Skip to content

Commit 97f5989

Browse files
Saul-STFCSaul-STFC
committed
CI: Hardening
1 parent d2ee5e8 commit 97f5989

7 files changed

Lines changed: 130 additions & 60 deletions

File tree

‎.github/workflows/general_daily_security.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
name: Security audit
3+
permissions: {}
34

45
on:
56
schedule:
@@ -8,9 +9,16 @@ on:
89

910
jobs:
1011
audit:
12+
name: Audit
1113
runs-on: ubuntu-latest
14+
permissions:
15+
contents: read
16+
checks: write # rustsec/audit-check reports findings as a check run
17+
issues: write # rustsec/audit-check opens/updates issues for new advisories
1218
steps:
13-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
14-
- uses: actions-rs/audit-check@35b7b53b1e25b55642157ac01b4adceb5b9ebef3 # renovate: tag=v1.2.0
19+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
20+
with:
21+
persist-credentials: false
22+
- uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
1523
with:
1624
token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/pr_cockpit.yml‎

Lines changed: 38 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
name: Pull Request Cockpit
3+
permissions: {}
34

45
on:
56
pull_request:
@@ -34,21 +35,24 @@ jobs:
3435
runs-on: ubuntu-latest
3536
needs:
3637
- general-checks
38+
permissions:
39+
contents: read
3740
steps:
3841
- name: Checkout Repository
39-
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
42+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
4043
with:
44+
persist-credentials: false
4145
submodules: recursive
4246

4347
- name: Setup Helm
44-
uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
48+
uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
4549
with:
4650
version: v3.6.2
4751

4852
- name: Setup Rust
49-
uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1
50-
with:
51-
toolchain: ${{ env.RUST_VERSION }}
53+
run: |
54+
rustup toolchain install "$RUST_VERSION" --profile minimal
55+
rustup default "$RUST_VERSION"
5256
5357
- name: Setup Rust Cache
5458
uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
@@ -63,15 +67,16 @@ jobs:
6367

6468
- name: Helm Charts not up-to-date
6569
if: ${{ failure() }}
66-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
70+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
6771
with:
6872
script: |
6973
core.setFailed('Committed Helm charts were not up to date, please regenerate and re-commit!')
7074
7175
publish:
7276
name: Publish ${{ matrix.runner.arch }} Image
7377
permissions:
74-
id-token: write
78+
contents: read
79+
id-token: write # required for keyless image signing via cosign (OIDC token to Sigstore)
7580
runs-on: ${{ matrix.runner.name }}
7681
strategy:
7782
matrix:
@@ -90,22 +95,26 @@ jobs:
9095
- check-charts
9196
steps:
9297
- name: Checkout Repository
93-
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
98+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
9499
with:
100+
persist-credentials: false
95101
submodules: recursive
96-
- uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # tag=v25
102+
- uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # tag=v31.11.1
97103

98104
- name: Setup Rust
99-
uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1
100-
with:
101-
toolchain: ${{ env.RUST_VERSION }}
105+
run: |
106+
rustup toolchain install "$RUST_VERSION" --profile minimal
107+
rustup default "$RUST_VERSION"
102108
103-
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
109+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
104110
with:
105111
go-version: ${{ env.GO_VERSION }}
106112

107113
- name: Install cosign
108-
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
114+
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
115+
with:
116+
# pin to the latest Cosign v2.x, V3 changes how we publish (new bundle format / OCI 1.1 referrer signatures)
117+
cosign-release: v2.6.5
109118

110119
- name: Install syft
111120
uses: anchore/sbom-action/download-syft@9246b90769f852b3a8921f330c59e0b3f439d6e9 # v0.20.1
@@ -116,9 +125,11 @@ jobs:
116125
key: pr-stackable-cockpit-chart
117126

118127
- name: Update Version
128+
env:
129+
PR_NUMBER: ${{ github.event.pull_request.number }}
119130
run: |
120131
cargo install --locked cargo-edit --version 0.11.11
121-
cargo set-version --offline --package stackable-cockpit 0.0.0-pr${{ github.event.pull_request.number }}
132+
cargo set-version --offline --package stackable-cockpit "0.0.0-pr$PR_NUMBER"
122133
123134
# Recreate charts and publish charts and docker image. The "-e" is needed as we want to override the
124135
# default value in the makefile if called from this action, but not otherwise (i.e. when called locally).
@@ -139,7 +150,8 @@ jobs:
139150
- publish
140151
runs-on: ubuntu-latest
141152
permissions:
142-
id-token: write
153+
contents: read
154+
id-token: write # required for keyless image signing via cosign (OIDC token to Sigstore)
143155
env:
144156
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
145157
OCI_REGISTRY_SDP_PASSWORD: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -148,21 +160,27 @@ jobs:
148160
OCI_REGISTRY_SDP_CHARTS_USERNAME: "robot$sdp-charts+github-action-build"
149161
steps:
150162
- name: Install cosign
151-
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
163+
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
164+
with:
165+
# pin to the latest Cosign v2.x, V3 changes how we publish (new bundle format / OCI 1.1 referrer signatures)
166+
cosign-release: v2.6.5
152167
- name: Checkout
153-
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
168+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
154169
with:
170+
persist-credentials: false
155171
submodules: recursive
156172
# This step checks if the current run was triggered by a push to a pr (or a pr being created).
157173
# If this is the case it changes the version of this project in all Cargo.toml files to include the suffix
158174
# "-pr<prnumber>" so that the published artifacts can be linked to this PR.
159-
- uses: stackabletech/cargo-install-action@main
175+
- uses: stackabletech/cargo-install-action@e3e2dcf8d0f0e5bdbc619bf6ee7560dd68152d3c # main
160176
with:
161177
crate: cargo-edit
162178
bin: cargo-set-version
163179
- name: Update version if PR
164180
if: ${{ github.event_name == 'pull_request' }}
165-
run: cargo set-version --offline --package stackable-cockpit 0.0.0-pr${{ github.event.pull_request.number }}
181+
env:
182+
PR_NUMBER: ${{ github.event.pull_request.number }}
183+
run: cargo set-version --offline --package stackable-cockpit "0.0.0-pr$PR_NUMBER"
166184
- name: Build manifest list
167185
run: |
168186
# Creating manifest list

‎.github/workflows/pr_docs.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
name: Pull Request Docs
3+
permissions: {}
34

45
on:
56
pull_request:

‎.github/workflows/pr_general.yml‎

Lines changed: 41 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
name: Pull Request General
3+
permissions: {}
34

45
on: workflow_call
56

@@ -20,15 +21,17 @@ jobs:
2021
env:
2122
RUSTC_BOOTSTRAP: 1
2223
steps:
23-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
24+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2425
with:
26+
persist-credentials: false
2527
submodules: recursive
2628

27-
- uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1
28-
with:
29-
toolchain: ${{ env.RUST_VERSION }}
29+
- name: Setup Rust
30+
run: |
31+
rustup toolchain install "$RUST_VERSION" --profile minimal
32+
rustup default "$RUST_VERSION"
3033
31-
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
34+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
3235
with:
3336
go-version: ${{ env.GO_VERSION }}
3437

@@ -50,8 +53,9 @@ jobs:
5053
# Prevent sudden announcement of a new advisory from failing ci:
5154
continue-on-error: ${{ matrix.checks == 'advisories' }}
5255
steps:
53-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
56+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
5457
with:
58+
persist-credentials: false
5559
submodules: recursive
5660
- uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15
5761
with:
@@ -61,16 +65,18 @@ jobs:
6165
name: Run RustDoc
6266
runs-on: ubuntu-latest
6367
steps:
64-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
68+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
6569
with:
70+
persist-credentials: false
6671
submodules: recursive
6772

68-
- uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1
69-
with:
70-
toolchain: ${{ env.RUST_VERSION }}
71-
components: rustfmt
73+
- name: Setup Rust
74+
run: |
75+
rustup toolchain install "$RUST_VERSION" --profile minimal
76+
rustup component add rustfmt --toolchain "$RUST_VERSION"
77+
rustup default "$RUST_VERSION"
7278
73-
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
79+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
7480
with:
7581
go-version: ${{ env.GO_VERSION }}
7682

@@ -84,15 +90,17 @@ jobs:
8490
name: Run Cargo Tests
8591
runs-on: ubuntu-latest
8692
steps:
87-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
93+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
8894
with:
95+
persist-credentials: false
8996
submodules: recursive
9097

91-
- uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1
92-
with:
93-
toolchain: ${{ env.RUST_VERSION }}
98+
- name: Setup Rust
99+
run: |
100+
rustup toolchain install "$RUST_VERSION" --profile minimal
101+
rustup default "$RUST_VERSION"
94102
95-
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
103+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
96104
with:
97105
go-version: ${{ env.GO_VERSION }}
98106

@@ -104,12 +112,26 @@ jobs:
104112

105113
tests_passed:
106114
name: All tests passed
115+
if: always()
107116
needs:
108117
- run_udeps
109118
- run_cargodeny
110119
- run_rustdoc
111120
- run_tests
112121
runs-on: ubuntu-latest
113122
steps:
114-
- name: log
115-
run: echo All tests have passed!
123+
- name: Check job results
124+
env:
125+
UDEPS_RESULT: ${{ needs.run_udeps.result }}
126+
CARGODENY_RESULT: ${{ needs.run_cargodeny.result }}
127+
RUSTDOC_RESULT: ${{ needs.run_rustdoc.result }}
128+
TESTS_RESULT: ${{ needs.run_tests.result }}
129+
run: |
130+
if [[ "$UDEPS_RESULT" != "success" ]] ||
131+
[[ "$CARGODENY_RESULT" != "success" ]] ||
132+
[[ "$RUSTDOC_RESULT" != "success" ]] ||
133+
[[ "$TESTS_RESULT" != "success" ]]; then
134+
echo "One or more jobs failed"
135+
exit 1
136+
fi
137+
echo "All tests have passed!"

‎.github/workflows/pr_pre-commit.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
name: pre-commit
3+
permissions: {}
34

45
on:
56
pull_request:
@@ -13,10 +14,12 @@ env:
1314

1415
jobs:
1516
pre-commit:
17+
name: Pre-commit
1618
runs-on: ubuntu-latest
1719
steps:
18-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
20+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1921
with:
22+
persist-credentials: false
2023
fetch-depth: 0
2124
- uses: stackabletech/actions/run-pre-commit@5901c3b1455488820c4be367531e07c3c3e82538 # v0.4.0
2225
with:

‎.github/workflows/pr_stackablectl.yml‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
name: Pull Request Stackablectl
3+
permissions: {}
34

45
on:
56
pull_request:
@@ -56,16 +57,20 @@ jobs:
5657
os: macos-latest
5758
steps:
5859
- name: Checkout
59-
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
60+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
6061
with:
62+
persist-credentials: false
6163
submodules: recursive
6264

63-
- uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1
64-
with:
65-
toolchain: ${{ env.RUST_VERSION }}
66-
targets: ${{ matrix.target }}
65+
- name: Setup Rust
66+
env:
67+
TARGET: ${{ matrix.target }}
68+
run: |
69+
rustup toolchain install "$RUST_VERSION" --profile minimal
70+
rustup target add "$TARGET" --toolchain "$RUST_VERSION"
71+
rustup default "$RUST_VERSION"
6772
68-
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
73+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
6974
with:
7075
go-version: ${{ env.GO_VERSION }}
7176

@@ -75,16 +80,18 @@ jobs:
7580

7681
- name: Build for non-Windows
7782
if: matrix.os != 'windows-latest'
78-
run: cargo build --target ${{ matrix.target }} -p stackablectl
83+
env:
84+
TARGET: ${{ matrix.target }}
85+
run: cargo build --target "$TARGET" -p stackablectl
7986

8087
- name: Ensure shell completions up-to-date
81-
if: matrix.os == 'x86_64-unknown-linux-gnu'
88+
if: matrix.target == 'x86_64-unknown-linux-gnu'
8289
run: |
8390
cargo xtask gen-comp
8491
git diff --exit-code
8592
8693
- name: Ensure man page is up-to-date
87-
if: matrix.os == 'x86_64-unknown-linux-gnu'
94+
if: matrix.target == 'x86_64-unknown-linux-gnu'
8895
run: |
8996
cargo xtask gen-man
9097
git diff --exit-code

0 commit comments

Comments
 (0)