Skip to content

Commit 7896fab

Browse files
raffisraffis
authored
fix: update deps, go1.22, align ci pipelines (#61)
1 parent 4e66b84 commit 7896fab

19 files changed

+570
-474
lines changed

‎.github/ISSUE_TEMPLATE/VULN-TEMPLATE.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
title: Vulnerabilities detected
3+
labels: security
4+
---
5+
High or critical vulnerabilities detected. Scan results are below:
6+
7+
{{ env.RESULTS }}

‎.github/workflows/main.yaml

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,27 +5,22 @@ on:
55
branches:
66
- master
77

8+
permissions: {}
9+
810
jobs:
911
build:
1012
runs-on: ubuntu-latest
1113
steps:
1214
- name: Harden Runner
13-
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
15+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
1416
with:
15-
egress-policy: audit
17+
egress-policy: audit
1618
- name: Checkout
17-
uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3
19+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
1820
- name: Setup Go
19-
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
20-
with:
21-
go-version: 1.20.x
22-
- name: Restore Go cache
23-
uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
21+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
2422
with:
25-
path: ~/go/pkg/mod
26-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
27-
restore-keys: |
28-
${{ runner.os }}-go-
23+
go-version: 1.22.x
2924
- name: Tests
3025
run: make test
3126
- name: Send go coverage report

‎.github/workflows/pr-actions.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: pr-actions
2+
3+
permissions: {}
4+
5+
on:
6+
pull_request:
7+
branches:
8+
- 'master'
9+
10+
jobs:
11+
ensure-sha-pinned:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Harden Runner
15+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
16+
with:
17+
egress-policy: audit
18+
19+
- name: Checkout
20+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
21+
- name: Ensure SHA pinned actions
22+
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@3c16e895bb662b4d7e284f032cbe8835a57773cc # v3.0.11
23+
with:
24+
# slsa-github-generator requires using a semver tag for reusable workflows.
25+
# See: https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators
26+
allowlist: |
27+
slsa-framework/slsa-github-generator

‎.github/workflows/pr-build.yaml

Lines changed: 33 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,18 @@ on:
77
- synchronize
88
- reopened
99

10+
permissions: {}
11+
1012
jobs:
1113
lint-chart:
1214
runs-on: ubuntu-latest
1315
steps:
1416
- name: Harden Runner
15-
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
17+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
1618
with:
1719
egress-policy: audit
1820
- name: Checkout
19-
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
21+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
2022
with:
2123
fetch-depth: 0
2224

@@ -25,7 +27,7 @@ jobs:
2527
with:
2628
version: v3.4.0
2729

28-
- uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa # v4.8.0
30+
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
2931
with:
3032
python-version: 3.7
3133

@@ -46,22 +48,15 @@ jobs:
4648
runs-on: ubuntu-latest
4749
steps:
4850
- name: Harden Runner
49-
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
51+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
5052
with:
5153
egress-policy: audit
5254
- name: Checkout
53-
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
55+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
5456
- name: Setup Go
55-
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
56-
with:
57-
go-version: 1.20.x
58-
- name: Restore Go cache
59-
uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
57+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
6058
with:
61-
path: ~/go/pkg/mod
62-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
63-
restore-keys: |
64-
${{ runner.os }}-go-
59+
go-version: 1.22.x
6560
- name: fmt
6661
run: make fmt
6762
- name: vet
@@ -81,28 +76,21 @@ jobs:
8176
strategy:
8277
matrix:
8378
kubernetes-version:
84-
- "1.25"
85-
- "1.26"
8679
- "1.27"
8780
- "1.28"
81+
- "1.29"
82+
- "1.30"
8883
steps:
8984
- name: Harden Runner
90-
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
85+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
9186
with:
9287
egress-policy: audit
9388
- name: Checkout
94-
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
89+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
9590
- name: Setup Go
96-
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
91+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
9792
with:
98-
go-version: 1.20.x
99-
- name: Restore Go cache
100-
uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
101-
with:
102-
path: ~/go/pkg/mod
103-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
104-
restore-keys: |
105-
${{ runner.os }}-go-
93+
go-version: 1.22.x
10694
- name: run test
10795
run: make test ENVTEST_K8S_VERSION=${{ matrix.kubernetes-version }}
10896

@@ -112,22 +100,15 @@ jobs:
112100
profiles: ${{ steps.profiles.outputs.matrix }}
113101
steps:
114102
- name: Harden Runner
115-
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
103+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
116104
with:
117105
egress-policy: audit
118106
- name: Checkout
119-
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
107+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
120108
- name: Setup Go
121-
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
122-
with:
123-
go-version: 1.20.x
124-
- name: Restore Go cache
125-
uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
109+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
126110
with:
127-
path: ~/go/pkg/mod
128-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
129-
restore-keys: |
130-
${{ runner.os }}-go-
111+
go-version: 1.22.x
131112
- name: build
132113
run: make build
133114
- name: Check if working tree is dirty
@@ -144,7 +125,7 @@ jobs:
144125
run: |
145126
docker save --output gc-controller-container.tar gc-controller:latest
146127
- name: Upload image
147-
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
128+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
148129
with:
149130
name: gc-controller-container
150131
path: gc-controller-container.tar
@@ -156,39 +137,45 @@ jobs:
156137
- lint-chart
157138
steps:
158139
- name: Harden Runner
159-
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
140+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
160141
with:
161142
egress-policy: audit
162143
- name: Checkout
163-
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
144+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
164145
with:
165146
fetch-depth: 0
166147

167148
- name: Set up Helm
168149
uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 #v3.5
169150

170-
- uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa # v4.8.0
151+
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
171152
with:
172153
python-version: 3.7
173154

174155
- name: Set up chart-testing
175156
uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
176157

177158
- name: Create kind cluster
178-
uses: helm/kind-action@99576bfa6ddf9a8e612d83b513da5a75875caced # v1.9.0
159+
uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
179160

180161
- name: Download gc-controller container
181-
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
162+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
182163
with:
183164
name: gc-controller-container
184165
path: /tmp
185166

186167
- name: Load image
187168
run: |
188169
docker load --input /tmp/gc-controller-container.tar
189-
docker tag gc-controller:latest ghcr.io/doodlescheduling/gc-controller:0.0.0
190-
kind load docker-image ghcr.io/doodlescheduling/gc-controller:0.0.0 --name chart-testing
170+
docker tag gc-controller:latest ghcr.io/doodlescheduling/gc-controller:v0.0.0
171+
kind load docker-image ghcr.io/doodlescheduling/gc-controller:v0.0.0 --name chart-testing
191172
docker image ls -a
192173
193174
- name: Run chart-testing (install)
194175
run: ct install --target-branch=master --chart-dirs chart
176+
177+
test-success:
178+
runs-on: ubuntu-latest
179+
needs: [test]
180+
steps:
181+
- run: echo "all tests succeeded"

‎.github/workflows/pr-goreleaser.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: pr-gorelaser
2+
3+
permissions: {}
4+
5+
on:
6+
pull_request:
7+
branches:
8+
- 'master'
9+
10+
jobs:
11+
validate-config:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Harden Runner
15+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
16+
with:
17+
egress-policy: audit
18+
- name: Checkout
19+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
20+
- name: Validate .goreleaser.yaml
21+
uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
22+
with:
23+
version: latest
24+
args: check
25+
env:
26+
RUNNER_TOKEN: ${{ github.token }}
27+
GITHUB_TOKEN: ${{ secrets.DOODLE_OSS_BOT}}

‎.github/workflows/pr-label.yaml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,20 @@ name: pr-label
33
on:
44
pull_request:
55

6+
permissions: {}
7+
68
jobs:
79
size-label:
810
runs-on: ubuntu-latest
911
if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' }}
12+
permissions:
13+
pull-requests: write
1014
steps:
1115
- name: Harden Runner
12-
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
16+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
1317
with:
14-
egress-policy: audit
18+
egress-policy: audit
1519
- name: size-label
16-
uses: "pascalgn/size-label-action@1619680c5ac1ef360b944bb56a57587ba4aa2af8"
20+
uses: "pascalgn/size-label-action@49850f3557d4b77f0b2e759829defd77ccc07c54"
1721
env:
1822
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/pr-stale.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: pr-stale
2+
on:
3+
schedule:
4+
- cron: '30 1 * * *'
5+
6+
permissions: {}
7+
8+
jobs:
9+
stale:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
issues: write
13+
steps:
14+
- uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
15+
with:
16+
days-before-close: '120'
17+
stale-pr-label: stale
18+
repo-token: ${{ github.token }}

‎.github/workflows/pr-trivy.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: pr-trivy
2+
on: pull_request
3+
4+
permissions: {}
5+
6+
jobs:
7+
trivy:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Harden Runner
11+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
12+
with:
13+
egress-policy: audit
14+
15+
- name: Trivy fs scan
16+
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
17+
with:
18+
scan-type: 'fs'
19+
ignore-unfixed: true
20+
scanners: license,vuln,secret
21+
format: 'sarif'
22+
output: 'trivy-results.sarif'
23+
severity: 'CRITICAL,HIGH'
24+
25+
- name: Upload Trivy scan results to GitHub Security tab
26+
uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
27+
with:
28+
sarif_file: 'trivy-results.sarif'

‎.github/workflows/rebase.yaml

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,25 @@ on:
66
issue_comment:
77
types: [created]
88

9+
permissions: {}
10+
911
jobs:
1012
rebase:
1113
if: github.event.issue.pull_request != '' && contains(github.event.comment.body, '/rebase') && (github.event.comment.author_association == 'CONTRIBUTOR' || github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'OWNER')
1214
runs-on: ubuntu-latest
15+
permissions:
16+
contents: write # needed to force push
1317
steps:
1418
- name: Harden Runner
15-
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
19+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
1620
with:
17-
egress-policy: audit
21+
egress-policy: audit
22+
1823
- name: Checkout the latest code
19-
uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b #v3
24+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
2025
with:
2126
fetch-depth: 0
2227
- name: Automatic Rebase
23-
uses: cirrus-actions/rebase@b87d48154a87a85666003575337e27b8cd65f691 #1.8
28+
uses: cirrus-actions/rebase@b87d48154a87a85666003575337e27b8cd65f691 # 1.8
2429
env:
25-
GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
30+
GITHUB_TOKEN: ${{ github.token }}

0 commit comments

Comments
 (0)