diff --git a/.github/workflows/general_daily_security.yml b/.github/workflows/general_daily_security.yml index 39196e57..2b689c51 100644 --- a/.github/workflows/general_daily_security.yml +++ b/.github/workflows/general_daily_security.yml @@ -1,5 +1,6 @@ --- name: Security audit +permissions: {} on: schedule: @@ -8,9 +9,16 @@ on: jobs: audit: + name: Audit runs-on: ubuntu-latest + permissions: + contents: read + checks: write # rustsec/audit-check reports findings as a check run + issues: write # rustsec/audit-check opens/updates issues for new advisories steps: - - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - - uses: actions-rs/audit-check@35b7b53b1e25b55642157ac01b4adceb5b9ebef3 # renovate: tag=v1.2.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0 with: token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/pr_cockpit.yml b/.github/workflows/pr_cockpit.yml index 5e582517..f3d7fca0 100644 --- a/.github/workflows/pr_cockpit.yml +++ b/.github/workflows/pr_cockpit.yml @@ -1,5 +1,6 @@ --- name: Pull Request Cockpit +permissions: {} on: pull_request: @@ -34,21 +35,24 @@ jobs: runs-on: ubuntu-latest needs: - general-checks + permissions: + contents: read steps: - name: Checkout Repository - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive - name: Setup Helm - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5 + uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 with: version: v3.6.2 - name: Setup Rust - uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1 - with: - toolchain: ${{ env.RUST_VERSION }} + run: | + rustup toolchain install "$RUST_VERSION" --profile minimal + rustup default "$RUST_VERSION" - name: Setup Rust Cache uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0 @@ -63,7 +67,7 @@ jobs: - name: Helm Charts not up-to-date if: ${{ failure() }} - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | core.setFailed('Committed Helm charts were not up to date, please regenerate and re-commit!') @@ -71,7 +75,8 @@ jobs: publish: name: Publish ${{ matrix.runner.arch }} Image permissions: - id-token: write + contents: read + id-token: write # required for keyless image signing via cosign (OIDC token to Sigstore) runs-on: ${{ matrix.runner.name }} strategy: matrix: @@ -90,22 +95,26 @@ jobs: - check-charts steps: - name: Checkout Repository - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive - - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # tag=v25 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # tag=v31.11.1 - name: Setup Rust - uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1 - with: - toolchain: ${{ env.RUST_VERSION }} + run: | + rustup toolchain install "$RUST_VERSION" --profile minimal + rustup default "$RUST_VERSION" - - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ env.GO_VERSION }} - name: Install cosign - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + with: + # pin to the latest Cosign v2.x, V3 changes how we publish (new bundle format / OCI 1.1 referrer signatures) + cosign-release: v2.6.5 - name: Install syft uses: anchore/sbom-action/download-syft@9246b90769f852b3a8921f330c59e0b3f439d6e9 # v0.20.1 @@ -116,9 +125,11 @@ jobs: key: pr-stackable-cockpit-chart - name: Update Version + env: + PR_NUMBER: ${{ github.event.pull_request.number }} run: | cargo install --locked cargo-edit --version 0.11.11 - cargo set-version --offline --package stackable-cockpit 0.0.0-pr${{ github.event.pull_request.number }} + cargo set-version --offline --package stackable-cockpit "0.0.0-pr$PR_NUMBER" # Recreate charts and publish charts and docker image. The "-e" is needed as we want to override the # default value in the makefile if called from this action, but not otherwise (i.e. when called locally). @@ -139,7 +150,8 @@ jobs: - publish runs-on: ubuntu-latest permissions: - id-token: write + contents: read + id-token: write # required for keyless image signing via cosign (OIDC token to Sigstore) env: NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }} OCI_REGISTRY_SDP_PASSWORD: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }} @@ -148,21 +160,27 @@ jobs: OCI_REGISTRY_SDP_CHARTS_USERNAME: "robot$sdp-charts+github-action-build" steps: - name: Install cosign - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + with: + # pin to the latest Cosign v2.x, V3 changes how we publish (new bundle format / OCI 1.1 referrer signatures) + cosign-release: v2.6.5 - name: Checkout - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive # This step checks if the current run was triggered by a push to a pr (or a pr being created). # If this is the case it changes the version of this project in all Cargo.toml files to include the suffix # "-pr" so that the published artifacts can be linked to this PR. - - uses: stackabletech/cargo-install-action@main + - uses: stackabletech/cargo-install-action@e3e2dcf8d0f0e5bdbc619bf6ee7560dd68152d3c # main with: crate: cargo-edit bin: cargo-set-version - name: Update version if PR if: ${{ github.event_name == 'pull_request' }} - run: cargo set-version --offline --package stackable-cockpit 0.0.0-pr${{ github.event.pull_request.number }} + env: + PR_NUMBER: ${{ github.event.pull_request.number }} + run: cargo set-version --offline --package stackable-cockpit "0.0.0-pr$PR_NUMBER" - name: Build manifest list run: | # Creating manifest list diff --git a/.github/workflows/pr_docs.yml b/.github/workflows/pr_docs.yml index 0c307065..8da60c20 100644 --- a/.github/workflows/pr_docs.yml +++ b/.github/workflows/pr_docs.yml @@ -1,5 +1,6 @@ --- name: Pull Request Docs +permissions: {} on: pull_request: diff --git a/.github/workflows/pr_general.yml b/.github/workflows/pr_general.yml index 9939cffc..67ea90ea 100644 --- a/.github/workflows/pr_general.yml +++ b/.github/workflows/pr_general.yml @@ -1,5 +1,6 @@ --- name: Pull Request General +permissions: {} on: workflow_call @@ -20,15 +21,17 @@ jobs: env: RUSTC_BOOTSTRAP: 1 steps: - - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive - - uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1 - with: - toolchain: ${{ env.RUST_VERSION }} + - name: Setup Rust + run: | + rustup toolchain install "$RUST_VERSION" --profile minimal + rustup default "$RUST_VERSION" - - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ env.GO_VERSION }} @@ -50,8 +53,9 @@ jobs: # Prevent sudden announcement of a new advisory from failing ci: continue-on-error: ${{ matrix.checks == 'advisories' }} steps: - - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive - uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15 with: @@ -61,16 +65,18 @@ jobs: name: Run RustDoc runs-on: ubuntu-latest steps: - - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive - - uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1 - with: - toolchain: ${{ env.RUST_VERSION }} - components: rustfmt + - name: Setup Rust + run: | + rustup toolchain install "$RUST_VERSION" --profile minimal + rustup component add rustfmt --toolchain "$RUST_VERSION" + rustup default "$RUST_VERSION" - - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ env.GO_VERSION }} @@ -84,15 +90,17 @@ jobs: name: Run Cargo Tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive - - uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1 - with: - toolchain: ${{ env.RUST_VERSION }} + - name: Setup Rust + run: | + rustup toolchain install "$RUST_VERSION" --profile minimal + rustup default "$RUST_VERSION" - - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ env.GO_VERSION }} @@ -104,6 +112,7 @@ jobs: tests_passed: name: All tests passed + if: always() needs: - run_udeps - run_cargodeny @@ -111,5 +120,18 @@ jobs: - run_tests runs-on: ubuntu-latest steps: - - name: log - run: echo All tests have passed! + - name: Check job results + env: + UDEPS_RESULT: ${{ needs.run_udeps.result }} + CARGODENY_RESULT: ${{ needs.run_cargodeny.result }} + RUSTDOC_RESULT: ${{ needs.run_rustdoc.result }} + TESTS_RESULT: ${{ needs.run_tests.result }} + run: | + if [[ "$UDEPS_RESULT" != "success" ]] || + [[ "$CARGODENY_RESULT" != "success" ]] || + [[ "$RUSTDOC_RESULT" != "success" ]] || + [[ "$TESTS_RESULT" != "success" ]]; then + echo "One or more jobs failed" + exit 1 + fi + echo "All tests have passed!" diff --git a/.github/workflows/pr_pre-commit.yml b/.github/workflows/pr_pre-commit.yml index 581c8056..a1c95475 100644 --- a/.github/workflows/pr_pre-commit.yml +++ b/.github/workflows/pr_pre-commit.yml @@ -1,5 +1,6 @@ --- name: pre-commit +permissions: {} on: pull_request: @@ -13,10 +14,12 @@ env: jobs: pre-commit: + name: Pre-commit runs-on: ubuntu-latest steps: - - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - uses: stackabletech/actions/run-pre-commit@5901c3b1455488820c4be367531e07c3c3e82538 # v0.4.0 with: diff --git a/.github/workflows/pr_stackablectl.yml b/.github/workflows/pr_stackablectl.yml index faa33072..28ff7d98 100644 --- a/.github/workflows/pr_stackablectl.yml +++ b/.github/workflows/pr_stackablectl.yml @@ -1,5 +1,6 @@ --- name: Pull Request Stackablectl +permissions: {} on: pull_request: @@ -56,16 +57,20 @@ jobs: os: macos-latest steps: - name: Checkout - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive - - uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1 - with: - toolchain: ${{ env.RUST_VERSION }} - targets: ${{ matrix.target }} + - name: Setup Rust + env: + TARGET: ${{ matrix.target }} + run: | + rustup toolchain install "$RUST_VERSION" --profile minimal + rustup target add "$TARGET" --toolchain "$RUST_VERSION" + rustup default "$RUST_VERSION" - - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ env.GO_VERSION }} @@ -75,16 +80,18 @@ jobs: - name: Build for non-Windows if: matrix.os != 'windows-latest' - run: cargo build --target ${{ matrix.target }} -p stackablectl + env: + TARGET: ${{ matrix.target }} + run: cargo build --target "$TARGET" -p stackablectl - name: Ensure shell completions up-to-date - if: matrix.os == 'x86_64-unknown-linux-gnu' + if: matrix.target == 'x86_64-unknown-linux-gnu' run: | cargo xtask gen-comp git diff --exit-code - name: Ensure man page is up-to-date - if: matrix.os == 'x86_64-unknown-linux-gnu' + if: matrix.target == 'x86_64-unknown-linux-gnu' run: | cargo xtask gen-man git diff --exit-code diff --git a/.github/workflows/release_stackablectl.yml b/.github/workflows/release_stackablectl.yml index cdb899b3..afc35991 100644 --- a/.github/workflows/release_stackablectl.yml +++ b/.github/workflows/release_stackablectl.yml @@ -1,10 +1,11 @@ --- name: Stackablectl Release Pipeline +permissions: {} on: push: tags: - - "stackablectl-[0-9]+.[0-9]+.[0-9]+**" + - "stackablectl-[0-9]+.[0-9]+.[0-9]+*" env: CARGO_CYCLONEDX_VERSION: 0.5.7 @@ -20,6 +21,8 @@ jobs: release: name: Release for ${{ matrix.target }} runs-on: ${{ matrix.os }} + permissions: + contents: write # required to upload release binaries and SBOM assets to the GitHub Release strategy: fail-fast: false matrix: @@ -38,34 +41,42 @@ jobs: file-suffix: "" steps: - name: Checkout - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive - - uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1 + - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 with: toolchain: ${{ env.RUST_VERSION }} targets: ${{ matrix.target }} - - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: '^1.22.2' + go-version: '^1.26.0' - name: Install cargo-cyclonedx - run: cargo install --locked cargo-cyclonedx@${{ env.CARGO_CYCLONEDX_VERSION }} + run: cargo install --locked cargo-cyclonedx@"$CARGO_CYCLONEDX_VERSION" - name: Build Binary if: matrix.os != 'windows-latest' - run: cargo build --target ${{ matrix.target }} --release --package stackablectl + env: + TARGET: ${{ matrix.target }} + run: cargo build --target "$TARGET" --release --package stackablectl - name: Generate SBOM run: cargo cyclonedx --all --spec-version 1.5 --describe binaries - name: Rename Binary - run: mv target/${{ matrix.target }}/release/stackablectl${{ matrix.file-suffix }} stackablectl-${{ matrix.target }}${{ matrix.file-suffix }} + env: + TARGET: ${{ matrix.target }} + FILE_SUFFIX: ${{ matrix.file-suffix }} + run: mv "target/$TARGET/release/stackablectl$FILE_SUFFIX" "stackablectl-$TARGET$FILE_SUFFIX" - name: Rename SBOM - run: mv rust/stackablectl/stackablectl_bin.cdx.xml stackablectl-${{ matrix.target }}.cdx.xml + env: + TARGET: ${{ matrix.target }} + run: mv rust/stackablectl/stackablectl_bin.cdx.xml "stackablectl-$TARGET.cdx.xml" - name: Upload Release Binary and SBOM uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2