Skip to content

Commit a040657

Browse files
lucacomelucacome
committed
Update workflows
1 parent e8f03c8 commit a040657

File tree

11 files changed

+195
-117
lines changed

11 files changed

+195
-117
lines changed

‎.github/dependabot.yml

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,26 @@
11
version: 2
22
updates:
3-
- package-ecosystem: "github-actions"
4-
directory: "/"
3+
- package-ecosystem: github-actions
4+
directory: /
55
schedule:
66
interval: weekly
7-
- package-ecosystem: "gomod"
8-
directory: "/"
7+
8+
- package-ecosystem: gomod
9+
directory: /
910
schedule:
1011
interval: weekly
1112
ignore:
1213
- dependency-name: "*/aws-sdk-go"
1314
update-types: ["version-update:semver-patch"]
1415
- dependency-name: "boto3"
1516
update-types: ["version-update:semver-patch"]
16-
- package-ecosystem: "pip"
17-
directory: "/tests"
17+
18+
- package-ecosystem: pip
19+
directory: /tests
1820
schedule:
1921
interval: weekly
20-
- package-ecosystem: "docker"
21-
directory: "/tests/docker"
22+
23+
- package-ecosystem: docker
24+
directory: /tests/docker
2225
schedule:
2326
interval: weekly

‎.github/labeler.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
change:
2+
- head-branch: ['^change/']
3+
14
enhancement:
25
- head-branch: ['^feature/', '^feat/', '^enhancement/', '^enh/']
36

‎.github/workflows/ci.yml

Lines changed: 26 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -4,43 +4,41 @@ on:
44
push:
55
branches:
66
- main
7-
paths-ignore:
8-
- '**.md'
97
tags:
10-
- 'v[0-9]+.[0-9]+.[0-9]+'
8+
- "v[0-9]+.[0-9]+.[0-9]+"
119
pull_request:
1210
branches:
1311
- main
14-
types:
15-
- opened
16-
- reopened
17-
- synchronize
18-
paths-ignore:
19-
- '**.md'
12+
13+
defaults:
14+
run:
15+
shell: bash
16+
17+
permissions:
18+
contents: read
2019

2120
jobs:
2221
binary:
2322
name: Build Binary
2423
runs-on: ubuntu-22.04
2524
steps:
2625
- name: Checkout Repository
27-
uses: actions/checkout@v3
26+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
2827

2928
- name: Setup Golang Environment
30-
uses: actions/setup-go@v4
29+
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
3130
with:
3231
go-version-file: go.mod
33-
cache: true
3432

3533
- name: Determine GOPATH
3634
id: go
3735
run: echo "go_path=$(go env GOPATH)" >> $GITHUB_OUTPUT
3836

3937
- name: Build binary
40-
uses: goreleaser/goreleaser-action@v4
38+
uses: goreleaser/goreleaser-action@336e29918d653399e599bfca99fadc1d7ffbc9f7 # v4.3.0
4139
with:
4240
version: latest
43-
args: build --snapshot --rm-dist --single-target
41+
args: build --snapshot --clean --single-target
4442
env:
4543
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4644
GOPATH: ${{ steps.go.outputs.go_path }}
@@ -50,13 +48,12 @@ jobs:
5048
runs-on: ubuntu-22.04
5149
steps:
5250
- name: Checkout Repository
53-
uses: actions/checkout@v3
51+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
5452

5553
- name: Setup Golang Environment
56-
uses: actions/setup-go@v4
54+
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
5755
with:
5856
go-version-file: go.mod
59-
cache: true
6057

6158
- name: Run Tests
6259
run: make test
@@ -65,42 +62,44 @@ jobs:
6562
name: Build Packages
6663
runs-on: ubuntu-22.04
6764
needs: [binary, unit-tests]
65+
permissions:
66+
contents: write
6867
steps:
6968
- name: Checkout Repository
70-
uses: actions/checkout@v3
69+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
7170
with:
7271
fetch-depth: 0
7372

7473
- name: Setup Golang Environment
75-
uses: actions/setup-go@v4
74+
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
7675
with:
7776
go-version-file: go.mod
78-
cache: true
7977

8078
- name: Determine GOPATH
8179
id: go
8280
run: echo "go_path=$(go env GOPATH)" >> $GITHUB_OUTPUT
8381

8482
- name: Draft Release Notes
85-
uses: lucacome/draft-release@v0.2.2
83+
uses: lucacome/draft-release@f6dc37dcdf44be100a649b72c62c628776750190 # v0.2.2
8684
with:
87-
minor-label: 'enhancement'
88-
major-label: 'change'
89-
publish: ${{ startsWith(github.ref, 'refs/tags/') }}
85+
minor-label: "enhancement"
86+
major-label: "change"
87+
publish: ${{ github.ref_type == 'tag' }}
88+
collapse-after: 50
9089
notes-footer: |
9190
## Resources
9291
9392
- Documentation -- https://github.com/nginxinc/nginx-asg-sync/blob/{{version}}/README.md
9493
if: github.event_name != 'pull_request'
9594

9695
- name: Download Syft
97-
uses: anchore/sbom-action/download-syft@v0.14.3
96+
uses: anchore/sbom-action/download-syft@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 # v0.14.3
9897

9998
- name: Build binaries
100-
uses: goreleaser/goreleaser-action@v4
99+
uses: goreleaser/goreleaser-action@336e29918d653399e599bfca99fadc1d7ffbc9f7 # v4.3.0
101100
with:
102101
version: latest
103-
args: release ${{ startsWith(github.ref, 'refs/tags/') && '' || '--snapshot' }} --rm-dist
102+
args: release ${{ github.ref_type == 'tag' && '' || '--snapshot' }} --clean
104103
env:
105104
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
106105
GOPATH: ${{ steps.go.outputs.go_path }}

‎.github/workflows/codeql-analysis.yml

Lines changed: 50 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,67 +1,73 @@
1-
# For most projects, this workflow file will not need changing; you simply need
2-
# to commit it to your repository.
3-
#
4-
# You may wish to alter this file to override the set of languages analyzed,
5-
# or to provide custom queries or build logic.
6-
#
7-
# ******** NOTE ********
8-
# We have attempted to detect the languages in your repository. Please check
9-
# the `language` matrix defined below to confirm you have the correct set of
10-
# supported CodeQL languages.
11-
#
121
name: "CodeQL"
132

143
on:
154
push:
16-
branches: [ main ]
5+
branches:
6+
- main
177
pull_request:
188
# The branches below must be a subset of the branches above
19-
branches: [ main ]
9+
branches:
10+
- main
2011
schedule:
21-
- cron: '16 6 * * 4'
12+
- cron: "16 6 * * 4" # run at 6:16am UTC on Thursdays
13+
14+
concurrency:
15+
group: ${{ github.ref_name }}-codeql
16+
cancel-in-progress: true
17+
18+
permissions:
19+
contents: read
2220

2321
jobs:
2422
analyze:
2523
name: Analyze
26-
runs-on: ubuntu-latest
24+
runs-on: ubuntu-22.04
25+
permissions:
26+
actions: read
27+
contents: read
28+
security-events: write
2729

2830
strategy:
2931
fail-fast: false
3032
matrix:
31-
language: [ 'go', 'python' ]
32-
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
33-
# Learn more:
34-
# https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
33+
language: ["go", "python"]
34+
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
35+
# Use only 'java' to analyze code written in Java, Kotlin or both
36+
# Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
37+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
3538

3639
steps:
37-
- name: Checkout repository
38-
uses: actions/checkout@v3
40+
- name: Checkout repository
41+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
42+
43+
# Initializes the CodeQL tools for scanning.
44+
- name: Initialize CodeQL
45+
uses: github/codeql-action/init@1813ca74c3faaa3a2da2070b9b8a0b3e7373a0d8 # v2.21.0
46+
with:
47+
languages: ${{ matrix.language }}
48+
# If you wish to specify custom queries, you can do so here or in a config file.
49+
# By default, queries listed here will override any specified in a config file.
50+
# Prefix the list here with "+" to use these queries and those in the config file.
3951

40-
# Initializes the CodeQL tools for scanning.
41-
- name: Initialize CodeQL
42-
uses: github/codeql-action/init@v2
43-
with:
44-
languages: ${{ matrix.language }}
45-
# If you wish to specify custom queries, you can do so here or in a config file.
46-
# By default, queries listed here will override any specified in a config file.
47-
# Prefix the list here with "+" to use these queries and those in the config file.
48-
# queries: ./path/to/local/query, your-org/your-repo/queries@main
52+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
53+
# queries: security-extended,security-and-quality
4954

50-
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
51-
# If this step fails, then you should remove it and run the build manually (see below)
52-
- name: Autobuild
53-
uses: github/codeql-action/autobuild@v2
55+
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
56+
# If this step fails, then you should remove it and run the build manually (see below)
57+
- name: Autobuild
58+
uses: github/codeql-action/autobuild@1813ca74c3faaa3a2da2070b9b8a0b3e7373a0d8 # v2.21.0
5459

55-
# ℹ️ Command-line programs to run using the OS shell.
56-
# 📚 https://git.io/JvXDl
60+
# ℹ️ Command-line programs to run using the OS shell.
61+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
5762

58-
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
59-
# and modify them (or add more) to build your code if your project
60-
# uses a compiled language
63+
# If the Autobuild fails above, remove it and uncomment the following three lines.
64+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
6165

62-
#- run: |
63-
# make bootstrap
64-
# make release
66+
# - run: |
67+
# echo "Run, Build Application using script"
68+
# ./location_of_script_within_repo/buildscript.sh
6569

66-
- name: Perform CodeQL Analysis
67-
uses: github/codeql-action/analyze@v2
70+
- name: Perform CodeQL Analysis
71+
uses: github/codeql-action/analyze@1813ca74c3faaa3a2da2070b9b8a0b3e7373a0d8 # v2.21.0
72+
with:
73+
category: "/language:${{matrix.language}}"

‎.github/workflows/dependabot-auto-merge.yml

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,21 @@
11
name: Dependabot auto-merge
22
on: pull_request_target
3+
34
permissions:
4-
pull-requests: write
5-
contents: write
5+
contents: read
6+
67
jobs:
78
dependabot:
89
runs-on: ubuntu-22.04
910
if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
11+
permissions:
12+
pull-requests: write
13+
contents: write
1014
steps:
1115
- name: Dependabot metadata
1216
id: dependabot-metadata
13-
uses: dependabot/fetch-metadata@v1.6.0
17+
uses: dependabot/fetch-metadata@c9c4182bf1b97f5224aee3906fd373f6b61b4526 # v1.6.0
18+
1419
- name: Enable auto-merge for Dependabot PRs
1520
run: gh pr merge --auto --squash "$PR_URL"
1621
env:

‎.github/workflows/dependency-review.yml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: "Dependency Review"
2+
on:
3+
pull_request:
4+
branches:
5+
- main
6+
7+
concurrency:
8+
group: ${{ github.ref_name }}-deps-review
9+
cancel-in-progress: true
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
dependency-review:
16+
runs-on: ubuntu-22.04
17+
permissions:
18+
contents: read # for actions/checkout
19+
pull-requests: write # for actions/dependency-review-action to post comments
20+
steps:
21+
- name: "Checkout Repository"
22+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
23+
24+
- name: "Dependency Review"
25+
uses: actions/dependency-review-action@1360a344ccb0ab6e9475edef90ad2f46bf8003b1 # v3.0.6
26+
with:
27+
config-file: "nginxinc/k8s-common/dependency-review-config.yml@main"

‎.github/workflows/fossa.yml

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,25 @@ on:
55
branches:
66
- main
77
paths-ignore:
8-
- '**.md'
8+
- "**.md"
99

10-
jobs:
10+
concurrency:
11+
group: ${{ github.ref_name }}-fossa
12+
cancel-in-progress: true
13+
14+
permissions:
15+
contents: read
1116

17+
jobs:
1218
scan:
1319
name: Fossa
1420
runs-on: ubuntu-22.04
21+
if: ${{ github.event.repository.fork == false }}
1522
steps:
1623
- name: Checkout Repository
17-
uses: actions/checkout@v3
24+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
25+
1826
- name: Scan
19-
uses: fossas/fossa-action@v1
27+
uses: fossas/fossa-action@f61a4c0c263690f2ddb54b9822a719c25a7b608f # v1.3.1
2028
with:
2129
api-key: ${{ secrets.FOSSA_TOKEN }}

‎.github/workflows/labeler.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ jobs:
99
triage:
1010
permissions:
1111
contents: read
12-
pull-requests: write
13-
runs-on: ubuntu-latest
12+
pull-requests: write # for actions/labeler to add labels
13+
runs-on: ubuntu-22.04
1414
steps:
15-
- uses: joshdales/labeler@3352df1f2b0ef052cea774a5eaff917ea700a1b4 # if https://github.com/actions/labeler/pull/203 is merged, use the official action actions/labeler
16-
with:
17-
repo-token: "${{ secrets.GITHUB_TOKEN }}"
15+
- uses: actions/labeler@4f052778de9a9b80cb16cfb9079b02287285a4cb # v5.0.0-alpha.1
16+
with:
17+
repo-token: "${{ secrets.GITHUB_TOKEN }}"

0 commit comments

Comments
 (0)