Skip to content

Commit b0f9714

Browse files
AB-xdevAB-xdev
authored
Merge pull request #116 from xdev-software/develop
Release
2 parents de6ad85 + 8149be3 commit b0f9714

8 files changed

Lines changed: 91 additions & 27 deletions

‎.github/workflows/broken-links.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818

1919
- name: Link Checker
2020
id: lychee
21-
uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2
21+
uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2
2222
with:
2323
fail: false # Don't fail on broken links, create an issue instead
2424

‎.github/workflows/check-build.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ jobs:
2424
- uses: actions/checkout@v6
2525

2626
# Build entirely in docker
27-
- uses: docker/setup-qemu-action@v3
27+
- uses: docker/setup-qemu-action@v4
2828

29-
- uses: docker/setup-buildx-action@v3
29+
- uses: docker/setup-buildx-action@v4
3030

31-
- uses: docker/build-push-action@v6
31+
- uses: docker/build-push-action@v7
3232
with:
3333
context: ./src
3434
push: false

‎.github/workflows/image-vuln-scan.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
- uses: actions/checkout@v6
2121

2222
- name: Scan - Full
23-
uses: aquasecurity/trivy-action@0.33.1
23+
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
2424
with:
2525
image-ref: ${{ env.TRIVYY_IMAGE_REF }}
2626

@@ -34,7 +34,7 @@ jobs:
3434
3535
- name: Scan - Relevant
3636
id: scan_relevant
37-
uses: aquasecurity/trivy-action@0.33.1
37+
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
3838
with:
3939
trivy-config: trivy.yml
4040
image-ref: ${{ env.TRIVYY_IMAGE_REF }}
@@ -46,7 +46,7 @@ jobs:
4646

4747
- name: Find already existing issue
4848
id: find-issue
49-
if: ${{ always() }}
49+
if: ${{ !cancelled() }}
5050
run: |
5151
echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title "Trivy Vulnerability Report"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT
5252
env:

‎.github/workflows/release.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@ jobs:
1515
- uses: actions/checkout@v6
1616

1717
# Build entirely in docker
18-
- uses: docker/setup-qemu-action@v3
18+
- uses: docker/setup-qemu-action@v4
1919

20-
- uses: docker/setup-buildx-action@v3
20+
- uses: docker/setup-buildx-action@v4
2121

22-
- uses: docker/build-push-action@v6
22+
- uses: docker/build-push-action@v7
2323
with:
2424
context: ./src
2525
push: false
@@ -98,26 +98,26 @@ jobs:
9898
git config --global user.name "GitHub Actions"
9999
git pull
100100
101-
- uses: docker/setup-qemu-action@v3
101+
- uses: docker/setup-qemu-action@v4
102102

103-
- uses: docker/setup-buildx-action@v3
103+
- uses: docker/setup-buildx-action@v4
104104

105105
- name: Login to DockerHub
106-
uses: docker/login-action@v3
106+
uses: docker/login-action@v4
107107
with:
108108
username: ${{ secrets.DOCKERHUB_USERNAME }}
109109
password: ${{ secrets.DOCKERHUB_TOKEN }}
110110

111111
- name: Login to ghcr.io
112-
uses: docker/login-action@v3
112+
uses: docker/login-action@v4
113113
with:
114114
registry: ghcr.io
115115
username: ${{ github.actor }}
116116
password: ${{ secrets.GITHUB_TOKEN }}
117117

118118
- name: Extract metadata (tags, labels) for Docker
119119
id: meta
120-
uses: docker/metadata-action@v5
120+
uses: docker/metadata-action@v6
121121
with:
122122
images: |
123123
${{ secrets.DOCKERHUB_USERNAME }}/oidc-server-mock
@@ -128,7 +128,7 @@ jobs:
128128
type=semver,pattern={{major}},value=${{ needs.prepare-release.outputs.version }}
129129
latest
130130
131-
- uses: docker/build-push-action@v6
131+
- uses: docker/build-push-action@v7
132132
id: push
133133
with:
134134
context: ./src
@@ -139,7 +139,7 @@ jobs:
139139
outputs: type=image,compression=zstd,force-compression=true
140140

141141
- name: Generate artifact attestation (ghcr.io)
142-
uses: actions/attest-build-provenance@v3
142+
uses: actions/attest@v4
143143
with:
144144
subject-name: ghcr.io/${{ github.repository }}
145145
subject-digest: ${{ steps.push.outputs.digest }}

‎.github/workflows/report-gha-workflow-security-problems.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: Report workflow security problems
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches: [ develop ]
7+
paths:
8+
- '.github/workflows/**'
9+
10+
permissions:
11+
issues: write
12+
13+
jobs:
14+
prt:
15+
runs-on: ubuntu-latest
16+
timeout-minutes: 15
17+
# Only run this in our repos (Prevent notification spam by forks)
18+
if: ${{ github.repository_owner == 'xdev-software' }}
19+
steps:
20+
- uses: actions/checkout@v6
21+
22+
- name: Check
23+
id: check
24+
run: |
25+
grep -l 'pull_request_target:' --exclude report-gha-workflow-security-problems.yml *.yml > reported.txt && exit 1 || exit 0
26+
working-directory: .github/workflows
27+
28+
- name: Find already existing issue
29+
id: find-issue
30+
if: ${{ !cancelled() }}
31+
run: |
32+
echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title "Incorrectly configure GHA workflow (prt)"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT
33+
env:
34+
GH_TOKEN: ${{ github.token }}
35+
36+
- name: Close issue if everything is fine
37+
if: ${{ success() && steps.find-issue.outputs.number != '' }}
38+
run: gh issue close -r 'not planned' ${{ steps.find-issue.outputs.number }}
39+
env:
40+
GH_TOKEN: ${{ github.token }}
41+
42+
- name: Create report
43+
if: ${{ failure() && steps.check.conclusion == 'failure' }}
44+
run: |
45+
echo 'Detected usage of `pull_request_target`. This event is dangerous and MUST NOT BE USED AT ALL COST!' > reported.md
46+
echo '' >> reported.md
47+
echo '/cc @xdev-software/gha-workflow-security' >> reported.md
48+
echo '' >> reported.md
49+
echo '```' >> reported.md
50+
cat .github/workflows/reported.txt >> reported.md
51+
echo '```' >> reported.md
52+
cat reported.md
53+
54+
- name: Create Issue From File
55+
if: ${{ failure() && steps.check.conclusion == 'failure' }}
56+
uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6
57+
with:
58+
issue-number: ${{ steps.find-issue.outputs.number }}
59+
title: 'Incorrectly configure GHA workflow (prt)'
60+
content-filepath: ./reported.md
61+
labels: bug, automated

‎.github/workflows/test-deploy.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,34 +14,34 @@ jobs:
1414
steps:
1515
- uses: actions/checkout@v6
1616

17-
- uses: docker/setup-qemu-action@v3
17+
- uses: docker/setup-qemu-action@v4
1818

19-
- uses: docker/setup-buildx-action@v3
19+
- uses: docker/setup-buildx-action@v4
2020

2121
- name: Login to DockerHub
22-
uses: docker/login-action@v3
22+
uses: docker/login-action@v4
2323
with:
2424
username: ${{ secrets.DOCKERHUB_USERNAME }}
2525
password: ${{ secrets.DOCKERHUB_TOKEN }}
2626

2727
- name: Login to ghcr.io
28-
uses: docker/login-action@v3
28+
uses: docker/login-action@v4
2929
with:
3030
registry: ghcr.io
3131
username: ${{ github.actor }}
3232
password: ${{ secrets.GITHUB_TOKEN }}
3333

3434
- name: Extract metadata (tags, labels) for Docker
3535
id: meta
36-
uses: docker/metadata-action@v5
36+
uses: docker/metadata-action@v6
3737
with:
3838
images: |
3939
${{ secrets.DOCKERHUB_USERNAME }}/oidc-server-mock
4040
ghcr.io/${{ github.repository }}
4141
tags: |
4242
experimental
4343
44-
- uses: docker/build-push-action@v6
44+
- uses: docker/build-push-action@v7
4545
id: push
4646
with:
4747
context: ./src
@@ -52,7 +52,7 @@ jobs:
5252
outputs: type=image,compression=zstd,force-compression=true
5353

5454
- name: Generate artifact attestation (ghcr.io)
55-
uses: actions/attest-build-provenance@v3
55+
uses: actions/attest@v4
5656
with:
5757
subject-name: ghcr.io/${{ github.repository }}
5858
subject-digest: ${{ steps.push.outputs.digest }}

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# 1.2.4
2+
* Updated dependencies
3+
14
# 1.2.3
25
* Include missing frontend distribution data
36

‎src/OpenIdConnectServerMock.csproj‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@
2626
</ItemGroup>
2727

2828
<ItemGroup>
29-
<PackageReference Include="Duende.IdentityServer" Version="7.4.5" />
30-
<PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="10.0.2" />
31-
<PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.2" />
29+
<PackageReference Include="Duende.IdentityServer" Version="7.4.7" />
30+
<PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="10.0.5" />
31+
<PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.5" />
3232
<PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />
3333
<PackageReference Include="YamlDotNet" Version="16.3.0" />
3434
</ItemGroup>

0 commit comments

Comments
 (0)