Skip to content

Commit 5526315

Browse files
moshevaynermoshevayner
committed
[CI]: Update GitHub Actions workflows to enhance security and update dependencies
Signed-off-by: Moshe Vayner <moshe@vayner.me>
1 parent 5170a16 commit 5526315

8 files changed

Lines changed: 115 additions & 48 deletions

File tree

‎.github/workflows/automerge.yml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,20 @@ jobs:
1010

1111
runs-on: ubuntu-latest
1212

13+
permissions:
14+
contents: write
15+
1316
steps:
17+
- name: Harden Runner
18+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
19+
with:
20+
disable-sudo: true
21+
egress-policy: block
22+
allowed-endpoints: >
23+
api.github.com:443
24+
github.com:443
1425
- name: Checkout
15-
uses: actions/checkout@v6
26+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1627
with:
1728
fetch-depth: 0 # Full clone necessary for proper merge
1829

‎.github/workflows/build-test.yml‎

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,18 +20,18 @@ jobs:
2020
outputs:
2121
paths: ${{ steps.filter.outputs.changes }}
2222
steps:
23-
- uses: actions/checkout@v6
24-
with:
25-
ref: ${{ github.event.pull_request.head.sha }}
2623
- name: Harden Runner
27-
uses: step-security/harden-runner@v2
24+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
2825
with:
2926
disable-sudo: true
3027
egress-policy: block
3128
allowed-endpoints: >
3229
api.github.com:443
3330
github.com:443
34-
- uses: dorny/paths-filter@v3
31+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
32+
with:
33+
ref: ${{ github.event.pull_request.head.sha }}
34+
- uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
3535
id: filter
3636
with:
3737
base: ${{ github.ref }}
@@ -43,7 +43,7 @@ jobs:
4343
if: ${{ contains(fromJSON(needs.changes.outputs.paths), 'src') }}
4444
steps:
4545
- name: Harden Runner
46-
uses: step-security/harden-runner@v2
46+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
4747
with:
4848
disable-sudo: true
4949
egress-policy: block
@@ -61,10 +61,10 @@ jobs:
6161
get.helm.sh:443
6262
golangci-lint.run:443
6363
64-
- uses: actions/checkout@v6
64+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6565
with:
6666
fetch-depth: 0
67-
- uses: actions/setup-go@v6
67+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
6868
with:
6969
go-version-file: go.mod
7070
check-latest: true
@@ -90,20 +90,34 @@ jobs:
9090
docker-build:
9191
runs-on: ubuntu-latest
9292
steps:
93-
- uses: actions/checkout@v6
93+
- name: Harden Runner
94+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
95+
with:
96+
disable-sudo: true
97+
egress-policy: block
98+
allowed-endpoints: >
99+
api.github.com:443
100+
auth.docker.io:443
101+
dl-cdn.alpinelinux.org:443
102+
github.com:443
103+
production.cloudflare.docker.com:443
104+
proxy.golang.org:443
105+
registry-1.docker.io:443
106+
storage.googleapis.com:443
107+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
94108
with:
95109
fetch-depth: 0
96110
- name: Docker Meta
97111
id: meta
98-
uses: docker/metadata-action@v5
112+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
99113
with:
100114
images: |
101115
linode/linode-cloud-controller-manager
102116
tags: |
103117
type=raw,value=pr-${{ github.event.pull_request.number }},enable=${{ github.event_name == 'pull_request' }}
104118
type=raw,value=latest,enable=${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
105119
- name: Build Dockerfile
106-
uses: docker/build-push-action@v6
120+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
107121
with:
108122
context: .
109123
push: false

‎.github/workflows/ci.yml‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -21,18 +21,18 @@ jobs:
2121
outputs:
2222
paths: ${{ steps.filter.outputs.changes }}
2323
steps:
24-
- uses: actions/checkout@v6
25-
with:
26-
ref: ${{ github.event.pull_request.head.sha }}
2724
- name: Harden Runner
28-
uses: step-security/harden-runner@v2
25+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
2926
with:
3027
disable-sudo: true
3128
egress-policy: block
3229
allowed-endpoints: >
3330
api.github.com:443
3431
github.com:443
35-
- uses: dorny/paths-filter@v3
32+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
33+
with:
34+
ref: ${{ github.event.pull_request.head.sha }}
35+
- uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
3636
id: filter
3737
with:
3838
base: ${{ github.ref }}
@@ -45,7 +45,7 @@ jobs:
4545
if: ${{ contains(fromJSON(needs.changes.outputs.paths), 'src') }}
4646
steps:
4747
- name: Harden Runner
48-
uses: step-security/harden-runner@v2
48+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
4949
with:
5050
disable-sudo: true
5151
egress-policy: block
@@ -61,10 +61,10 @@ jobs:
6161
api.codecov.io:443
6262
ingest.codecov.io:443
6363
64-
- uses: actions/checkout@v6
64+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6565
with:
6666
ref: ${{ github.event.pull_request.head.sha }}
67-
- uses: actions/setup-go@v6
67+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
6868
with:
6969
go-version-file: go.mod
7070
check-latest: true
@@ -73,7 +73,7 @@ jobs:
7373
run: make test
7474

7575
- name: Upload coverage reports to Codecov
76-
uses: codecov/codecov-action@v5
76+
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
7777
with:
7878
files: ./coverage.out
7979
verbose: true
@@ -94,24 +94,29 @@ jobs:
9494
LINODE_MACHINE_TYPE: g6-standard-2
9595
WORKER_NODES: '2'
9696
steps:
97-
- uses: actions/checkout@v6
97+
- name: Harden Runner
98+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
99+
with:
100+
disable-sudo: true
101+
egress-policy: audit
102+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
98103
with:
99104
ref: ${{ github.event.pull_request.head.sha }}
100105

101106
- name: Set up Go
102-
uses: actions/setup-go@v6
107+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
103108
with:
104109
go-version-file: 'go.mod'
105110
check-latest: true
106111

107112
- name: Login to Docker Hub
108-
uses: docker/login-action@v3
113+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
109114
with:
110115
username: ${{ secrets.DOCKER_USERNAME }}
111116
password: ${{ secrets.DOCKER_PASSWORD }}
112117

113118
- name: Install devbox
114-
uses: jetify-com/devbox-install-action@v0.15.0
119+
uses: jetify-com/devbox-install-action@8c6a66ed6273138b1915457069de78cb52fe3bd7 # v0.15.0
115120

116121
- name: Setup CAPL Management Kind Cluster and CAPL Child Cluster For Testing
117122
run: devbox run mgmt-and-capl-cluster

‎.github/workflows/helm.yml‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,13 @@ jobs:
1414
helm-test:
1515
runs-on: ubuntu-latest
1616
steps:
17+
- name: Harden Runner
18+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
19+
with:
20+
disable-sudo: true
21+
egress-policy: audit
1722
- name: Checkout
18-
uses: actions/checkout@v6
23+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1924
with:
2025
fetch-depth: 0
2126

@@ -26,15 +31,15 @@ jobs:
2631
sed -ie "s/version: 0.0.0/version: ${TAG#helm-}/g" deploy/chart/Chart.yaml
2732
2833
- name: Set up Helm
29-
uses: azure/setup-helm@v4
34+
uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
3035

31-
- uses: actions/setup-python@v6
36+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
3237
with:
3338
python-version: '3.14'
3439
check-latest: true
3540

3641
- name: Set up chart-testing
37-
uses: helm/chart-testing-action@v2.8.0
42+
uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
3843

3944
- name: Run chart-testing (lint)
4045
run: ct lint --check-version-increment=false --chart-dirs deploy --target-branch ${{ github.event.repository.default_branch }}
@@ -53,8 +58,13 @@ jobs:
5358
contents: write # for helm/chart-releaser-action to push chart release and create a release
5459
runs-on: ubuntu-latest
5560
steps:
61+
- name: Harden Runner
62+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
63+
with:
64+
disable-sudo: true
65+
egress-policy: audit
5666
- name: Checkout
57-
uses: actions/checkout@v6
67+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5868
with:
5969
fetch-depth: 0
6070

@@ -70,10 +80,10 @@ jobs:
7080
git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
7181
7282
- name: Set up Helm
73-
uses: azure/setup-helm@v4
83+
uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
7484

7585
- name: Run chart-releaser
76-
uses: helm/chart-releaser-action@v1.7.0
86+
uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
7787
env:
7888
CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
7989
CR_RELEASE_NAME_TEMPLATE: "helm-{{ .Version }}"

‎.github/workflows/label-sync.yml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
name: Sync labels
2+
3+
permissions:
4+
contents: read
25
on:
36
push:
47
branches:
@@ -8,9 +11,18 @@ on:
811
jobs:
912
build:
1013
runs-on: ubuntu-latest
14+
permissions:
15+
issues: write
1116
steps:
12-
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # pin@v2
13-
- uses: micnncim/action-label-syncer@3abd5ab72fda571e69fffd97bd4e0033dd5f495c # pin@v1
17+
- name: Harden Runner
18+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
19+
with:
20+
disable-sudo: true
21+
egress-policy: audit
22+
- name: Checkout
23+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
24+
- name: Sync Labels
25+
uses: micnncim/action-label-syncer@3abd5ab72fda571e69fffd97bd4e0033dd5f495c # v1.3.0
1426
env:
1527
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1628
with:

‎.github/workflows/pr-labeler.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,22 @@ on:
55
pull_request_target:
66
types: [opened, reopened, synchronize]
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
label-pr:
1013
name: Update PR labels
1114
permissions:
12-
contents: write
1315
pull-requests: write
1416
runs-on: ubuntu-latest
1517
steps:
16-
- name: Checkout repository
17-
uses: actions/checkout@v6
18+
- name: Harden Runner
19+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
1820
with:
19-
fetch-depth: 0
21+
disable-sudo: true
22+
egress-policy: audit
2023
- name: Label PR
21-
uses: release-drafter/release-drafter@v6
22-
with:
23-
disable-releaser: github.ref != 'refs/heads/main'
24+
uses: release-drafter/release-drafter/autolabeler@5de93583980a40bd78603b6dfdcda5b4df377b32 # v7.2.0
2425
env:
2526
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-drafter.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,14 @@ permissions:
1212
jobs:
1313
update_release_draft:
1414
permissions:
15-
contents: write
1615
pull-requests: write
1716
runs-on: ubuntu-latest
1817
steps:
19-
- uses: release-drafter/release-drafter@v6
18+
- name: Harden Runner
19+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
20+
with:
21+
disable-sudo: true
22+
egress-policy: audit
23+
- uses: release-drafter/release-drafter@5de93583980a40bd78603b6dfdcda5b4df377b32 # v7.2.0
2024
env:
2125
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release.yml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,38 +4,48 @@ on:
44
tags:
55
- "v*.*.*"
66

7+
permissions:
8+
contents: read
9+
710
jobs:
811
release:
912
runs-on: ubuntu-latest
13+
permissions:
14+
contents: write
1015
steps:
11-
- uses: actions/checkout@v6
16+
- name: Harden Runner
17+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
18+
with:
19+
disable-sudo: true
20+
egress-policy: audit
21+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1222
with:
1323
fetch-depth: 0
1424
- name: Create Release Artifacts
1525
run: make release
1626
env:
1727
IMAGE_VERSION: ${{ github.ref_name }}
1828
- name: Upload Release Artifacts
19-
uses: softprops/action-gh-release@v2.5.0
29+
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
2030
with:
2131
files: |
2232
./release/helm-chart-${{ github.ref_name }}.tgz
2333
- name: Docker Meta
2434
id: meta
25-
uses: docker/metadata-action@v5
35+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
2636
with:
2737
images: |
2838
linode/linode-cloud-controller-manager
2939
tags: |
3040
type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
3141
type=semver,pattern={{raw}},value=${{ github.ref_name }}
3242
- name: Login to Docker Hub
33-
uses: docker/login-action@v3
43+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
3444
with:
3545
username: ${{ secrets.DOCKER_USERNAME }}
3646
password: ${{ secrets.DOCKER_PASSWORD }}
3747
- name: Build and Push to Docker Hub
38-
uses: docker/build-push-action@v6
48+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
3949
with:
4050
context: .
4151
push: true

0 commit comments

Comments
 (0)