Skip to content

Commit 80c0118

Browse files
sean-sype-simmonssean-sype-simmons
committed
updating so that each step is versioned
this should help teams manage breaking changes and also ensure that they can take whatever version required for their specific project to work Signed-off-by: Sean Simmons <ssimmons@progress.com>
1 parent 5649cae commit 80c0118

File tree

4 files changed

+158
-19
lines changed

4 files changed

+158
-19
lines changed

‎.github/workflows/ci-main-pull-request.yml‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -347,7 +347,12 @@ on:
347347
description: 'Report Sonar test coverage and other metrics to Atlassian dashboard (Irfans QA dashboard)'
348348
required: false
349349
type: boolean
350-
default: true
350+
default: true
351+
quality-dashboard-version:
352+
description: 'Version of quality dashboard workflow to use (e.g., main, v1.0.7)'
353+
required: false
354+
type: string
355+
default: 'main'
351356
quality-product-name:
352357
description: 'Product name for quality reporting (Chef360, Courier, Inspec)'
353358
required: false
@@ -734,7 +739,7 @@ jobs:
734739
scc:
735740
name: 'Source code complexity checks'
736741
if: ${{ inputs.perform-complexity-checks == true }}
737-
uses: chef/common-github-actions/.github/workflows/scc.yml@main
742+
uses: chef/common-github-actions/.github/workflows/scc.yml@${{ inputs.scc-version }}
738743
needs: checkout
739744
with:
740745
outputfilename: ${{ inputs.scc-output-filename }}
@@ -859,7 +864,7 @@ jobs:
859864
run-trufflehog:
860865
name: 'Trufflehog scan'
861866
if: ${{ inputs.perform-trufflehog-scan }}
862-
uses: chef/common-github-actions/.github/workflows/trufflehog.yml@main
867+
uses: chef/common-github-actions/.github/workflows/trufflehog.yml@${{ inputs.trufflehog-version }}
863868
needs: checkout
864869
with:
865870
github-event-name: ${{ inputs.github-event-name }}
@@ -979,7 +984,7 @@ jobs:
979984
run-grype-image:
980985
name: 'Grype Docker image scan'
981986
if: ${{ inputs.perform-grype-image-scan }}
982-
uses: chef/common-github-actions/.github/workflows/grype.yml@main
987+
uses: chef/common-github-actions/.github/workflows/grype.yml@${{ inputs.grype-version }}
983988
needs: checkout
984989
secrets: inherit
985990
with:
@@ -990,7 +995,7 @@ jobs:
990995
run-grype-hab-package-scan:
991996
name: 'Grype scan Habitat packages from bldr.habitat.sh'
992997
if: ${{ inputs.perform-grype-hab-scan == true }}
993-
uses: chef/common-github-actions/.github/workflows/grype-hab-package-scan.yml@main
998+
uses: chef/common-github-actions/.github/workflows/grype-hab-package-scan.yml@${{ inputs.grype-hab-version }}
994999
needs: checkout
9951000
secrets: inherit
9961001
with:
@@ -1301,7 +1306,7 @@ jobs:
13011306
BlackDuck-Polaris-SAST:
13021307
name: 'BlackDuck Polaris SAST scan'
13031308
if: ${{ inputs.perform-blackduck-polaris }}
1304-
uses: chef/common-github-actions/.github/workflows/polaris-sast.yml@main
1309+
uses: chef/common-github-actions/.github/workflows/polaris-sast.yml@${{ inputs.polaris-version }}
13051310
needs: checkout
13061311
secrets: inherit
13071312
with:
@@ -1568,7 +1573,7 @@ jobs:
15681573
name: 'Generating SBOM'
15691574
# Create software bill-of-materials (SBOM) using SPDX format
15701575
if: ${{ inputs.generate-sbom == true }}
1571-
uses: chef/common-github-actions/.github/workflows/sbom.yml@main
1576+
uses: chef/common-github-actions/.github/workflows/sbom.yml@${{ inputs.sbom-version }}
15721577
needs: checkout # TODO: fix set-application-version
15731578
secrets: inherit
15741579
with:
@@ -1599,7 +1604,7 @@ jobs:
15991604
id-token: write
16001605
contents: read
16011606
if: ${{ inputs.report-to-atlassian-dashboard == true && success() }}
1602-
uses: chef/common-github-actions/.github/workflows/irfan-quality-dashboard.yml@main
1607+
uses: chef/common-github-actions/.github/workflows/irfan-quality-dashboard.yml@${{ inputs.quality-dashboard-version }}
16031608
with:
16041609
perform-build: ${{ inputs.build }} # was ${{ inputs.perform-sonar-build }}
16051610
build-profile: ${{ inputs.build-profile }}

‎.github/workflows/stubs/ci-main-pull-request-stub.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,18 +38,23 @@ jobs:
3838

3939
# complexity-checks
4040
perform-complexity-checks: true
41+
# scc-version: 'main' # Version of SCC workflow (main, v1.0.7, etc.)
4142
# scc-output-filename: 'scc-output.txt'
4243
perform-language-linting: false # Perform language-specific linting and pre-compilation checks
4344

4445
# trufflehog secret scanning
4546
perform-trufflehog-scan: true
47+
# trufflehog-version: 'main' # Version of Trufflehog workflow (main, v1.0.7, etc.)
4648

4749
# trivy dependency and container scanning
4850
perform-trivy-scan: true
51+
# grype-version: 'main' # Version of Grype workflow for source/image scans (main, v1.0.7, etc.)
52+
# grype-hab-version: 'main' # Version of Grype Habitat package scan workflow (main, v1.0.7, etc.)
4953

5054
# BlackDuck SAST (Polaris) and SCA scans (requires a build or download to do SAST)
5155
# requires these secrets: POLARIS_SERVER_URL, POLARIS_ACCESS_TOKEN
5256
perform-blackduck-polaris: true
57+
# polaris-version: 'main' # Version of Polaris SAST workflow (main, v1.0.7, etc.)
5358
polaris-application-name: "Chef-Chef360" # one of these: Chef-Agents, Chef-Automate, Chef-Chef360, Chef-Habitat, Chef-Infrastructure-Server, Chef-Shared-Services, Chef-Other, Chef-Non-Product
5459
polaris-project-name: ${{ github.event.repository.name }}
5560
# polaris-blackduck-executable: 'path/to/blackduck/binary'
@@ -82,6 +87,7 @@ jobs:
8287
perform-docker-scan: false # scan Dockerfile and built images with Docker Scout or Trivy; see repo custom properties matching "container"
8388

8489
# report to central developer dashboard
90+
# quality-dashboard-version: 'main' # Version of quality dashboard workflow (main, v1.0.7, etc.)
8591
report-to-atlassian-dashboard: false
8692
quality-product-name: 'Chef-360' # product name for quality reporting, like Chef360, Courier, Inspec
8793
# quality-product-name: ${{ github.event.repository.name }} # like 'Chef-360' - the product name for quality reporting, like Chef360, Courier, Inspec
@@ -105,6 +111,7 @@ jobs:
105111
publish-packages: false # Publish packages (e.g., container from Dockerfile to ECR, go-releaser binary to releases page, omnibus to artifactory, gems, choco, homebrew, other app stores)
106112

107113
# generate and export Software Bill of Materials (SBOM) in various formats
114+
# sbom-version: 'main' # Version of SBOM workflow (main, v1.0.7, etc.)
108115
generate-sbom: true
109116
export-github-sbom: true # SPDX JSON artifact on job instance
110117
perform-blackduck-sca-scan: true # combined with generate sbom & generate github-sbom, also needs version above

‎HOW-TO-USE.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,12 @@ jobs:
4848
with:
4949
visibility: ${{ github.event.repository.visibility }}
5050
language: 'go' # go, ruby, rust
51+
52+
# Optionally pin individual scan versions (all default to 'main')
53+
# trufflehog-version: 'v1.0.7'
54+
# grype-version: 'v1.0.7'
55+
# sbom-version: 'v1.0.7'
56+
5157
perform-complexity-checks: true
5258
perform-trufflehog-scan: true
5359
perform-trivy-scan: true
@@ -102,6 +108,43 @@ Tags follow semantic versioning: `v{MAJOR}.{MINOR}.{PATCH}`
102108

103109
When code is merged to `main` in `common-github-actions`, a new patch tag is automatically created via the `create-release-tag.yml` workflow. Manual version bumps can be triggered via workflow dispatch.
104110

111+
### Sub-Workflow Versioning (NEW)
112+
113+
**Each security scan can be pinned to its own version independently**, giving you fine-grained control over which scan versions to use:
114+
115+
```yaml
116+
jobs:
117+
ci:
118+
uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@v1.0.7
119+
with:
120+
# Pin individual scan versions
121+
scc-version: 'v1.0.7' # Use stable SCC
122+
trufflehog-version: 'v1.0.7' # Use stable TruffleHog
123+
grype-version: 'main' # Use latest Grype
124+
grype-hab-version: 'v1.0.6' # Use older Habitat scan
125+
polaris-version: 'v1.0.7' # Use stable Polaris
126+
sbom-version: 'v1.0.7' # Use stable SBOM
127+
quality-dashboard-version: 'main' # Use latest dashboard
128+
```
129+
130+
**Benefits:**
131+
- Pin versions that work well with your project
132+
- Update individual scans without affecting others
133+
- Test new scan versions without full pipeline upgrade
134+
- Avoid breaking changes in production workflows
135+
- Roll back specific scans if issues arise
136+
137+
**Available Version Inputs:**
138+
- `scc-version` - Source code complexity checks
139+
- `trufflehog-version` - Secret scanning
140+
- `grype-version` - Grype image/source scanning
141+
- `grype-hab-version` - Grype Habitat package scanning
142+
- `polaris-version` - BlackDuck Polaris SAST
143+
- `sbom-version` - SBOM generation and BlackDuck SCA
144+
- `quality-dashboard-version` - Quality dashboard reporting
145+
146+
**Default:** All sub-workflows default to `'main'` if not specified.
147+
105148
---
106149

107150
## Available Workflows
@@ -166,6 +209,12 @@ jobs:
166209
version: '1.0.0'
167210
build-profile: 'cli'
168211
212+
# Pin scan versions for stability (optional)
213+
trufflehog-version: 'v1.0.7'
214+
grype-version: 'v1.0.7'
215+
polaris-version: 'v1.0.7'
216+
sbom-version: 'v1.0.7'
217+
169218
# Code Quality
170219
perform-complexity-checks: true
171220
perform-language-linting: true
@@ -259,6 +308,9 @@ jobs:
259308
visibility: ${{ github.event.repository.visibility }}
260309
language: 'go'
261310
311+
# Use specific versions for critical scans
312+
trufflehog-version: 'v1.0.7' # Pin to stable version
313+
262314
# Disable everything except security scans
263315
perform-complexity-checks: false
264316
perform-language-linting: false

‎PIPELINE-REFERENCE.md‎

Lines changed: 86 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,56 @@ This document provides comprehensive information about the security and quality
66

77
## Pipeline Overview
88

9+
### Sub-Workflow Versioning
10+
11+
**NEW in v1.0.7+**: Each security scan workflow can be pinned to a specific version independently. This allows you to:
12+
13+
- **Pin stable versions** that work with your project
14+
- **Update incrementally** - test one scan at a time
15+
- **Avoid breaking changes** - stay on known-good versions
16+
- **Roll back easily** - revert specific scans if needed
17+
18+
**Version Control Strategy:**
19+
20+
```yaml
21+
# Example: Mix stable and latest versions
22+
jobs:
23+
ci:
24+
uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@v1.0.7
25+
with:
26+
# Production-critical scans: pin to tested versions
27+
trufflehog-version: 'v1.0.7'
28+
polaris-version: 'v1.0.7'
29+
sbom-version: 'v1.0.7'
30+
31+
# Non-blocking scans: use latest
32+
scc-version: 'main'
33+
grype-version: 'main'
34+
35+
# Your scan configurations...
36+
perform-trufflehog-scan: true
37+
perform-blackduck-polaris: true
38+
generate-sbom: true
39+
```
40+
41+
**Available Version Inputs:**
42+
43+
| Input | Workflow | Default | Description |
44+
|-------|----------|---------|-------------|
45+
| `scc-version` | scc.yml | `main` | Source code complexity |
46+
| `trufflehog-version` | trufflehog.yml | `main` | Secret scanning |
47+
| `grype-version` | grype.yml | `main` | Image/source scanning |
48+
| `grype-hab-version` | grype-hab-package-scan.yml | `main` | Habitat package scanning |
49+
| `polaris-version` | polaris-sast.yml | `main` | BlackDuck Polaris SAST |
50+
| `sbom-version` | sbom.yml | `main` | SBOM + BlackDuck SCA |
51+
| `quality-dashboard-version` | irfan-quality-dashboard.yml | `main` | Quality reporting |
52+
53+
**Recommendation:** Pin to specific versions (e.g., `v1.0.7`) for production repositories. Use `main` for development/testing repositories to get latest features.
54+
55+
---
56+
57+
## Pipeline Overview
58+
959
```mermaid
1060
graph TD
1161
Start([Pull Request/Push Event]) --> PreCheck[precompilation-checks]
@@ -70,16 +120,20 @@ graph TD
70120

71121
```mermaid
72122
graph LR
73-
A[scc Job] -->|calls| B[scc.yml]
123+
A[scc Job] -->|calls| B[scc.yml@version]
74124
B -->|requires| C[Variables]
75125
76126
C -->|input| D[outputfilename: string]
127+
C -->|version| E[scc-version: string]
77128
78129
style A fill:#e1f5ff
79130
style B fill:#d4edff
80131
```
81132

82-
**Workflow File:** `chef/common-github-actions/.github/workflows/scc.yml`
133+
**Workflow File:** `chef/common-github-actions/.github/workflows/scc.yml@{version}`
134+
135+
**Version Input:**
136+
- `scc-version` (string) - Version of SCC workflow to use (e.g., 'main', 'v1.0.7'), default: 'main'
83137

84138
**Required Variables:**
85139
- `outputfilename` (string) - Name of the SCC complexity output file artifact, default: 'scc-complexity'
@@ -143,16 +197,20 @@ graph LR
143197

144198
```mermaid
145199
graph LR
146-
A[run-trufflehog Job] -->|calls| B[trufflehog.yml]
200+
A[run-trufflehog Job] -->|calls| B[trufflehog.yml@version]
147201
B -->|requires| C[Variables]
148202
149203
C -->|no inputs| D[None Required]
204+
C -->|version| E[trufflehog-version: string]
150205
151206
style A fill:#ffe1e1
152207
style B fill:#ffd4d4
153208
```
154209

155-
**Workflow File:** `chef/common-github-actions/.github/workflows/trufflehog.yml`
210+
**Workflow File:** `chef/common-github-actions/.github/workflows/trufflehog.yml@{version}`
211+
212+
**Version Input:**
213+
- `trufflehog-version` (string) - Version of Trufflehog workflow to use (e.g., 'main', 'v1.0.7'), default: 'main'
156214

157215
**Required Variables:**
158216
- None (inherits secrets automatically)
@@ -228,17 +286,21 @@ graph LR
228286

229287
```mermaid
230288
graph LR
231-
A[BlackDuck-Polaris-SAST Job] -->|inline steps| B[Inline Implementation]
289+
A[BlackDuck-Polaris-SAST Job] -->|calls| B[polaris-sast.yml@version]
232290
B -->|requires| C[Variables]
233291
234292
C -->|secrets| D[POLARIS_SERVER_URL<br/>POLARIS_ACCESS_TOKEN]
235293
C -->|inputs| E[polaris-application-name<br/>polaris-project-name<br/>polaris-working-directory<br/>polaris-config-path<br/>polaris-coverity-config-path<br/>polaris-coverity-build-command<br/>polaris-coverity-clean-command<br/>polaris-coverity-args<br/>polaris-detect-search-depth<br/>polaris-detect-args<br/>polaris-assessment-mode<br/>wait-for-scan]
294+
C -->|version| F[polaris-version: string]
236295
237296
style A fill:#ffe1e1
238297
style B fill:#ffd4d4
239298
```
240299

241-
**Workflow File:** Inline implementation (no separate workflow)
300+
**Workflow File:** `chef/common-github-actions/.github/workflows/polaris-sast.yml@{version}`
301+
302+
**Version Input:**
303+
- `polaris-version` (string) - Version of Polaris SAST workflow to use (e.g., 'main', 'v1.0.7'), default: 'main'
242304

243305
**Required Secrets:**
244306
- `POLARIS_SERVER_URL` - BlackDuck Polaris server URL
@@ -429,12 +491,17 @@ graph LR
429491
430492
C -->|secrets| D[HAB_PUBLIC_BLDR_PAT]
431493
C -->|inputs| E[publish-habitat-hab_package<br/>publish-habitat-hab_version<br/>publish-habitat-hab_release<br/>publish-habitat-hab_channel<br/>publish-habitat-hab_auth_token]
494+
C -->|version| F[grype-version or grype-hab-version]
432495
433496
style A fill:#ffe1e1
434497
style B fill:#ffd4d4
435498
```
436499

437-
**Workflow File:** Inline implementation
500+
**Workflow File:** Inline implementation (for inline scans) or `grype.yml@{version}` / `grype-hab-package-scan.yml@{version}`
501+
502+
**Version Inputs:**
503+
- `grype-version` (string) - Version of Grype workflow for image/source scans, default: 'main'
504+
- `grype-hab-version` (string) - Version of Grype Habitat package scan workflow, default: 'main'
438505

439506
**Required Secrets:**
440507
- `HAB_PUBLIC_BLDR_PAT` - Habitat Builder personal access token (fallback)
@@ -544,17 +611,21 @@ graph LR
544611

545612
```mermaid
546613
graph LR
547-
A[generate-sbom Job] -->|calls| B[sbom.yml]
614+
A[generate-sbom Job] -->|calls| B[sbom.yml@version]
548615
B -->|requires| C[Variables]
549616
550617
C -->|secrets| D[BLACKDUCK_SBOM_URL<br/>BLACKDUCK_SCA_TOKEN]
551618
C -->|inputs| E[version<br/>export-github-sbom<br/>perform-blackduck-sca-scan<br/>blackduck-project-group-name<br/>blackduck-project-name<br/>generate-msft-sbom<br/>license_scout<br/>go-private-modules]
619+
C -->|version| F[sbom-version: string]
552620
553621
style A fill:#e1ffe1
554622
style B fill:#c5f5c5
555623
```
556624

557-
**Workflow File:** `chef/common-github-actions/.github/workflows/sbom.yml`
625+
**Workflow File:** `chef/common-github-actions/.github/workflows/sbom.yml@{version}`
626+
627+
**Version Input:**
628+
- `sbom-version` (string) - Version of SBOM workflow to use (e.g., 'main', 'v1.0.7'), default: 'main'
558629

559630
**Required Secrets:**
560631
- `BLACKDUCK_SBOM_URL` - BlackDuck SCA server URL
@@ -600,16 +671,20 @@ graph LR
600671

601672
```mermaid
602673
graph LR
603-
A[quality-dashboard Job] -->|calls| B[irfan-quality-dashboard.yml]
674+
A[quality-dashboard Job] -->|calls| B[irfan-quality-dashboard.yml@version]
604675
B -->|requires| C[Variables]
605676
606677
C -->|inputs| D[perform-build<br/>build-profile<br/>language<br/>report-unit-test-coverage<br/>report-to-atlassian-dashboard<br/>quality-product-name<br/>quality-sonar-app-name<br/>quality-testing-type<br/>quality-service-name<br/>quality-junit-report<br/>visibility<br/>go-private-modules<br/>udf1, udf2, udf3]
678+
C -->|version| E[quality-dashboard-version: string]
607679
608680
style A fill:#f0e1ff
609681
style B fill:#e0c5ff
610682
```
611683

612-
**Workflow File:** `chef/common-github-actions/.github/workflows/irfan-quality-dashboard.yml`
684+
**Workflow File:** `chef/common-github-actions/.github/workflows/irfan-quality-dashboard.yml@{version}`
685+
686+
**Version Input:**
687+
- `quality-dashboard-version` (string) - Version of quality dashboard workflow to use (e.g., 'main', 'v1.0.7'), default: 'main'
613688

614689
**Required Variables:**
615690
- `perform-build` (boolean) - Whether build was performed

0 commit comments

Comments
 (0)