Skip to content

Commit 8542fa3

Browse files
davidgamerodavidgamero
committed
ci: pin all GitHub Actions to SHAs and add zizmor security linter
Pin remaining mutable tag references to full commit SHAs with version comments for traceability. Add zizmor as a CI job to enforce SHA pinning and detect SHA-to-version-comment mismatches on every push and PR. Also fix missing @ separator in codeql-analysis.yml analyze action reference.
1 parent 71cd4d8 commit 8542fa3

File tree

5 files changed

+74
-61
lines changed

5 files changed

+74
-61
lines changed

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,15 +38,15 @@ jobs:
3838

3939
steps:
4040
- name: Checkout repository
41-
uses: actions/checkout@v6.0.2
41+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4242

4343
# Initializes the CodeQL tools for scanning.
4444
- name: Initialize CodeQL
45-
uses: github/codeql-action/init@v4
45+
uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
4646
with:
4747
languages: ${{ matrix.language }}
4848

4949
- name: Autobuild
50-
uses: github/codeql-action/autobuild@v4
50+
uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
5151
- name: Perform CodeQL Analysis
52-
uses: github/codeql-action/analyze@v4
52+
uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1

‎.github/workflows/deploy-docs.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ jobs:
88
runs-on: ubuntu-latest
99
steps:
1010
- name: Checkout
11-
uses: actions/checkout@v6.0.2
11+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1212
- name: Setup Node.js
13-
uses: actions/setup-node@v6
13+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
1414
with:
1515
node-version: '20'
1616
# Pre-check to validate that versions match between package.json
@@ -23,7 +23,7 @@ jobs:
2323
run: npm run docs
2424

2525
- name: Deploy docs
26-
uses: JamesIves/github-pages-deploy-action@v4.8.0
26+
uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
2727
with:
2828
branch: gh-pages # The branch the action should deploy to.
2929
folder: docs # The folder the action should deploy.

‎.github/workflows/generate-javascript.yml‎

Lines changed: 49 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,56 @@
11
name: Generate
22

33
on:
4-
workflow_dispatch:
5-
inputs:
6-
kubernetesBranch:
7-
type: string
8-
required: true
9-
description: 'The remote kubernetes release branch to fetch openapi spec. .e.g. "release-1.23"'
10-
genCommit:
11-
type: string
12-
required: true
13-
default: 'b461333bb57fa2dc2152f939ed70bac3cef2c1f6'
14-
description: 'The commit to use for the kubernetes-client/gen repo'
4+
workflow_dispatch:
5+
inputs:
6+
kubernetesBranch:
7+
type: string
8+
required: true
9+
description: 'The remote kubernetes release branch to fetch openapi spec. .e.g. "release-1.23"'
10+
genCommit:
11+
type: string
12+
required: true
13+
default: 'b461333bb57fa2dc2152f939ed70bac3cef2c1f6'
14+
description: 'The commit to use for the kubernetes-client/gen repo'
1515

1616
permissions:
17-
contents: write
18-
pull-requests: write
17+
contents: write
18+
pull-requests: write
1919

2020
jobs:
21-
generate:
22-
runs-on: ubuntu-latest
23-
steps:
24-
- name: Checkout Javascript
25-
uses: actions/checkout@v6.0.2
26-
- name: Setup Node
27-
uses: actions/setup-node@v6
28-
with:
29-
node-version: '20'
30-
- name: Generate Openapi
31-
run: |
32-
echo "export KUBERNETES_BRANCH=${{ github.event.inputs.kubernetesBranch }}" >> ./settings
33-
echo "export GEN_COMMIT=${{ github.event.inputs.genCommit }}" >> ./settings
34-
./generate-client.sh
35-
- name: Generate Branch Name
36-
run: |
37-
SUFFIX=$(openssl rand -hex 4)
38-
echo "BRANCH=automated-generate-$SUFFIX" >> $GITHUB_ENV
39-
- name: Commit and push
40-
run: |
41-
# Commit and push
42-
git config user.email "k8s.ci.robot@gmail.com"
43-
git config user.name "Kubernetes Prow Robot"
44-
git checkout -b "$BRANCH"
45-
git add .
46-
# we modify the settings file in "Generate Openapi" but do not want to commit this
47-
git reset settings
48-
git commit -s -m 'Automated openapi generation from ${{ github.event.inputs.kubernetesBranch }}'
49-
git push origin "$BRANCH"
50-
- name: Pull Request
51-
uses: repo-sync/pull-request@v2
52-
with:
53-
source_branch: ${{ env.BRANCH }}
54-
destination_branch: ${{ github.ref_name }}
55-
github_token: ${{ secrets.GITHUB_TOKEN }}
56-
pr_title: "Automated Generate from openapi ${{ github.event.inputs.kubernetesBranch }}"
21+
generate:
22+
runs-on: ubuntu-latest
23+
steps:
24+
- name: Checkout Javascript
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
26+
- name: Setup Node
27+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
28+
with:
29+
node-version: '20'
30+
- name: Generate Openapi
31+
run: |
32+
echo "export KUBERNETES_BRANCH=${{ github.event.inputs.kubernetesBranch }}" >> ./settings
33+
echo "export GEN_COMMIT=${{ github.event.inputs.genCommit }}" >> ./settings
34+
./generate-client.sh
35+
- name: Generate Branch Name
36+
run: |
37+
SUFFIX=$(openssl rand -hex 4)
38+
echo "BRANCH=automated-generate-$SUFFIX" >> $GITHUB_ENV
39+
- name: Commit and push
40+
run: |
41+
# Commit and push
42+
git config user.email "k8s.ci.robot@gmail.com"
43+
git config user.name "Kubernetes Prow Robot"
44+
git checkout -b "$BRANCH"
45+
git add .
46+
# we modify the settings file in "Generate Openapi" but do not want to commit this
47+
git reset settings
48+
git commit -s -m 'Automated openapi generation from ${{ github.event.inputs.kubernetesBranch }}'
49+
git push origin "$BRANCH"
50+
- name: Pull Request
51+
uses: repo-sync/pull-request@7e79a9f5dc3ad0ce53138f01df2fad14a04831c5 # v2.12.1
52+
with:
53+
source_branch: ${{ env.BRANCH }}
54+
destination_branch: ${{ github.ref_name }}
55+
github_token: ${{ secrets.GITHUB_TOKEN }}
56+
pr_title: 'Automated Generate from openapi ${{ github.event.inputs.kubernetesBranch }}'

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,9 @@ jobs:
3434
environment: production
3535
steps:
3636
- name: Checkout Javascript
37-
uses: actions/checkout@v6.0.2
37+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3838
- name: Setup Node
39-
uses: actions/setup-node@v6
39+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
4040
with:
4141
node-version: '25'
4242
registry-url: 'https://registry.npmjs.org'

‎.github/workflows/test.yml‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ jobs:
1414
node: ['25', '24', '23', '22', '20', '18']
1515
name: Node ${{ matrix.node }} validation
1616
steps:
17-
- uses: actions/checkout@v6.0.2
18-
- uses: actions/setup-node@v6
17+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
18+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
1919
with:
2020
node-version: ${{ matrix.node }}
2121
# Pre-check to validate that versions match between package.json
@@ -33,5 +33,18 @@ jobs:
3333
- run: npm audit --audit-level=critical
3434
- run: npm run build-with-tests && npm run test-transpiled
3535
- name: Create k8s Kind Cluster
36-
uses: helm/kind-action@v1
36+
uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
3737
- run: npm run integration-test
38+
zizmor:
39+
runs-on: ubuntu-latest
40+
name: GitHub Actions security lint
41+
permissions:
42+
contents: read
43+
steps:
44+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
45+
with:
46+
persist-credentials: false
47+
- uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
48+
with:
49+
advanced-security: false
50+
persona: pedantic

0 commit comments

Comments
 (0)