Skip to content

Commit a9fb8f1

Browse files
willmurphyscodewillmurphyscode
authored
chore: lint gh actions (#2804)
Signed-off-by: Will Murphy <[email protected]>
1 parent 6592f3c commit a9fb8f1

File tree

10 files changed

+112
-13
lines changed

10 files changed

+112
-13
lines changed

‎.github/actions/bootstrap/action.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,10 @@ runs:
6363
if: inputs.bootstrap-apt-packages != ''
6464
shell: bash
6565
run: |
66-
DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y ${{ inputs.bootstrap-apt-packages }}
66+
read -ra PACKAGES <<< "$BOOTSTRAP_APT_PACKAGES"
67+
DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y "${PACKAGES[@]}"
68+
env:
69+
BOOTSTRAP_APT_PACKAGES: ${{ inputs.bootstrap-apt-packages }}
6770

6871
- name: Create all cache fingerprints
6972
if: inputs.compute-fingerprints == 'true'

‎.github/workflows/release-version-file.yaml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,18 +17,25 @@ on:
1717
type: string
1818
description: release version to update the version file with (prefixed with v)
1919
required: true
20+
secrets:
21+
TOOLBOX_AWS_ACCESS_KEY_ID:
22+
required: true
23+
TOOLBOX_AWS_SECRET_ACCESS_KEY:
24+
required: true
2025

2126
jobs:
2227

2328
release:
2429
runs-on: ubuntu-24.04
2530
steps:
2631
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
32+
with:
33+
persist-credentials: false
2734

2835
- name: Update version file
2936
run: make ci-release-version-file
3037
env:
31-
RELEASE_VERSION: ${{ github.event.inputs.version }}
38+
RELEASE_VERSION: ${{ inputs.version }}
3239
# for updating the VERSION file in S3...
3340
AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
3441
AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}

‎.github/workflows/release.yaml‎

Lines changed: 29 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ jobs:
2020
runs-on: ubuntu-24.04
2121
steps:
2222
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
23+
with:
24+
persist-credentials: false
2325

2426
- name: Check if running on main
2527
if: github.ref != 'refs/heads/main'
@@ -30,15 +32,19 @@ jobs:
3032
run: echo "This can only be run on the main branch otherwise releases produced will not be verifiable with cosign" && exit 1
3133

3234
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
35+
with:
36+
persist-credentials: false
3337

3438
- name: Check if pinned syft is a release version
3539
run: .github/scripts/check-syft-version-is-release.sh
3640

3741
- name: Check if tag already exists
3842
# note: this will fail if the tag already exists
3943
run: |
40-
[[ "${{ github.event.inputs.version }}" == v* ]] || (echo "version '${{ github.event.inputs.version }}' does not have a 'v' prefix" && exit 1)
41-
git tag ${{ github.event.inputs.version }}
44+
[[ "$VERSION" == v* ]] || (echo "version '$VERSION' does not have a 'v' prefix" && exit 1)
45+
git tag "$VERSION"
46+
env:
47+
VERSION: ${{ github.event.inputs.version }}
4248

4349
- name: Check static analysis results
4450
uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
@@ -107,14 +113,22 @@ jobs:
107113

108114
- name: Quality gate
109115
if: steps.static-analysis.outputs.conclusion != 'success' || steps.unit.outputs.conclusion != 'success' || steps.integration.outputs.conclusion != 'success' || steps.quality_tests.outputs.conclusion != 'success' || steps.cli-linux.outputs.conclusion != 'success' || steps.acceptance-linux.outputs.conclusion != 'success' || steps.acceptance-mac.outputs.conclusion != 'success'
116+
env:
117+
STATIC_ANALYSIS_STATUS: ${{ steps.static-analysis.conclusion }}
118+
UNIT_TEST_STATUS: ${{ steps.unit.outputs.conclusion }}
119+
INTEGRATION_TEST_STATUS: ${{ steps.integration.outputs.conclusion }}
120+
QUALITY_TEST_STATUS: ${{ steps.quality_tests.outputs.conclusion }}
121+
ACCEPTANCE_LINUX_STATUS: ${{ steps.acceptance-linux.outputs.conclusion }}
122+
ACCEPTANCE_MAC_STATUS: ${{ steps.acceptance-mac.outputs.conclusion }}
123+
CLI_LINUX_STATUS: ${{ steps.cli-linux.outputs.conclusion }}
110124
run: |
111-
echo "Static Analysis Status: ${{ steps.static-analysis.conclusion }}"
112-
echo "Unit Test Status: ${{ steps.unit.outputs.conclusion }}"
113-
echo "Integration Test Status: ${{ steps.integration.outputs.conclusion }}"
114-
echo "Quality Test Status: ${{ steps.quality_tests.outputs.conclusion }}"
115-
echo "Acceptance Test (Linux) Status: ${{ steps.acceptance-linux.outputs.conclusion }}"
116-
echo "Acceptance Test (Mac) Status: ${{ steps.acceptance-mac.outputs.conclusion }}"
117-
echo "CLI Test (Linux) Status: ${{ steps.cli-linux.outputs.conclusion }}"
125+
echo "Static Analysis Status: $STATIC_ANALYSIS_STATUS"
126+
echo "Unit Test Status: $UNIT_TEST_STATUS"
127+
echo "Integration Test Status: $INTEGRATION_TEST_STATUS"
128+
echo "Quality Test Status: $QUALITY_TEST_STATUS"
129+
echo "Acceptance Test (Linux) Status: $ACCEPTANCE_LINUX_STATUS"
130+
echo "Acceptance Test (Mac) Status: $ACCEPTANCE_MAC_STATUS"
131+
echo "CLI Test (Linux) Status: $CLI_LINUX_STATUS"
118132
false
119133
120134
# only release core assets within the "release" job. Any other assets not already under the purview of the
@@ -133,6 +147,7 @@ jobs:
133147
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
134148
with:
135149
fetch-depth: 0
150+
persist-credentials: false
136151

137152
- name: Bootstrap environment
138153
uses: ./.github/actions/bootstrap
@@ -157,9 +172,10 @@ jobs:
157172
run: |
158173
git config user.name "anchoreci"
159174
git config user.email "[email protected]"
160-
git tag -a ${{ github.event.inputs.version }} -m "Release ${{ github.event.inputs.version }}"
175+
git tag -a "$VERSION" -m "Release $VERSION"
161176
git push origin --tags
162177
env:
178+
VERSION: ${{ github.event.inputs.version }}
163179
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
164180

165181
- name: Build & publish release artifacts
@@ -197,4 +213,6 @@ jobs:
197213
uses: ./.github/workflows/release-version-file.yaml
198214
with:
199215
version: ${{ github.event.inputs.version }}
200-
secrets: inherit
216+
secrets:
217+
TOOLBOX_AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
218+
TOOLBOX_AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}

‎.github/workflows/remove-awaiting-response-label.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66

77
jobs:
88
run:
9+
permissions:
10+
issues: write
11+
pull-requests: write
912
uses: "anchore/workflows/.github/workflows/remove-awaiting-response-label.yaml@main"
1013
secrets:
1114
token: ${{ secrets.OSS_PROJECT_GH_TOKEN }}

‎.github/workflows/update-anchore-dependencies.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ jobs:
1616
if: github.repository_owner == 'anchore' # only run for main repo (not forks)
1717
steps:
1818
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
19+
with:
20+
persist-credentials: false
1921

2022
- name: Bootstrap environment
2123
uses: ./.github/actions/bootstrap

‎.github/workflows/update-bootstrap-tools.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ jobs:
1414
if: github.repository == 'anchore/grype' # only run for main repo
1515
steps:
1616
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
17+
with:
18+
persist-credentials: false
1719

1820
- name: Bootstrap environment
1921
uses: ./.github/actions/bootstrap

‎.github/workflows/update-quality-gate-db.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ jobs:
1414
if: github.repository == 'anchore/grype' # only run for main repo
1515
steps:
1616
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
17+
with:
18+
persist-credentials: false
1719

1820
- name: "Update quality DB"
1921
run: |

‎.github/workflows/validate-github-actions.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: "Validate GitHub Actions"
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- '.github/workflows/**'
7+
- '.github/actions/**'
8+
push:
9+
branches:
10+
- main
11+
paths:
12+
- '.github/workflows/**'
13+
- '.github/actions/**'
14+
15+
permissions:
16+
contents: read
17+
18+
jobs:
19+
zizmor:
20+
name: "Lint"
21+
runs-on: ubuntu-latest
22+
permissions:
23+
contents: read
24+
security-events: write # for uploading SARIF results
25+
steps:
26+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
27+
with:
28+
persist-credentials: false
29+
30+
- name: "Run zizmor"
31+
uses: zizmorcore/zizmor-action@f52a838cfabf134edcbaa7c8b3677dde20045018 # v0.1.1
32+
with:
33+
config-file: .github/zizmor.yml
34+
sarif-upload: true
35+
inputs: .github

‎.github/workflows/validations.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ jobs:
1717
runs-on: ubuntu-24.04
1818
steps:
1919
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
20+
with:
21+
persist-credentials: false
2022

2123
- name: Bootstrap environment
2224
uses: ./.github/actions/bootstrap
@@ -30,6 +32,8 @@ jobs:
3032
runs-on: ubuntu-24.04
3133
steps:
3234
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
35+
with:
36+
persist-credentials: false
3337

3438
- name: Bootstrap environment
3539
uses: ./.github/actions/bootstrap
@@ -45,6 +49,7 @@ jobs:
4549
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4650
with:
4751
submodules: true
52+
persist-credentials: false
4853

4954
- name: Bootstrap environment
5055
uses: ./.github/actions/bootstrap
@@ -98,6 +103,8 @@ jobs:
98103
runs-on: ubuntu-24.04
99104
steps:
100105
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
106+
with:
107+
persist-credentials: false
101108

102109
- name: Bootstrap environment
103110
uses: ./.github/actions/bootstrap
@@ -116,6 +123,8 @@ jobs:
116123
runs-on: ubuntu-24.04
117124
steps:
118125
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
126+
with:
127+
persist-credentials: false
119128

120129
- name: Bootstrap environment
121130
uses: ./.github/actions/bootstrap
@@ -145,6 +154,8 @@ jobs:
145154
runs-on: ubuntu-24.04
146155
steps:
147156
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
157+
with:
158+
persist-credentials: false
148159

149160
- name: Download snapshot build
150161
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
@@ -186,6 +197,8 @@ jobs:
186197
runs-on: ubuntu-24.04
187198
steps:
188199
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
200+
with:
201+
persist-credentials: false
189202

190203
- name: Download snapshot build
191204
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
@@ -221,6 +234,8 @@ jobs:
221234
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac #v3.9.1
222235

223236
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
237+
with:
238+
persist-credentials: false
224239

225240
- name: Download snapshot build
226241
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
@@ -246,6 +261,8 @@ jobs:
246261
runs-on: ubuntu-24.04
247262
steps:
248263
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
264+
with:
265+
persist-credentials: false
249266

250267
- name: Bootstrap environment
251268
uses: ./.github/actions/bootstrap
@@ -278,6 +295,8 @@ jobs:
278295
- Upload-Snapshot-Artifacts
279296
steps:
280297
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
298+
with:
299+
persist-credentials: false
281300

282301
- name: Delete snapshot cache
283302
run: gh cache delete "snapshot-build-${{ github.run_id }}" || echo "Cache deletion failed or cache not found - continuing"

‎.github/zizmor.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Zizmor configuration file for suppressing false positives
2+
3+
rules:
4+
unpinned-uses:
5+
ignore:
6+
# anchore/workflows is an internal repository with controlled access
7+
# Always use latest version from main branch for internal workflows
8+
- update-anchore-dependencies.yml

0 commit comments

Comments
 (0)