Skip to content

Commit d0243c1

Browse files
NickLarsenNZNickLarsenNZ
authored
ci: Security Improvements (#113)
* ci: Replace dtolnay/rust-toolchain with rustup command This remediates both: - https://docs.zizmor.sh/audits/#unpinned-uses (one pointed to `master`). - https://docs.zizmor.sh/audits/#superfluous-actions * ci: Do not persist credentials on checkout This remediates https://docs.zizmor.sh/audits/#artipacked * ci: Default to no scopes This remediates https://docs.zizmor.sh/audits/#excessive-permissions * ci: Bump actions/checkout * ci: Bump docker/login-action Note: I think we can replace this by using the stackabletech/actions * ci: Bump sigstore/cosign-installer Note: I think we can replace this by using the stackabletech/actions * ci: Bump actions/setup-python * ci: Bump stackabletech/actions Note: I checked the documented inputs/outputs for any changes, but it looks like none are needed.
1 parent b1319ed commit d0243c1

3 files changed

Lines changed: 48 additions & 42 deletions

File tree

‎.github/workflows/build.yaml‎

Lines changed: 23 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ on:
44
branches: [main]
55
pull_request:
66

7+
permissions: {}
8+
79
env:
810
RUST_TOOLCHAIN_VERSION: "1.94.0"
911
RUSTFLAGS: "-D warnings"
@@ -15,42 +17,40 @@ jobs:
1517
name: Run tests
1618
runs-on: ubuntu-latest
1719
steps:
18-
- uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
19-
- uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a
20+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
2021
with:
21-
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
22+
persist-credentials: false
23+
- run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
2224
- run: cargo test --all-features
2325

2426
clippy:
2527
name: Check clippy
2628
runs-on: ubuntu-latest
2729
steps:
28-
- uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
29-
- uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a
30+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
3031
with:
31-
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
32-
components: clippy
32+
persist-credentials: false
33+
- run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}" --component clippy
3334
- run: cargo clippy --all-targets -- -D warnings
3435

3536
fmt:
3637
name: Check formatting
3738
runs-on: ubuntu-latest
3839
steps:
39-
- uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
40-
- uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a
40+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
4141
with:
42-
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
43-
components: rustfmt
42+
persist-credentials: false
43+
- run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}" --component rustfmt
4444
- run: cargo fmt --all -- --check
4545

4646
docs:
4747
name: Generate docs
4848
runs-on: ubuntu-latest
4949
steps:
50-
- uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
51-
- uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a
50+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
5251
with:
53-
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
52+
persist-credentials: false
53+
- run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
5454
- run: cargo doc --document-private-items
5555

5656
build:
@@ -65,18 +65,20 @@ jobs:
6565
- ubuntu-latest
6666
- ubicloud-standard-8-arm
6767
steps:
68-
- uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
68+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
69+
with:
70+
persist-credentials: false
6971
- name: Build and (optionally) push container image
7072
id: build
71-
uses: stackabletech/actions/build-container-image@013e6482fbc0edf2d38cf9220fc931f6a81336fb # v0.0.6
73+
uses: stackabletech/actions/build-container-image@a14cbd08d9e034e2361ea9205b32aff0491885db # v0.15.0
7274
with:
7375
image-name: trino-lb
7476
image-index-manifest-tag: dev
7577
container-file: docker/Dockerfile
7678

7779
- name: Publish Container Image on oci.stackable.tech
7880
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
79-
uses: stackabletech/actions/publish-image@013e6482fbc0edf2d38cf9220fc931f6a81336fb # v0.0.6
81+
uses: stackabletech/actions/publish-image@a14cbd08d9e034e2361ea9205b32aff0491885db # v0.15.0
8082
with:
8183
image-registry-uri: oci.stackable.tech
8284
image-registry-username: robot$stackable+github-action-build
@@ -95,10 +97,12 @@ jobs:
9597
runs-on: ubuntu-latest
9698
steps:
9799
- name: Checkout Repository
98-
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
100+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
101+
with:
102+
persist-credentials: false
99103

100104
- name: Publish and Sign Image Index Manifest to oci.stackable.tech
101-
uses: stackabletech/actions/publish-index-manifest@013e6482fbc0edf2d38cf9220fc931f6a81336fb # v0.0.6
105+
uses: stackabletech/actions/publish-index-manifest@a14cbd08d9e034e2361ea9205b32aff0491885db # v0.15.0
102106
with:
103107
image-registry-uri: oci.stackable.tech
104108
image-registry-username: robot$stackable+github-action-build

‎.github/workflows/pr_pre-commit.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ name: pre-commit
44
on:
55
pull_request:
66

7+
permissions: {}
8+
79
env:
810
CARGO_TERM_COLOR: always
911
RUST_TOOLCHAIN_VERSION: "1.94.0"
@@ -13,16 +15,14 @@ jobs:
1315
pre-commit:
1416
runs-on: ubuntu-latest
1517
steps:
16-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
18+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
1719
with:
1820
fetch-depth: 0
19-
- uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
21+
persist-credentials: false
22+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
2023
with:
2124
python-version: '3.12'
22-
- uses: dtolnay/rust-toolchain@master
23-
with:
24-
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
25-
components: rustfmt,clippy
25+
- run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}" --component rustfmt,clippy
2626
- name: Setup Hadolint
2727
shell: bash
2828
run: |

‎.github/workflows/release.yaml‎

Lines changed: 19 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ on:
33
push:
44
tags: ['v[0-9]+.[0-9]+.[0-9]+']
55

6+
permissions: {}
7+
68
env:
79
RUST_TOOLCHAIN_VERSION: "1.94.0"
810
RUSTFLAGS: "-D warnings"
@@ -14,42 +16,40 @@ jobs:
1416
name: Run tests
1517
runs-on: ubuntu-latest
1618
steps:
17-
- uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
18-
- uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a
19+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
1920
with:
20-
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
21+
persist-credentials: false
22+
- run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
2123
- run: cargo test --all-features
2224

2325
clippy:
2426
name: Check clippy
2527
runs-on: ubuntu-latest
2628
steps:
27-
- uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
28-
- uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a
29+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
2930
with:
30-
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
31-
components: clippy
31+
persist-credentials: false
32+
- run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}" --component clippy
3233
- run: cargo clippy --all-targets -- -D warnings
3334

3435
fmt:
3536
name: Check formatting
3637
runs-on: ubuntu-latest
3738
steps:
38-
- uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
39-
- uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a
39+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
4040
with:
41-
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
42-
components: rustfmt
41+
persist-credentials: false
42+
- run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}" --component clippy
4343
- run: cargo fmt --all -- --check
4444

4545
docs:
4646
name: Generate docs
4747
runs-on: ubuntu-latest
4848
steps:
49-
- uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
50-
- uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a
49+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
5150
with:
52-
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
51+
persist-credentials: false
52+
- run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
5353
- run: cargo doc --document-private-items
5454

5555
docker-image:
@@ -59,11 +59,13 @@ jobs:
5959
id-token: write
6060
runs-on: ubuntu-latest
6161
steps:
62-
- uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
62+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
63+
with:
64+
persist-credentials: false
6365
- name: Set up Cosign
64-
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
66+
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
6567
- name: Login to Stackable Harbor
66-
uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
68+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
6769
with:
6870
registry: oci.stackable.tech
6971
username: robot$stackable+github-action-build

0 commit comments

Comments
 (0)