Skip to content

Commit 23cabf1

Browse files
metsmametsma
committed
Harden GitHub Actions
WE2-1250 Signed-off-by: Raul Metsma <raul@metsma.ee>
1 parent 9fbc925 commit 23cabf1

11 files changed

Lines changed: 135 additions & 85 deletions

‎.github/dependabot.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: weekly

‎.github/vcpkg-triplets/arm64-x64-osx.cmake‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
set(VCPKG_TARGET_ARCHITECTURE arm64 x86_64)
2+
set(VCPKG_CRT_LINKAGE dynamic)
3+
set(VCPKG_LIBRARY_LINKAGE static)
4+
set(VCPKG_BUILD_TYPE release)
5+
6+
set(VCPKG_CMAKE_SYSTEM_NAME Darwin)
7+
set(VCPKG_OSX_ARCHITECTURES arm64 x86_64)
8+
set(VCPKG_OSX_DEPLOYMENT_TARGET 14.0)

‎.github/workflows/cmake-linux-codeql.yml‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,39 +7,48 @@ on:
77
# The branches below must be a subset of the branches above
88
branches: [ main ]
99

10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
1014
jobs:
1115
analyze:
1216
name: Run CodeQL tests
1317
runs-on: ubuntu-latest
18+
timeout-minutes: 120
19+
permissions:
20+
actions: read
21+
contents: read
22+
security-events: write
1423

1524
steps:
1625
- name: Install dependencies
1726
run: sudo apt update -qq && sudo apt install --no-install-recommends -y cmake libpcsclite-dev libgtest-dev libgl-dev libqt6svg6-dev qt6-tools-dev qt6-tools-dev-tools qt6-l10n-tools
1827

19-
- uses: actions/checkout@v6
28+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2029
with:
2130
submodules: recursive
2231
persist-credentials: false
2332

24-
- uses: github/codeql-action/init@v4
33+
- uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
2534
with:
2635
languages: cpp
2736
queries: +security-and-quality
2837

29-
- uses: github/codeql-action/autobuild@v4
38+
- uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
3039

31-
- uses: github/codeql-action/analyze@v4
40+
- uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
3241
with:
3342
upload: False
3443
output: sarif-results
3544

36-
- uses: advanced-security/filter-sarif@v1
45+
- uses: advanced-security/filter-sarif@2da736ff05ef065cb2894ac6892e47b5eac2c3c0 # v1.1
3746
with:
3847
patterns: |
3948
-**/*autogen*/**
4049
input: sarif-results/cpp.sarif
4150
output: sarif-results/cpp.sarif
4251

43-
- uses: github/codeql-action/upload-sarif@v4
52+
- uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
4453
with:
4554
sarif_file: sarif-results/cpp.sarif

‎.github/workflows/cmake-linux-coverity.yml‎

Lines changed: 36 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,16 @@ name: Coverity code analysis
33
on:
44
push:
55
branches: [ coverity_scan ]
6-
pull_request:
7-
# The branches below must be a subset of the branches above
8-
branches: [ coverity_scan ]
6+
7+
permissions:
8+
contents: read
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
913

1014
env:
1115
BUILD_TYPE: RelWithDebInfo
12-
TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
1316
PROJECTNAME: web-eid/web-eid-app
1417
CMAKE_BUILD_PARALLEL_LEVEL: 3
1518

@@ -18,12 +21,13 @@ jobs:
1821
name: Run Coverity tests
1922
if: github.repository == 'web-eid/web-eid-app'
2023
runs-on: ubuntu-latest
24+
timeout-minutes: 120
2125

2226
steps:
2327
- name: Install dependencies
2428
run: sudo apt update -qq && sudo apt install --no-install-recommends -y cmake libpcsclite-dev libgtest-dev libgl-dev libqt6svg6-dev qt6-tools-dev qt6-tools-dev-tools qt6-l10n-tools
2529

26-
- uses: actions/checkout@v6
30+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2731
with:
2832
submodules: recursive
2933
persist-credentials: false
@@ -33,25 +37,39 @@ jobs:
3337

3438
- name: Download Coverity Build Tool
3539
working-directory: ${{github.workspace}}/build
40+
env:
41+
TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
3642
run: |
37-
curl --silent --data "token=$TOKEN&project=$PROJECTNAME" -o cov-analysis-linux64.tar.gz https://scan.coverity.com/download/cxx/linux64
38-
mkdir cov-analysis-linux64
39-
tar xzf cov-analysis-linux64.tar.gz --strip 1 -C cov-analysis-linux64
43+
curl --fail-with-body --show-error --silent --location \
44+
--proto '=https' \
45+
--proto-redir '=https' \
46+
--retry 3 \
47+
--data-urlencode "token=$TOKEN" \
48+
--data-urlencode "project=$PROJECTNAME" \
49+
--output cov-analysis-linux64.tar.gz \
50+
https://scan.coverity.com/download/cxx/linux64
4051
4152
- name: Build
53+
working-directory: ${{github.workspace}}/build
4254
run: |
43-
export PATH=$PWD/build/cov-analysis-linux64/bin:$PATH
44-
cov-build --dir build/cov-int cmake --build build --config $BUILD_TYPE
55+
mkdir cov-analysis-linux64
56+
tar xzf cov-analysis-linux64.tar.gz --strip 1 -C cov-analysis-linux64
57+
export PATH=$PWD/cov-analysis-linux64/bin:$PATH
58+
cov-build --dir cov-int cmake --build . --config $BUILD_TYPE
59+
tar czvf upload.tgz cov-int
4560
4661
- name: Submit the result to Coverity Scan
4762
working-directory: ${{github.workspace}}/build
63+
env:
64+
TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
4865
run: |
49-
tar czvf upload.tgz cov-int
50-
curl --silent \
51-
--form project=$PROJECTNAME \
52-
--form token=$TOKEN \
53-
--form email=eid-teenusehaldus@ria.ee \
54-
--form file=@upload.tgz \
55-
--form version=master \
56-
--form description="Github Actions CI build" \
66+
curl --fail-with-body --show-error --silent --location \
67+
--proto '=https' \
68+
--proto-redir '=https' \
69+
--form "project=$PROJECTNAME" \
70+
--form "token=$TOKEN" \
71+
--form "email=eid-teenusehaldus@ria.ee" \
72+
--form "file=@upload.tgz" \
73+
--form "version=master" \
74+
--form "description=Github Actions CI build" \
5775
https://scan.coverity.com/builds?project=$PROJECTNAME

‎.github/workflows/cmake-linux-fedora.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@ name: CMake (Fedora Linux)
22

33
on: [push, pull_request]
44

5+
permissions:
6+
contents: read
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
512
env:
613
BUILD_TYPE: RelWithDebInfo
714
BUILD_NUMBER: ${{github.run_number}}
@@ -11,6 +18,7 @@ env:
1118
jobs:
1219
build:
1320
runs-on: ubuntu-latest
21+
timeout-minutes: 120
1422
container: fedora:${{ matrix.container }}
1523
strategy:
1624
matrix:
@@ -20,7 +28,7 @@ jobs:
2028
- name: Install Deps
2129
run: dnf install -y --setopt=install_weak_deps=False git gcc-c++ cmake rpm-build openssl-devel pcsc-lite-devel qt6-qtsvg-devel qt6-qttools-devel gtest-devel
2230

23-
- uses: actions/checkout@v6
31+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2432
with:
2533
submodules: recursive
2634
persist-credentials: false
@@ -31,7 +39,7 @@ jobs:
3139
- name: Build
3240
run: cmake --build build --config $BUILD_TYPE --target package
3341

34-
- uses: actions/upload-artifact@v7
42+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
3543
with:
3644
name: web-eid-app-fedora-build-fedora${{matrix.container}}-${{github.run_number}}
3745
path: build/*rpm

‎.github/workflows/cmake-linux-ubuntu.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@ name: CMake (Ubuntu Linux)
22

33
on: [push, pull_request]
44

5+
permissions:
6+
contents: read
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
512
env:
613
BUILD_TYPE: RelWithDebInfo
714
BUILD_NUMBER: ${{github.run_number}}
@@ -14,6 +21,7 @@ env:
1421
jobs:
1522
build:
1623
runs-on: ubuntu-24.04${{ matrix.arch == 'arm64' && '-arm' || '' }}
24+
timeout-minutes: 120
1725
container: ubuntu:${{matrix.container}}
1826
strategy:
1927
matrix:
@@ -31,7 +39,7 @@ jobs:
3139
echo 'path-exclude=/usr/share/doc-base/*' >> /etc/dpkg/dpkg.cfg.d/99-nodocs
3240
apt update -qq && apt install --no-install-recommends -y git lsb-release fakeroot build-essential devscripts debhelper lintian pkg-config cmake libpcsclite-dev libssl-dev libgtest-dev libgl-dev libqt6svg6-dev qt6-tools-dev qt6-tools-dev-tools qt6-l10n-tools
3341
34-
- uses: actions/checkout@v6
42+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3543
with:
3644
submodules: recursive
3745
persist-credentials: false
@@ -48,7 +56,7 @@ jobs:
4856
- name: Test package
4957
run: lintian build/*.deb
5058

51-
- uses: actions/upload-artifact@v7
59+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
5260
with:
5361
name: web-eid-app-ubuntu-build-ubuntu${{matrix.container}}-${{ matrix.arch }}-${{github.run_number}}
5462
path: build/*.*deb

‎.github/workflows/cmake-macos.yml‎

Lines changed: 28 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -2,87 +2,70 @@ name: CMake (macOS)
22

33
on: [push, pull_request]
44

5+
permissions:
6+
contents: read
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
512
env:
613
BUILD_TYPE: RelWithDebInfo
714
BUILD_DIR: build
815
BUILD_NUMBER: ${{github.run_number}}
9-
OPENSSL_ROOT_DIR: ${{ github.workspace }}/openssl-binary
10-
GTest_ROOT: ${{ github.workspace }}/gtest-binary
1116
QT_QPA_PLATFORM: offscreen
1217
CMAKE_BUILD_PARALLEL_LEVEL: 3
1318
MACOSX_DEPLOYMENT_TARGET: 14.0
1419

1520
jobs:
1621
build:
1722
runs-on: macos-latest
23+
timeout-minutes: 120
1824

1925
steps:
2026
- name: Checkout code
21-
uses: actions/checkout@v6
27+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2228
with:
2329
submodules: recursive
2430
persist-credentials: false
2531

26-
- name: Cache
27-
uses: actions/cache@v5
28-
id: cache
32+
- name: Cache vcpkg
33+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
2934
with:
30-
path: |
31-
${{ env.OPENSSL_ROOT_DIR }}
32-
${{ env.GTest_ROOT }}
33-
key: ${{ runner.os }}-deps
34-
35-
- name: Build GTest
36-
if: steps.cache.outputs.cache-hit != 'true'
37-
run: |
38-
git clone --depth=1 https://github.com/google/googletest.git
39-
cmake -S googletest -B gtest-build \
40-
-DCMAKE_BUILD_TYPE=${BUILD_TYPE} \
41-
-DCMAKE_OSX_ARCHITECTURES="arm64;x86_64" \
42-
-DCMAKE_INSTALL_PREFIX=${GTest_ROOT} \
43-
-DCMAKE_CXX_STANDARD=20
44-
cmake --build gtest-build --target install
45-
46-
- name: Build OpenSSL
47-
if: steps.cache.outputs.cache-hit != 'true'
48-
run: |
49-
git clone --depth=1 https://github.com/openssl/openssl.git -b openssl-3.5
50-
cd openssl
51-
for ARCH in x86_64 arm64; do
52-
./Configure darwin64-${ARCH} --prefix=${OPENSSL_ROOT_DIR} no-apps no-shared no-module no-tests enable-ec_nistp_64_gcc_128
53-
MAKEFLAGS=-j1 make -s install_sw
54-
mv ${OPENSSL_ROOT_DIR}{,.${ARCH}}
55-
make distclean
56-
done
57-
cd -
58-
cp -a ${OPENSSL_ROOT_DIR}{.x86_64,}
59-
cd ${OPENSSL_ROOT_DIR}.arm64
60-
for i in lib/lib*.*; do
61-
lipo -create ${OPENSSL_ROOT_DIR}.x86_64/${i} ${i} -output ${OPENSSL_ROOT_DIR}/${i}
62-
done
63-
cd -
35+
path: ${{ github.workspace }}/vcpkg_cache
36+
key: ${{ runner.os }}-${{ runner.arch }}-vcpkg-${{ hashFiles('lib/libelectronic-id/vcpkg.json', '.github/vcpkg-triplets/arm64-x64-osx.cmake') }}
6437

6538
- name: Install Qt
66-
uses: jurplel/install-qt-action@v4
39+
uses: jurplel/install-qt-action@48d3ad6db93f3627c8ee7a0454bc6f3744f7e730 # v4.3.1
6740
with:
6841
version: 6.10.3
6942
arch: clang_64
7043
cache: true
7144

7245
- name: Configure
73-
run: cmake -DCMAKE_BUILD_TYPE=${BUILD_TYPE} -DCMAKE_OSX_ARCHITECTURES="arm64;x86_64" -B ${BUILD_DIR} -S .
46+
env:
47+
VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg_cache,readwrite
48+
run: |
49+
export VCPKG_ROOT="${VCPKG_INSTALLATION_ROOT}"
50+
cmake -S . -B "${BUILD_DIR}" \
51+
-DCMAKE_BUILD_TYPE="${BUILD_TYPE}" \
52+
-DCMAKE_OSX_ARCHITECTURES="arm64;x86_64" \
53+
-DCMAKE_TOOLCHAIN_FILE="${VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake" \
54+
-DVCPKG_MANIFEST_DIR="${GITHUB_WORKSPACE}/lib/libelectronic-id" \
55+
-DVCPKG_OVERLAY_TRIPLETS="${GITHUB_WORKSPACE}/.github/vcpkg-triplets" \
56+
-DVCPKG_TARGET_TRIPLET=arm64-x64-osx
7457
7558
- name: Build
7659
run: |
7760
cmake --build ${BUILD_DIR} --config ${BUILD_TYPE}
7861
cmake --build ${BUILD_DIR} --config ${BUILD_TYPE} --target installer
7962
cmake --build ${BUILD_DIR} --config ${BUILD_TYPE} --target installer-safari
8063
81-
#- name: Test
82-
# run: ctest -V -C ${BUILD_TYPE} --test-dir ${BUILD_DIR}
64+
- name: Test
65+
run: ctest -V -C ${BUILD_TYPE} --test-dir ${BUILD_DIR}
8366

8467
- name: Upload artifacts
85-
uses: actions/upload-artifact@v7
68+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
8669
with:
8770
name: web-eid-app-macos-build-${{github.run_number}}
8871
path: |

0 commit comments

Comments
 (0)