Skip to content

CI: Hardening #450

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Saul-STFC wants to merge 1 commit into
base: main
Choose a base branch
from
Open

CI: Hardening #450

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions .github/workflows/general_daily_security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
---
name: Security audit
permissions: {}

on:
schedule:
Expand All @@ -8,9 +9,16 @@ on:

jobs:
audit:
name: Audit
runs-on: ubuntu-latest
permissions:
contents: read
checks: write # rustsec/audit-check reports findings as a check run
issues: write # rustsec/audit-check opens/updates issues for new advisories
steps:
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
- uses: actions-rs/audit-check@35b7b53b1e25b55642157ac01b4adceb5b9ebef3 # renovate: tag=v1.2.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
with:
token: ${{ secrets.GITHUB_TOKEN }}
58 changes: 38 additions & 20 deletions .github/workflows/pr_cockpit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
---
name: Pull Request Cockpit
permissions: {}

on:
pull_request:
Expand Down Expand Up @@ -34,21 +35,24 @@ jobs:
runs-on: ubuntu-latest
needs:
- general-checks
permissions:
contents: read
steps:
- name: Checkout Repository
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
submodules: recursive

- name: Setup Helm
uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
with:
version: v3.6.2

- name: Setup Rust
uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1
with:
toolchain: ${{ env.RUST_VERSION }}
run: |
rustup toolchain install "$RUST_VERSION" --profile minimal
rustup default "$RUST_VERSION"

- name: Setup Rust Cache
uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
Expand All @@ -63,15 +67,16 @@ jobs:

- name: Helm Charts not up-to-date
if: ${{ failure() }}
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
core.setFailed('Committed Helm charts were not up to date, please regenerate and re-commit!')

publish:
name: Publish ${{ matrix.runner.arch }} Image
permissions:
id-token: write
contents: read
id-token: write # required for keyless image signing via cosign (OIDC token to Sigstore)
runs-on: ${{ matrix.runner.name }}
strategy:
matrix:
Expand All @@ -90,22 +95,26 @@ jobs:
- check-charts
steps:
- name: Checkout Repository
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
submodules: recursive
- uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # tag=v25
- uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # tag=v31.11.1

- name: Setup Rust
uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1
with:
toolchain: ${{ env.RUST_VERSION }}
run: |
rustup toolchain install "$RUST_VERSION" --profile minimal
rustup default "$RUST_VERSION"

- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: ${{ env.GO_VERSION }}

- name: Install cosign
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
with:
# pin to the latest Cosign v2.x, V3 changes how we publish (new bundle format / OCI 1.1 referrer signatures)
cosign-release: v2.6.5

@Saul-STFC Saul-STFC Aug 18, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/stackabletech/stack_scanner/blob/master/.github/workflows/scan_release.yml

Stackscanner uses the newer version so this doesn't seem to be needed?


- name: Install syft
uses: anchore/sbom-action/download-syft@9246b90769f852b3a8921f330c59e0b3f439d6e9 # v0.20.1
Expand All @@ -116,9 +125,11 @@ jobs:
key: pr-stackable-cockpit-chart

- name: Update Version
env:
PR_NUMBER: ${{ github.event.pull_request.number }}
run: |
cargo install --locked cargo-edit --version 0.11.11
cargo set-version --offline --package stackable-cockpit 0.0.0-pr${{ github.event.pull_request.number }}
cargo set-version --offline --package stackable-cockpit "0.0.0-pr$PR_NUMBER"

# Recreate charts and publish charts and docker image. The "-e" is needed as we want to override the
# default value in the makefile if called from this action, but not otherwise (i.e. when called locally).
Expand All @@ -139,7 +150,8 @@ jobs:
- publish
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
id-token: write # required for keyless image signing via cosign (OIDC token to Sigstore)
env:
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
OCI_REGISTRY_SDP_PASSWORD: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
Expand All @@ -148,21 +160,27 @@ jobs:
OCI_REGISTRY_SDP_CHARTS_USERNAME: "robot$sdp-charts+github-action-build"
steps:
- name: Install cosign
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
with:
# pin to the latest Cosign v2.x, V3 changes how we publish (new bundle format / OCI 1.1 referrer signatures)
cosign-release: v2.6.5
- name: Checkout
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
submodules: recursive
# This step checks if the current run was triggered by a push to a pr (or a pr being created).
# If this is the case it changes the version of this project in all Cargo.toml files to include the suffix
# "-pr<prnumber>" so that the published artifacts can be linked to this PR.
- uses: stackabletech/cargo-install-action@main
- uses: stackabletech/cargo-install-action@e3e2dcf8d0f0e5bdbc619bf6ee7560dd68152d3c # main
with:
crate: cargo-edit
bin: cargo-set-version
- name: Update version if PR
if: ${{ github.event_name == 'pull_request' }}
run: cargo set-version --offline --package stackable-cockpit 0.0.0-pr${{ github.event.pull_request.number }}
env:
PR_NUMBER: ${{ github.event.pull_request.number }}
run: cargo set-version --offline --package stackable-cockpit "0.0.0-pr$PR_NUMBER"
- name: Build manifest list
run: |
# Creating manifest list
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/pr_docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
---
name: Pull Request Docs
permissions: {}

on:
pull_request:
Expand Down
60 changes: 41 additions & 19 deletions .github/workflows/pr_general.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
---
name: Pull Request General
permissions: {}

on: workflow_call

Expand All @@ -20,15 +21,17 @@ jobs:
env:
RUSTC_BOOTSTRAP: 1
steps:
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
submodules: recursive

- uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1
with:
toolchain: ${{ env.RUST_VERSION }}
- name: Setup Rust
run: |
rustup toolchain install "$RUST_VERSION" --profile minimal
rustup default "$RUST_VERSION"

- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: ${{ env.GO_VERSION }}

Expand All @@ -50,8 +53,9 @@ jobs:
# Prevent sudden announcement of a new advisory from failing ci:
continue-on-error: ${{ matrix.checks == 'advisories' }}
steps:
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
submodules: recursive
- uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15
with:
Expand All @@ -61,16 +65,18 @@ jobs:
name: Run RustDoc
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
submodules: recursive

- uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1
with:
toolchain: ${{ env.RUST_VERSION }}
components: rustfmt
- name: Setup Rust
run: |
rustup toolchain install "$RUST_VERSION" --profile minimal
rustup component add rustfmt --toolchain "$RUST_VERSION"
rustup default "$RUST_VERSION"

- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: ${{ env.GO_VERSION }}

Expand All @@ -84,15 +90,17 @@ jobs:
name: Run Cargo Tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
submodules: recursive

- uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1
with:
toolchain: ${{ env.RUST_VERSION }}
- name: Setup Rust
run: |
rustup toolchain install "$RUST_VERSION" --profile minimal
rustup default "$RUST_VERSION"

- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: ${{ env.GO_VERSION }}

Expand All @@ -104,12 +112,26 @@ jobs:

tests_passed:
name: All tests passed
if: always()
needs:
- run_udeps
- run_cargodeny
- run_rustdoc
- run_tests
runs-on: ubuntu-latest
steps:
- name: log
run: echo All tests have passed!
- name: Check job results
env:
UDEPS_RESULT: ${{ needs.run_udeps.result }}
CARGODENY_RESULT: ${{ needs.run_cargodeny.result }}
RUSTDOC_RESULT: ${{ needs.run_rustdoc.result }}
TESTS_RESULT: ${{ needs.run_tests.result }}
run: |
if [[ "$UDEPS_RESULT" != "success" ]] ||
[[ "$CARGODENY_RESULT" != "success" ]] ||
[[ "$RUSTDOC_RESULT" != "success" ]] ||
[[ "$TESTS_RESULT" != "success" ]]; then
echo "One or more jobs failed"
exit 1
fi
echo "All tests have passed!"
5 changes: 4 additions & 1 deletion .github/workflows/pr_pre-commit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
---
name: pre-commit
permissions: {}

on:
pull_request:
Expand All @@ -13,10 +14,12 @@ env:

jobs:
pre-commit:
name: Pre-commit
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
fetch-depth: 0
- uses: stackabletech/actions/run-pre-commit@5901c3b1455488820c4be367531e07c3c3e82538 # v0.4.0
with:
Expand Down
25 changes: 16 additions & 9 deletions .github/workflows/pr_stackablectl.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
---
name: Pull Request Stackablectl
permissions: {}

on:
pull_request:
Expand Down Expand Up @@ -56,16 +57,20 @@ jobs:
os: macos-latest
steps:
- name: Checkout
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
submodules: recursive

- uses: dtolnay/rust-toolchain@0e66bd3e6b38ec0ad5312288c83e47c143e6b09e # v1
with:
toolchain: ${{ env.RUST_VERSION }}
targets: ${{ matrix.target }}
- name: Setup Rust
env:
TARGET: ${{ matrix.target }}
run: |
rustup toolchain install "$RUST_VERSION" --profile minimal
rustup target add "$TARGET" --toolchain "$RUST_VERSION"
rustup default "$RUST_VERSION"

- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: ${{ env.GO_VERSION }}

Expand All @@ -75,16 +80,18 @@ jobs:

- name: Build for non-Windows
if: matrix.os != 'windows-latest'
run: cargo build --target ${{ matrix.target }} -p stackablectl
env:
TARGET: ${{ matrix.target }}
run: cargo build --target "$TARGET" -p stackablectl

- name: Ensure shell completions up-to-date
if: matrix.os == 'x86_64-unknown-linux-gnu'
if: matrix.target == 'x86_64-unknown-linux-gnu'
run: |
cargo xtask gen-comp
git diff --exit-code

- name: Ensure man page is up-to-date
if: matrix.os == 'x86_64-unknown-linux-gnu'
if: matrix.target == 'x86_64-unknown-linux-gnu'
run: |
cargo xtask gen-man
git diff --exit-code
Loading