Skip to content

Commit b653816

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #2814 from davidgamero/pin-actions-to-sha
pin actions to sha
2 parents 71cd4d8 + 0f3b041 commit b653816

File tree

6 files changed

+131
-72
lines changed

6 files changed

+131
-72
lines changed

‎.github/dependabot.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,21 @@ updates:
55
schedule:
66
interval: 'daily'
77
time: '02:00'
8+
cooldown:
9+
default-days: 7
810
target-branch: 'main'
911
- package-ecosystem: 'github-actions'
1012
directory: '/'
1113
schedule:
1214
interval: 'daily'
1315
time: '03:00'
16+
cooldown:
17+
default-days: 7
1418
target-branch: 'main'
1519
- package-ecosystem: 'devcontainers'
1620
directory: '/'
1721
schedule:
1822
interval: 'weekly'
23+
cooldown:
24+
default-days: 7
1925
target-branch: 'main'

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,16 @@ on:
2121
schedule:
2222
- cron: '35 14 * * 3'
2323

24-
permissions:
25-
actions: read
26-
contents: read
27-
security-events: write
24+
permissions: {}
2825

2926
jobs:
3027
analyze:
3128
name: Analyze
3229
runs-on: ubuntu-latest
30+
permissions:
31+
actions: read
32+
contents: read
33+
security-events: write
3334

3435
strategy:
3536
fail-fast: false
@@ -38,15 +39,17 @@ jobs:
3839

3940
steps:
4041
- name: Checkout repository
41-
uses: actions/checkout@v6.0.2
42+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
43+
with:
44+
persist-credentials: false
4245

4346
# Initializes the CodeQL tools for scanning.
4447
- name: Initialize CodeQL
45-
uses: github/codeql-action/init@v4
48+
uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
4649
with:
4750
languages: ${{ matrix.language }}
4851

4952
- name: Autobuild
50-
uses: github/codeql-action/autobuild@v4
53+
uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
5154
- name: Perform CodeQL Analysis
52-
uses: github/codeql-action/analyze@v4
55+
uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1

‎.github/workflows/deploy-docs.yml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,21 @@ on:
33
push:
44
branches:
55
- main
6+
7+
permissions: {}
8+
69
jobs:
710
build-and-deploy-docs:
811
runs-on: ubuntu-latest
12+
permissions:
13+
contents: write
914
steps:
1015
- name: Checkout
11-
uses: actions/checkout@v6.0.2
16+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
17+
with:
18+
persist-credentials: false
1219
- name: Setup Node.js
13-
uses: actions/setup-node@v6
20+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
1421
with:
1522
node-version: '20'
1623
# Pre-check to validate that versions match between package.json
@@ -23,7 +30,7 @@ jobs:
2330
run: npm run docs
2431

2532
- name: Deploy docs
26-
uses: JamesIves/github-pages-deploy-action@v4.8.0
33+
uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
2734
with:
2835
branch: gh-pages # The branch the action should deploy to.
2936
folder: docs # The folder the action should deploy.

‎.github/workflows/generate-javascript.yml‎

Lines changed: 64 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,70 @@
11
name: Generate
22

33
on:
4-
workflow_dispatch:
5-
inputs:
6-
kubernetesBranch:
7-
type: string
8-
required: true
9-
description: 'The remote kubernetes release branch to fetch openapi spec. .e.g. "release-1.23"'
10-
genCommit:
11-
type: string
12-
required: true
13-
default: 'b461333bb57fa2dc2152f939ed70bac3cef2c1f6'
14-
description: 'The commit to use for the kubernetes-client/gen repo'
4+
workflow_dispatch:
5+
inputs:
6+
kubernetesBranch:
7+
type: string
8+
required: true
9+
description: 'The remote kubernetes release branch to fetch openapi spec. .e.g. "release-1.23"'
10+
genCommit:
11+
type: string
12+
required: true
13+
default: 'b461333bb57fa2dc2152f939ed70bac3cef2c1f6'
14+
description: 'The commit to use for the kubernetes-client/gen repo'
1515

16-
permissions:
17-
contents: write
18-
pull-requests: write
16+
permissions: {}
1917

2018
jobs:
21-
generate:
22-
runs-on: ubuntu-latest
23-
steps:
24-
- name: Checkout Javascript
25-
uses: actions/checkout@v6.0.2
26-
- name: Setup Node
27-
uses: actions/setup-node@v6
28-
with:
29-
node-version: '20'
30-
- name: Generate Openapi
31-
run: |
32-
echo "export KUBERNETES_BRANCH=${{ github.event.inputs.kubernetesBranch }}" >> ./settings
33-
echo "export GEN_COMMIT=${{ github.event.inputs.genCommit }}" >> ./settings
34-
./generate-client.sh
35-
- name: Generate Branch Name
36-
run: |
37-
SUFFIX=$(openssl rand -hex 4)
38-
echo "BRANCH=automated-generate-$SUFFIX" >> $GITHUB_ENV
39-
- name: Commit and push
40-
run: |
41-
# Commit and push
42-
git config user.email "k8s.ci.robot@gmail.com"
43-
git config user.name "Kubernetes Prow Robot"
44-
git checkout -b "$BRANCH"
45-
git add .
46-
# we modify the settings file in "Generate Openapi" but do not want to commit this
47-
git reset settings
48-
git commit -s -m 'Automated openapi generation from ${{ github.event.inputs.kubernetesBranch }}'
49-
git push origin "$BRANCH"
50-
- name: Pull Request
51-
uses: repo-sync/pull-request@v2
52-
with:
53-
source_branch: ${{ env.BRANCH }}
54-
destination_branch: ${{ github.ref_name }}
55-
github_token: ${{ secrets.GITHUB_TOKEN }}
56-
pr_title: "Automated Generate from openapi ${{ github.event.inputs.kubernetesBranch }}"
19+
generate:
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: write # Push generated branch
23+
pull-requests: write # Create PR via gh CLI
24+
steps:
25+
- name: Checkout Javascript
26+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
27+
with:
28+
persist-credentials: false
29+
- name: Setup Node
30+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
31+
with:
32+
node-version: '20'
33+
- name: Generate Openapi
34+
run: |
35+
echo "export KUBERNETES_BRANCH=${KUBERNETES_BRANCH}" >> ./settings
36+
echo "export GEN_COMMIT=${GEN_COMMIT}" >> ./settings
37+
./generate-client.sh
38+
env:
39+
KUBERNETES_BRANCH: ${{ github.event.inputs.kubernetesBranch }}
40+
GEN_COMMIT: ${{ github.event.inputs.genCommit }}
41+
- name: Generate Branch Name
42+
run: |
43+
SUFFIX=$(openssl rand -hex 4)
44+
echo "BRANCH=automated-generate-$SUFFIX" >> $GITHUB_ENV
45+
- name: Commit and push
46+
run: |
47+
# Commit and push
48+
git config user.email "k8s.ci.robot@gmail.com"
49+
git config user.name "Kubernetes Prow Robot"
50+
git checkout -b "$BRANCH"
51+
git add .
52+
# we modify the settings file in "Generate Openapi" but do not want to commit this
53+
git reset settings
54+
git commit -s -m "Automated openapi generation from ${KUBERNETES_BRANCH}"
55+
git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
56+
git push origin "$BRANCH"
57+
env:
58+
KUBERNETES_BRANCH: ${{ github.event.inputs.kubernetesBranch }}
59+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
60+
- name: Create Pull Request
61+
run: |
62+
gh pr create \
63+
--base "${BASE_BRANCH}" \
64+
--head "$BRANCH" \
65+
--title "Automated Generate from openapi ${KUBERNETES_BRANCH}" \
66+
--body "Automated openapi generation from ${KUBERNETES_BRANCH}"
67+
env:
68+
KUBERNETES_BRANCH: ${{ github.event.inputs.kubernetesBranch }}
69+
BASE_BRANCH: ${{ github.ref_name }}
70+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release.yml‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
name: Release
22

3-
permissions:
4-
contents: write
5-
actions: write
6-
id-token: write
3+
permissions: {}
74

85
on:
96
workflow_dispatch:
@@ -32,11 +29,17 @@ jobs:
3229
release:
3330
runs-on: ubuntu-latest
3431
environment: production
32+
permissions:
33+
contents: write # Push tags to the repository
34+
actions: write # Trigger downstream workflows
35+
id-token: write # npm provenance via OIDC
3536
steps:
3637
- name: Checkout Javascript
37-
uses: actions/checkout@v6.0.2
38+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
39+
with:
40+
persist-credentials: false
3841
- name: Setup Node
39-
uses: actions/setup-node@v6
42+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
4043
with:
4144
node-version: '25'
4245
registry-url: 'https://registry.npmjs.org'
@@ -55,8 +58,14 @@ jobs:
5558
run: |
5659
git config --global user.name 'Github Bot'
5760
git config --global user.email '<>'
58-
git tag ${{ github.event.inputs.releaseVersion }}
61+
git tag "${RELEASE_VERSION}"
62+
env:
63+
RELEASE_VERSION: ${{ github.event.inputs.releaseVersion }}
5964
- name: Push tag
6065
if: ${{ github.event.inputs.dry_run != 'true' }}
6166
run: |
62-
git push origin ${{ github.event.inputs.releaseVersion }}
67+
git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
68+
git push origin "${RELEASE_VERSION}"
69+
env:
70+
RELEASE_VERSION: ${{ github.event.inputs.releaseVersion }}
71+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/test.yml‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,22 @@ on:
66
pull_request:
77
branches: [master, main]
88

9+
permissions: {}
10+
911
jobs:
1012
build:
1113
runs-on: ubuntu-latest
14+
permissions:
15+
contents: read
1216
strategy:
1317
matrix:
1418
node: ['25', '24', '23', '22', '20', '18']
1519
name: Node ${{ matrix.node }} validation
1620
steps:
17-
- uses: actions/checkout@v6.0.2
18-
- uses: actions/setup-node@v6
21+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
persist-credentials: false
24+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
1925
with:
2026
node-version: ${{ matrix.node }}
2127
# Pre-check to validate that versions match between package.json
@@ -33,5 +39,19 @@ jobs:
3339
- run: npm audit --audit-level=critical
3440
- run: npm run build-with-tests && npm run test-transpiled
3541
- name: Create k8s Kind Cluster
36-
uses: helm/kind-action@v1
42+
uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
3743
- run: npm run integration-test
44+
zizmor:
45+
runs-on: ubuntu-latest
46+
name: GitHub Actions security lint
47+
permissions:
48+
contents: read
49+
steps:
50+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
51+
with:
52+
persist-credentials: false
53+
- uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
54+
with:
55+
advanced-security: false
56+
persona: pedantic
57+
min-severity: medium

0 commit comments

Comments
 (0)