,7 @@ jobs:
5555
- name: Create release (master only)
5656
id: create-release
5757
if: github.ref == 'refs/heads/master'
58-
uses: actions/create-release@v1
58+
uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
5959
continue-on-error: true
6060
env:
6161
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/pr-lint.yaml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
# 1) Validate the branch name without using shell (no user input in `run`)
1212
- name: Check ticket name conforms to requirements
1313
id: validate-branch
14-
uses: actions/github-script@v7
14+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
1515
with:
1616
script: |
1717
const ref = context.payload.pull_request?.head?.ref || '';
@@ -24,10 +24,10 @@ jobs:
2424
- name: Grab ticket name
2525
id: ticket
2626
if: contains(github.event.pull_request.head.ref, 'apm-') ||
27-
contains(github.event.pull_request.head.ref, 'APM-') ||
28-
contains(github.event.pull_request.head.ref, 'amb-') ||
29-
contains(github.event.pull_request.head.ref, 'AMB-')
30-
uses: actions/github-script@v7
27+
contains(github.event.pull_request.head.ref, 'APM-') ||
28+
contains(github.event.pull_request.head.ref, 'amb-') ||
29+
contains(github.event.pull_request.head.ref, 'AMB-')
30+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
3131
with:
3232
result-encoding: string
3333
script: |
@@ -38,10 +38,10 @@ jobs:
3838
# 3) Comment with link to JIRA ticket, using the safe output (no env mutation)
3939
- name: Comment on PR with link to JIRA ticket
4040
if: (contains(github.event.pull_request.head.ref, 'apm-') ||
41-
contains(github.event.pull_request.head.ref, 'APM-') ||
42-
contains(github.event.pull_request.head.ref, 'amb-') ||
43-
contains(github.event.pull_request.head.ref, 'AMB-')) &&
44-
steps.ticket.outputs.result != ''
41+
contains(github.event.pull_request.head.ref, 'APM-') ||
42+
contains(github.event.pull_request.head.ref, 'amb-') ||
43+
contains(github.event.pull_request.head.ref, 'AMB-')) &&
44+
steps.ticket.outputs.result != ''
4545
uses: unsplash/comment-on-pr@master
4646
env:
4747
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -53,11 +53,11 @@ jobs:
5353
# 4) Comment with link to Spec (pure expression usage is fine)
5454
- name: Comment on PR with link to Spec
5555
if: contains(github.event.pull_request.head.ref, 'apm-') ||
56-
contains(github.event.pull_request.head.ref, 'APM-') ||
57-
contains(github.event.pull_request.head.ref, 'apmspii-') ||
58-
contains(github.event.pull_request.head.ref, 'APMSPII-') ||
59-
contains(github.event.pull_request.head.ref, 'adz-') ||
60-
contains(github.event.pull_request.head.ref, 'ADZ-')
56+
contains(github.event.pull_request.head.ref, 'APM-') ||
57+
contains(github.event.pull_request.head.ref, 'apmspii-') ||
58+
contains(github.event.pull_request.head.ref, 'APMSPII-') ||
59+
contains(github.event.pull_request.head.ref, 'adz-') ||
60+
contains(github.event.pull_request.head.ref, 'ADZ-')
6161
uses: unsplash/comment-on-pr@master
6262
env:
6363
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/sbom.yml‎

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@ jobs:
2424
contents: write
2525
steps:
2626
- name: Checkout
27-
uses: actions/checkout@v5
27+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2828

2929
- name: Setup Python 3.13
30-
uses: actions/setup-python@v5
30+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
3131
with:
3232
python-version: "3.13"
3333

@@ -56,7 +56,7 @@ jobs:
5656
chmod +x syft
5757
5858
# Add to PATH for subsequent steps
59-
echo "$(pwd)" >> $GITHUB_PATH
59+
echo "$(pwd)" >> $GITHUB_PATH
6060
6161
- name: Create SBOM
6262
run: bash scripts/create-sbom.sh terraform python tflint
@@ -69,7 +69,7 @@ jobs:
6969
python .github/scripts/sbom_json_to_csv.py sbom.json SBOM_${REPO_NAME}.csv
7070
7171
- name: Upload SBOM CSV as artifact
72-
uses: actions/upload-artifact@v7
72+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
7373
with:
7474
name: sbom-csv
7575
path: SBOM_${{ github.event.repository.name }}.csv
@@ -81,18 +81,15 @@ jobs:
8181
- name: Scan SBOM for Vulnerabilities (JSON)
8282
run: |
8383
grype sbom:sbom.json -o json > grype-report.json
84-
85-
8684
8785
- name: Convert Grype JSON to CSV
8886
run: |
8987
pip install --upgrade pip
9088
REPO_NAME=$(basename $GITHUB_REPOSITORY)
9189
python .github/scripts/grype_json_to_csv.py grype-report.json grype-report-${REPO_NAME}.csv
9290
93-
9491
- name: Upload Vulnerability Report
95-
uses: actions/upload-artifact@v7
92+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
9693
with:
9794
name: grype-report
9895
path: grype-report-${{ github.event.repository.name }}.csv
@@ -104,7 +101,7 @@ jobs:
104101
python .github/scripts/sbom_packages_to_csv.py sbom.json $REPO_NAME
105102
106103
- name: Upload Package Inventory CSV
107-
uses: actions/upload-artifact@v7
104+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
108105
with:
109106
name: sbom-packages
110-
path: sbom-packages-${{ github.event.repository.name }}.csv
107+
path: sbom-packages-${{ github.event.repository.name }}.csv

‎.github/workflows/spec-release-pipeline.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@ name: spec-release-pipeline
22
defaults:
33
run:
44
shell: bash # Explicitly sets pipeline to fail if any subprocess fails
5-
on:
6-
push
5+
on: push
76
permissions:
87
contents: read
98

@@ -17,7 +16,7 @@ jobs:
1716
PROXYGEN_API_NAME: hello-world
1817
steps:
1918
- name: Checkout
20-
uses: actions/checkout@v6
19+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2120
with:
2221
fetch-depth: 0
2322

@@ -40,7 +39,7 @@ jobs:
4039
fi
4140
4241
- name: Install Python 3.10
43-
uses: actions/setup-python@v6
42+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
4443
with:
4544
python-version: "3.10"
4645

0 commit comments

Comments
 (0)