ITQ/submariner-charts
1
0
Fork 0
mirror of https://github.com/submariner-io/submariner-charts.git synced 2026-09-21 19:40:35 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Use SHAs for GHA versions

Browse Source 
Per GitHub's security guidelines, GHAs should be pinned using full
length commit SHAs instead of tags.

The SHAs are of the commits currently resolved by the versions.

Even "trusted" GHAs from GitHub developers are pinned because it's
possible their repo rights could be compromised and a malicious GHA
published. These core repos are not frequently substantially updated.

Submariner-internal GHAs are left pinned at devel because we want
automatic updates from Shipyard's shared tooling.

Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
This commit is contained in:
Daniel Farrell
2021-08-24 08:18:22 -04:00
committed by Thomas Pantelis
parent 50489802e2
commit eea398da4e
6 changed files with 20 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/e2e-full.yml
+1 -1
View File
@@ -24,7 +24,7 @@ jobs:
- k8s_version: '1.20' - k8s_version: '1.20'
steps: steps:
- name: Check out the repository - name: Check out the repository
uses: actions/checkout@v2 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
- name: Run E2E deployment and tests - name: Run E2E deployment and tests
uses: submariner-io/shipyard/gh-actions/e2e@devel uses: submariner-io/shipyard/gh-actions/e2e@devel
.github/workflows/e2e.yml
+1 -1
View File
@@ -11,7 +11,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out the repository - name: Check out the repository
uses: actions/checkout@v2 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
- name: Run E2E deployment and tests - name: Run E2E deployment and tests
uses: submariner-io/shipyard/gh-actions/e2e@devel uses: submariner-io/shipyard/gh-actions/e2e@devel
.github/workflows/flake_finder.yml
+1 -1
View File
@@ -19,7 +19,7 @@ jobs:
lighthouse: ['', 'lighthouse'] lighthouse: ['', 'lighthouse']
steps: steps:
- name: Check out the repository - name: Check out the repository
uses: actions/checkout@v2 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
- name: Run E2E deployment and tests - name: Run E2E deployment and tests
uses: submariner-io/shipyard/gh-actions/e2e@devel uses: submariner-io/shipyard/gh-actions/e2e@devel
.github/workflows/linting.yml
+13 -13
View File
@@ -11,12 +11,12 @@ jobs:
steps: steps:
- name: Get PR commits - name: Get PR commits
id: 'get-pr-commits' id: 'get-pr-commits'
uses: tim-actions/get-pr-commits@v1.1.0 uses: tim-actions/get-pr-commits@55b867b9b28954e6f5c1a0fe2f729dc926c306d0
with: with:
token: ${{ secrets.GITHUB_TOKEN }} token: ${{ secrets.GITHUB_TOKEN }}
- name: 'Verify no "Apply suggestions from code review" commits' - name: 'Verify no "Apply suggestions from code review" commits'
uses: tim-actions/commit-message-checker-with-regex@v0.3.1 uses: tim-actions/commit-message-checker-with-regex@d6d9770051dd6460679d1cab1dcaa8cffc5c2bbd
with: with:
commits: ${{ steps.get-pr-commits.outputs.commits }} commits: ${{ steps.get-pr-commits.outputs.commits }}
pattern: '^(?!.*(apply suggestions from code review))' pattern: '^(?!.*(apply suggestions from code review))'
@@ -28,20 +28,20 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out the repository - name: Check out the repository
uses: actions/checkout@v2 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
- name: Set up Helm - name: Set up Helm
uses: azure/setup-helm@v1 uses: azure/setup-helm@18bc76811624f360dbd7f18c2d4ecb32c7b87bab
with: with:
version: v3.6.0 version: v3.6.0
- name: Set up Python - name: Set up Python
uses: actions/setup-python@v2 uses: actions/setup-python@dc73133d4da04e56a135ae2246682783cc7c7cb6
with: with:
python-version: '3.x' python-version: '3.x'
- name: Set up helm/chart-testing - name: Set up helm/chart-testing
uses: helm/chart-testing-action@v2.1.0 uses: helm/chart-testing-action@5f16c27cf7a4fa9c776ff73734df3909b2b65127
- name: Run helm/chart-testing (lint) - name: Run helm/chart-testing (lint)
run: ct lint --config ct.yaml run: ct lint --config ct.yaml
@@ -51,7 +51,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out the repository - name: Check out the repository
uses: actions/checkout@v2 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
with: with:
fetch-depth: 0 fetch-depth: 0
- name: Run gitlint - name: Run gitlint
@@ -62,7 +62,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out the repository - name: Check out the repository
uses: actions/checkout@v2 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
- name: Run helm-docs and verify docs are up-to-date - name: Run helm-docs and verify docs are up-to-date
run: make helm-docs run: make helm-docs
@@ -72,10 +72,10 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out the repository - name: Check out the repository
uses: actions/checkout@v2 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
- name: Run markdown-link-check - name: Run markdown-link-check
uses: gaurav-nelson/github-action-markdown-link-check@v1 uses: gaurav-nelson/github-action-markdown-link-check@9710f0fec812ce0a3b98bef4c9d842fc1f39d976
with: with:
config-file: ".markdownlinkcheck.json" config-file: ".markdownlinkcheck.json"
check-modified-files-only: "yes" check-modified-files-only: "yes"
@@ -86,7 +86,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out the repository - name: Check out the repository
uses: actions/checkout@v2 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
- name: Run markdownlint - name: Run markdownlint
run: make markdownlint run: make markdownlint
@@ -95,9 +95,9 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out the repository - name: Check out the repository
uses: actions/checkout@v2 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
- name: Run yamllint - name: Run yamllint
uses: ibiqlik/action-yamllint@v1 uses: ibiqlik/action-yamllint@665205c3255fcf157ef8dc9a40d527fe025a4bc8
with: with:
file_or_dir: submariner-k8s-broker/Chart.yaml submariner-k8s-broker/values.yaml submariner-operator/Chart.yaml submariner-operator/values.yaml file_or_dir: submariner-k8s-broker/Chart.yaml submariner-k8s-broker/values.yaml submariner-operator/Chart.yaml submariner-operator/values.yaml
config_file: .yamllint.yml config_file: .yamllint.yml
.github/workflows/periodic.yml
+3 -3
View File
@@ -12,16 +12,16 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out the repository - name: Check out the repository
uses: actions/checkout@v2 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
- name: Run markdown-link-check - name: Run markdown-link-check
uses: gaurav-nelson/github-action-markdown-link-check@v1 uses: gaurav-nelson/github-action-markdown-link-check@9710f0fec812ce0a3b98bef4c9d842fc1f39d976
with: with:
config-file: ".markdownlinkcheck.json" config-file: ".markdownlinkcheck.json"
- name: Raise an Issue to report broken links - name: Raise an Issue to report broken links
if: ${{ failure() }} if: ${{ failure() }}
uses: peter-evans/create-issue-from-file@v2.3.2 uses: peter-evans/create-issue-from-file@a04ce672e3acedb1f8e416b46716ddfd09905326
with: with:
title: Broken link detected by CI title: Broken link detected by CI
content-filepath: .github/ISSUE_TEMPLATE/broken-link.md content-filepath: .github/ISSUE_TEMPLATE/broken-link.md
.github/workflows/release.yml
+1 -1
View File
@@ -13,7 +13,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v2 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
with: with:
fetch-depth: 0 fetch-depth: 0