Skip to content

Commit f657924

Browse files
tesshuflowertesshuflower
committed
chore: pin GitHub Actions to digest SHAs and replace setup-kind
Pin all GitHub Actions to immutable commit SHAs to prevent supply chain issues from moving tags. Replace engineerd/setup-kind with direct `kind create cluster` run steps using the kind binary pre-installed on GitHub-hosted runners. The Kubernetes node image version is now explicit via KUBERNETES_VERSION env variable set to v1.32.2 (same version previously used by kind v0.27.0 by default). Signed-off-by: Tesshu Flower <tflower@redhat.com>
1 parent ee20e44 commit f657924

5 files changed

Lines changed: 27 additions & 32 deletions

File tree

‎.github/workflows/chart-upload.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
runs-on: ubuntu-latest
1717
steps:
1818
- name: checkout code
19-
uses: actions/checkout@v4
19+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2020
with:
2121
fetch-depth: 1
2222
- name: get release version

‎.github/workflows/fossa.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
runs-on: ubuntu-latest
1212
steps:
1313
- name: Checkout Repo
14-
uses: actions/checkout@v3
14+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
1515
- name: Run FOSSA Scan
1616
uses: fossas/fossa-action@v1
1717
with:

‎.github/workflows/go-postsubmit.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,18 +26,18 @@ jobs:
2626
runs-on: ubuntu-latest
2727
steps:
2828
- name: checkout code
29-
uses: actions/checkout@v3
29+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
3030
with:
3131
fetch-depth: 1
3232
path: go/src/github.com/open-cluster-management/cluster-permission
3333
- name: install Go
34-
uses: actions/setup-go@v3
34+
uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
3535
with:
3636
go-version: ${{ env.GO_VERSION }}
3737
- name: test
3838
run: make test
3939
- name: report-coverage
40-
uses: codecov/codecov-action@v4
40+
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
4141
with:
4242
token: ${{ secrets.CODECOV_UPLOAD_TOKEN }}
4343
files: /home/runner/work/cluster-permission/cluster-permission/go/src/github.com/open-cluster-management/cluster-permission/coverage.out
@@ -51,12 +51,12 @@ jobs:
5151
runs-on: ubuntu-latest
5252
steps:
5353
- name: checkout code
54-
uses: actions/checkout@v3
54+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
5555
with:
5656
fetch-depth: 1
5757
path: go/src/github.com/open-cluster-management/cluster-permission
5858
- name: install Go
59-
uses: actions/setup-go@v3
59+
uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
6060
with:
6161
go-version: ${{ env.GO_VERSION }}
6262
- name: install imagebuilder

‎.github/workflows/go-presubmit.yml‎

Lines changed: 16 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ env:
1515
# Common versions
1616
GO_VERSION: '1.25'
1717
GO_REQUIRED_MIN_VERSION: ''
18+
KUBERNETES_VERSION: 'v1.32.2'
1819
GOPATH: '/home/runner/work/cluster-permission/cluster-permission/go'
1920
defaults:
2021
run:
@@ -26,12 +27,12 @@ jobs:
2627
runs-on: ubuntu-latest
2728
steps:
2829
- name: checkout code
29-
uses: actions/checkout@v3
30+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
3031
with:
3132
fetch-depth: 1
3233
path: go/src/github.com/open-cluster-management/cluster-permission
3334
- name: install Go
34-
uses: actions/setup-go@v3
35+
uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
3536
with:
3637
go-version: ${{ env.GO_VERSION }}
3738
- name: pre-build
@@ -44,12 +45,12 @@ jobs:
4445
runs-on: ubuntu-latest
4546
steps:
4647
- name: checkout code
47-
uses: actions/checkout@v3
48+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
4849
with:
4950
fetch-depth: 1
5051
path: go/src/github.com/open-cluster-management/cluster-permission
5152
- name: install Go
52-
uses: actions/setup-go@v3
53+
uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
5354
with:
5455
go-version: ${{ env.GO_VERSION }}
5556
- name: install imagebuilder
@@ -62,18 +63,18 @@ jobs:
6263
runs-on: ubuntu-latest
6364
steps:
6465
- name: checkout code
65-
uses: actions/checkout@v3
66+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
6667
with:
6768
fetch-depth: 1
6869
path: go/src/github.com/open-cluster-management/cluster-permission
6970
- name: install Go
70-
uses: actions/setup-go@v3
71+
uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
7172
with:
7273
go-version: ${{ env.GO_VERSION }}
7374
- name: test
7475
run: make test
7576
- name: report-coverage
76-
uses: codecov/codecov-action@v4
77+
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
7778
with:
7879
token: ${{ secrets.CODECOV_TOKEN }}
7980
files: /home/runner/work/cluster-permission/cluster-permission/go/src/github.com/open-cluster-management/cluster-permission/coverage.out
@@ -89,9 +90,9 @@ jobs:
8990
GO111MODULE: on
9091
steps:
9192
- name: Checkout Source
92-
uses: actions/checkout@v3
93+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
9394
- name: Run Gosec Security Scanner
94-
uses: securego/gosec@master
95+
uses: securego/gosec@caf8857bbd3276599d0176b0528e9712bb0b5bec # master
9596
with:
9697
args: -exclude-generated ./...
9798
env:
@@ -101,28 +102,22 @@ jobs:
101102
runs-on: ubuntu-latest
102103
steps:
103104
- name: checkout code
104-
uses: actions/checkout@v3
105+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
105106
with:
106107
fetch-depth: 1
107108
path: go/src/github.com/open-cluster-management/cluster-permission
108109
- name: install Go
109-
uses: actions/setup-go@v3
110+
uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
110111
with:
111112
go-version: ${{ env.GO_VERSION }}
112113
- name: install imagebuilder
113114
run: go install github.com/openshift/imagebuilder/cmd/imagebuilder@v1.2.3
114115
- name: images
115116
run: make docker-build
116-
- name: setup kind
117-
uses: engineerd/setup-kind@v0.5.0
118-
with:
119-
version: v0.27.0
120-
name: cluster1
121-
- name: setup kind
122-
uses: engineerd/setup-kind@v0.5.0
123-
with:
124-
version: v0.27.0
125-
name: hub
117+
- name: setup kind cluster1
118+
run: kind create cluster --name cluster1 --image kindest/node:${{ env.KUBERNETES_VERSION }} --wait 300s
119+
- name: setup kind hub
120+
run: kind create cluster --name hub --image kindest/node:${{ env.KUBERNETES_VERSION }} --wait 300s
126121
- name: Load image on the nodes of the cluster
127122
run: |
128123
kind load docker-image --name=hub quay.io/open-cluster-management/cluster-permission:latest

‎.github/workflows/go-release.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,11 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: checkout code
20-
uses: actions/checkout@v4
20+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2121
with:
2222
fetch-depth: 1
2323
- name: install Go
24-
uses: actions/setup-go@v5
24+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
2525
with:
2626
go-version: ${{ env.GO_VERSION }}
2727
- name: install imagebuilder
@@ -35,7 +35,7 @@ jobs:
3535
run: |
3636
echo "MAJOR_RELEASE_VERSION=${RELEASE_VERSION%.*}" >> $GITHUB_ENV
3737
- name: setup helm
38-
uses: azure/setup-helm@v4
38+
uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
3939
- name: chart package
4040
run: |
4141
mkdir -p release
@@ -53,7 +53,7 @@ jobs:
5353
echo "- See the [CHANGELOG](https://github.com/open-cluster-management-io/cluster-permission/blob/main/CHANGELOG/CHANGELOG-${MAJOR_RELEASE_VERSION}.md) for more details." >> /home/runner/work/changelog.txt
5454
echo "- The released image is quay.io/open-cluster-management/cluster-permission:$RELEASE_VERSION" >> /home/runner/work/changelog.txt
5555
- name: publish release
56-
uses: softprops/action-gh-release@v2
56+
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
5757
env:
5858
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5959
with:

0 commit comments

Comments
 (0)