-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: updated ci pipelines, align kustomize postrenderers
- Loading branch information
Showing
20 changed files
with
428 additions
and
241 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| name: pr-actions | ||
|
|
||
| permissions: {} | ||
|
|
||
| on: | ||
| pull_request: | ||
| branches: | ||
| - 'master' | ||
|
|
||
| jobs: | ||
| ensure-sha-pinned: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Harden Runner | ||
| uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 | ||
| with: | ||
| egress-policy: audit | ||
|
|
||
| - name: Checkout | ||
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| - name: Ensure SHA pinned actions | ||
| uses: zgosalvez/github-actions-ensure-sha-pinned-actions@b88cd0aad2c36a63e42c71f81cb1958fed95ac87 # v3.0.10 | ||
| with: | ||
| # slsa-github-generator requires using a semver tag for reusable workflows. | ||
| # See: https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators | ||
| allowlist: | | ||
| slsa-framework/slsa-github-generator |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| name: pr-stale | ||
| on: | ||
| schedule: | ||
| - cron: '30 1 * * *' | ||
|
|
||
| permissions: {} | ||
|
|
||
| jobs: | ||
| stale: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| issues: write | ||
| steps: | ||
| - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0 | ||
| with: | ||
| days-before-close: '120' | ||
| stale-pr-label: stale | ||
| repo-token: ${{ github.token }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| name: pr-trivy | ||
| on: pull_request | ||
|
|
||
| permissions: {} | ||
|
|
||
| jobs: | ||
| trivy: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Harden Runner | ||
| uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 | ||
| with: | ||
| egress-policy: audit | ||
|
|
||
| - name: Trivy fs scan | ||
| uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0 | ||
| with: | ||
| scan-type: 'fs' | ||
| ignore-unfixed: true | ||
| scanners: license,vuln,secret | ||
| format: 'sarif' | ||
| output: 'trivy-results.sarif' | ||
| severity: 'CRITICAL,HIGH' | ||
|
|
||
| - name: Upload Trivy scan results to GitHub Security tab | ||
| uses: github/codeql-action/upload-sarif@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2 | ||
| with: | ||
| sarif_file: 'trivy-results.sarif' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| name: report-on-vulnerabilities | ||
|
|
||
| permissions: {} | ||
|
|
||
| on: | ||
| workflow_dispatch: {} | ||
| schedule: | ||
| - cron: '0 6 * * *' | ||
|
|
||
| jobs: | ||
| scan: | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| results: ${{ steps.parse-results.outputs.results }} | ||
| steps: | ||
| - name: Harden Runner | ||
| uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 | ||
| with: | ||
| egress-policy: audit | ||
|
|
||
| - name: Scan for vulnerabilities | ||
| uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0 | ||
| with: | ||
| image-ref: ghcr.io/doodlescheduling/flux-build:latest | ||
| format: json | ||
| scanners: license,vuln,secret | ||
| ignore-unfixed: false | ||
| severity: HIGH,CRITICAL | ||
| output: scan.json | ||
|
|
||
| - name: Parse scan results | ||
| id: parse-results | ||
| continue-on-error: true | ||
| run: | | ||
| VULNS=$(cat scan.json | jq '.Results[] | length') | ||
| if [[ $VULNS -eq 0 ]] | ||
| then | ||
| echo "No vulnerabilities found, halting" | ||
| echo "results=nothing" >> $GITHUB_OUTPUT | ||
| else | ||
| echo "Vulnerabilities found, creating issue" | ||
| echo "results=found" >> $GITHUB_OUTPUT | ||
| fi | ||
| - name: Upload vulnerability scan report | ||
| uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6 | ||
| if: steps.parse-results.outputs.results == 'found' | ||
| with: | ||
| name: scan.json | ||
| path: scan.json | ||
| if-no-files-found: error | ||
|
|
||
| open-issue: | ||
| runs-on: ubuntu-latest | ||
| if: needs.scan.outputs.results == 'found' | ||
| needs: scan | ||
| permissions: | ||
| issues: write | ||
| steps: | ||
| - name: Harden Runner | ||
| uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 | ||
| with: | ||
| egress-policy: audit | ||
|
|
||
| - name: Checkout | ||
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| - name: Download scan | ||
| uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 | ||
| with: | ||
| name: scan.json | ||
| - name: Set scan output | ||
| id: set-scan-output | ||
| run: echo "results=$(cat scan.json | jq -c)" >> $GITHUB_OUTPUT | ||
| - uses: JasonEtco/create-an-issue@1b14a70e4d8dc185e5cc76d3bec9eab20257b2c5 # v2.9.2 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| RESULTS: ${{ steps.set-scan-output.outputs.results }} | ||
| with: | ||
| filename: .github/ISSUE_TEMPLATE/VULN-TEMPLATE.md |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| name: scorecard | ||
| on: | ||
| branch_protection_rule: | ||
| schedule: | ||
| - cron: '18 14 * * 5' | ||
| push: | ||
| branches: [ "master" ] | ||
|
|
||
| permissions: {} | ||
|
|
||
| jobs: | ||
| scorecard: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| security-events: write | ||
| id-token: write | ||
| steps: | ||
| - name: Harden Runner | ||
| uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 | ||
| with: | ||
| egress-policy: audit | ||
|
|
||
| - name: "Checkout code" | ||
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: "Run analysis" | ||
| uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 | ||
| with: | ||
| results_file: results.sarif | ||
| results_format: sarif | ||
| publish_results: true | ||
|
|
||
| - name: "Upload artifact" | ||
| uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6 | ||
| with: | ||
| name: SARIF file | ||
| path: results.sarif | ||
| retention-days: 5 | ||
|
|
||
| - name: "Upload to code-scanning" | ||
| uses: github/codeql-action/upload-sarif@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2 | ||
| with: | ||
| sarif_file: results.sarif |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.