Skip to content

Commit bee85ab

Browse files
FrawlessFrawless
authored
Improve OpenSSF Scorecard results (#41)
* Pin actions via sha diggest instead of floating tags Signed-off-by: Jakub Stejskal <xstejs24@gmail.com> * Bump couple of versions and add scorecard workflow Signed-off-by: Jakub Stejskal <xstejs24@gmail.com> * Improve OpenSSF Scorecard reports Signed-off-by: Jakub Stejskal <xstejs24@gmail.com> --------- Signed-off-by: Jakub Stejskal <xstejs24@gmail.com>
1 parent 926b19d commit bee85ab

26 files changed

Lines changed: 175 additions & 64 deletions

File tree

‎.github/actionlint.yaml‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,9 @@ self-hosted-runner:
66
# Labels of self-hosted runner in array of strings.
77
# Add other runners if needed
88
labels:
9-
# container runners
10-
- oracle-2cpu-8gb-arm64
11-
- oracle-2cpu-8gb-x86_64
12-
# VM runners
13-
- oracle-vm-2cpu-8gb-x86-64
14-
- oracle-vm-2cpu-8gb-arm64
15-
- oracle-vm-4cpu-16gb-x86-64
16-
- oracle-vm-4cpu-16gb-arm64
17-
- oracle-vm-8cpu-32gb-x86-64
18-
- oracle-vm-8cpu-32gb-arm64
9+
- cncf-ubuntu-2-8-x86
10+
- cncf-ubuntu-4-16-x86
11+
- cncf-ubuntu-8-32-x86
12+
- cncf-ubuntu-2-8-arm
13+
- cncf-ubuntu-4-16-arm
14+
- cncf-ubuntu-8-32-arm

‎.github/actions/build/build-binaries/action.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ runs:
2525
# Common build steps
2626
#############################################################
2727
- name: Restore Maven cache
28-
uses: actions/cache/restore@v5
28+
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
2929
with:
3030
path: ~/.m2/repository
3131
key: maven-${{ hashFiles('**/pom.xml') }}
@@ -111,7 +111,7 @@ runs:
111111
- name: Save Maven cache
112112
# Save maven cache only after pushes into default branch
113113
if: ${{ inputs.mainJavaBuild == 'true' && github.event_name == 'push' && github.ref_name == github.event.repository.default_branch }}
114-
uses: actions/cache/save@v5
114+
uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
115115
with:
116116
path: ~/.m2/repository
117117
key: maven-${{ hashFiles('**/pom.xml') }}
@@ -138,14 +138,14 @@ runs:
138138
139139
- name: Upload artifact
140140
if: ${{ inputs.mainJavaBuild == 'true' }}
141-
uses: actions/upload-artifact@v7
141+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
142142
with:
143143
name: binaries-${{ inputs.artifactSuffix }}.tar
144144
path: binaries-${{ inputs.artifactSuffix }}.tar
145145
retention-days: 7
146146

147147
- name: Publish test results
148-
uses: dorny/test-reporter@v3
148+
uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
149149
if: always() && inputs.clusterOperatorBuild != 'true'
150150
with:
151151
name: 'Unit & Integration tests'

‎.github/actions/build/build-containers/action.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,13 +34,13 @@ runs:
3434
steps:
3535
- name: Download binaries from this workflow
3636
if: ${{ inputs.buildRunId == '' }}
37-
uses: actions/download-artifact@v7
37+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
3838
with:
3939
name: binaries-${{ inputs.artifactSuffix }}.tar
4040

4141
- name: Download binaries from external build
4242
if: ${{ inputs.buildRunId != '' }}
43-
uses: actions/download-artifact@v7
43+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
4444
with:
4545
name: binaries-${{ inputs.artifactSuffix }}.tar
4646
run-id: ${{ inputs.buildRunId }}
@@ -67,7 +67,7 @@ runs:
6767
run: "tar -cvpf containers-${{ inputs.artifactSuffix }}-${{ inputs.architecture }}.tar ${{ inputs.imagesLocation }}"
6868

6969
- name: Upload containers artifact
70-
uses: actions/upload-artifact@v7
70+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
7171
with:
7272
name: containers-${{ inputs.artifactSuffix }}-${{ inputs.architecture }}.tar
7373
path: containers-${{ inputs.artifactSuffix }}-${{ inputs.architecture }}.tar

‎.github/actions/build/deploy-java/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ runs:
2222
using: "composite"
2323
steps:
2424
- name: Restore Maven cache
25-
uses: actions/cache/restore@v5
25+
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
2626
with:
2727
path: ~/.m2/repository
2828
key: maven-${{ hashFiles('**/pom.xml') }}

‎.github/actions/build/publish-helm-chart/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ runs:
3030
using: "composite"
3131
steps:
3232
- name: Download release artifacts
33-
uses: actions/download-artifact@v7
33+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
3434
with:
3535
name: release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar
3636
path: ./

‎.github/actions/build/push-containers/action.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,11 @@ runs:
3535
using: "composite"
3636
steps:
3737
- name: Install Cosign
38-
uses: sigstore/cosign-installer@v4.0.0
38+
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
3939

4040
- name: Download container artifact
4141
if: ${{ inputs.buildRunId != '' }}
42-
uses: actions/download-artifact@v7
42+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
4343
with:
4444
pattern: containers-${{ inputs.artifactSuffix }}*
4545
path: ./
@@ -49,7 +49,7 @@ runs:
4949

5050
- name: Download container artifact
5151
if: ${{ inputs.buildRunId == '' }}
52-
uses: actions/download-artifact@v7
52+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
5353
with:
5454
pattern: containers-${{ inputs.artifactSuffix }}*
5555
path: ./
@@ -144,7 +144,7 @@ runs:
144144
# The keyless signing doesn't work on pull_requests events so this part will be tested only during push events
145145
# It shouldn't affect the usage in Strimzi projects as images are always pushed and signed during push or workflow_dispatch events
146146
if: ${{ github.event_name != 'pull_request' }}
147-
uses: actions/upload-artifact@v7
147+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
148148
with:
149149
name: SBOMs-${{ inputs.artifactSuffix }}-${{ inputs.containerTag }}.tar.gz
150150
path: sbom.tar.gz

‎.github/actions/build/release-artifacts/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ runs:
1313
using: "composite"
1414
steps:
1515
- name: Restore Maven cache
16-
uses: actions/cache/restore@v5
16+
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
1717
with:
1818
path: ~/.m2/repository
1919
key: maven-${{ hashFiles('**/pom.xml') }}
@@ -37,7 +37,7 @@ runs:
3737
-exec tar -rvf release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar {} \;
3838
3939
- name: Upload release artifacts
40-
uses: actions/upload-artifact@v7
40+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
4141
with:
4242
name: release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar
4343
path: release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar

‎.github/actions/dependencies/install-ascii-doctor/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ runs:
1111
using: "composite"
1212
steps:
1313
- name: Set up Ruby
14-
uses: ruby/setup-ruby@v1
14+
uses: ruby/setup-ruby@12fd324f1d0b43274fdc8130f6980590a667c455 # v1.312.0
1515
with:
1616
ruby-version: ${{ inputs.rubyVersion }}
1717

‎.github/actions/dependencies/install-docker/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,12 @@ runs:
99
run: "docker --version"
1010

1111
- name: Set up QEMU
12-
uses: docker/setup-qemu-action@v4
12+
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
1313
with:
1414
platforms: all
1515

1616
- name: Set up Docker Buildx
17-
uses: docker/setup-buildx-action@v4
17+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
1818
with:
1919
platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
2020
driver: docker

‎.github/actions/dependencies/install-helm/setup-helm.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ function install_helm3 {
1313
fi
1414

1515
export HELM_INSTALL_DIR=/usr/bin
16-
curl https://raw.githubusercontent.com/kubernetes/helm/master/scripts/get > get_helm.sh
16+
curl https://raw.githubusercontent.com/helm/helm/06468084e85c244c712834933d25ea232a4c2093/scripts/get > get_helm.sh # v4.2.0
1717
# we need to modify the script with a different path because on the Azure pipelines the HELM_INSTALL_DIR env var is not honoured
1818
sed -i 's#/usr/local/bin#/usr/bin#g' get_helm.sh
1919
chmod 700 get_helm.sh

0 commit comments

Comments
 (0)