Auto generated from templates by gromit

Author: Gromit

.github/workflows/drift-check.yml

@@ -0,0 +1,9 @@
+# Generated by: gromit policy
+# This file is managed by gromit, do not edit by hand.
+# The check logic lives in TykTechnologies/github-actions.
+name: Drift Check
+on:
+  pull_request:
+jobs:
+  drift:
+    uses: TykTechnologies/github-actions/.github/workflows/drift-check.yml@production

.github/workflows/release.yml

@@ -0,0 +1,26 @@
+# Generated by: gromit policy
+# This file is managed by gromit, do not edit by hand.
+name: zizmor
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  push:
+    branches:
+      - release-5.8.15
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  workflow_dispatch:
+permissions: {}
+jobs:
+  zizmor:
+    uses: TykTechnologies/github-actions/.github/workflows/zizmor.yml@production
+    with:
+      upload_sarif: true
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+      pull-requests: write

.github/workflows/zizmor.yml

@@ -0,0 +1,10 @@
+# Generated by: gromit policy
+# This file is managed by gromit, do not edit by hand.
+# zizmor configuration (https://docs.zizmor.sh/configuration/)
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # First-party refs use mutable tags (production/main) by design.
+        "TykTechnologies/*": ref-pin
+        "*": hash-pin

.github/zizmor.yml

@@ -11,7 +11,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 # The _ after the pkg name is to match tyk-gateway strictly and not tyk-gateway-fips (for example)
 COPY ${BUILD_PACKAGE_NAME}_*${TARGETARCH}.deb /
 ARG NONROOT_CHOWN=false
-RUN dpkg -i /${BUILD_PACKAGE_NAME}_*${TARGETARCH}.deb && rm /*.deb \
+RUN dpkg -i /"${BUILD_PACKAGE_NAME}"_*"${TARGETARCH}".deb && rm /*.deb \
     && chmod -R a+rX /opt/tyk-gateway/ \
     && mkdir -p /opt/tyk-gateway/middleware/bundles \
     && chmod a+rwX /opt/tyk-gateway/middleware /opt/tyk-gateway/middleware/bundles \

ci/Dockerfile.distroless

@@ -15,7 +15,7 @@ RUN rm -fv /usr/bin/passwd /usr/sbin/adduser || true
 
 # Comment this to test in dev
 COPY dist/${BUILD_PACKAGE_NAME}_*_${TARGETARCH}.deb /
-RUN dpkg -i /${BUILD_PACKAGE_NAME}_*_${TARGETARCH}.deb && find / -maxdepth 1 -name "*.deb" -delete
+RUN dpkg -i /"${BUILD_PACKAGE_NAME}"_*_"${TARGETARCH}".deb && find / -maxdepth 1 -name "*.deb" -delete
 
 # Clean up caches, unwanted .a and .o files
 RUN rm -rf /root/.cache \