diff --git a/.github/actions/create_manifest_instance_build_images_containers/Dockerfile b/.github/actions/create_manifest_instance_build_images_containers/Dockerfile index bb08703374..e5652becfd 100644 --- a/.github/actions/create_manifest_instance_build_images_containers/Dockerfile +++ b/.github/actions/create_manifest_instance_build_images_containers/Dockerfile @@ -1,4 +1,4 @@ -FROM docker.io/library/python:3.9 AS builder +FROM docker.io/library/python:3.9@sha256:30678bb79d9eeaf98ec0ce83cdcd4d6f5301484ef86873a711e69df2ca77e8ac AS builder COPY images_containers_manifest.py /images_containers_manifest.py diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e9058bce6a..70dc936fbd 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -22,3 +22,68 @@ updates: directory: / schedule: interval: daily + + - package-ecosystem: docker + directory: /.github/actions/create_manifest_instance_build_images_containers + schedule: + interval: daily + + - package-ecosystem: docker + directory: /dffml/skel/operations + schedule: + interval: daily + + - package-ecosystem: docker + directory: /examples/ffmpeg + schedule: + interval: daily + + - package-ecosystem: pip + directory: /examples/innersource/swportal + schedule: + interval: daily + + - package-ecosystem: pip + directory: /examples + schedule: + interval: daily + + - package-ecosystem: docker + directory: /operations/binsec + schedule: + interval: daily + + - package-ecosystem: docker + directory: /operations/data + schedule: + interval: daily + + - package-ecosystem: docker + directory: /operations/deploy + schedule: + interval: daily + + - package-ecosystem: docker + directory: /operations/image + schedule: + interval: daily + + - package-ecosystem: docker + directory: /operations/neo4j + schedule: + interval: daily + + - package-ecosystem: docker + directory: /operations/nlp + schedule: + interval: daily + + - package-ecosystem: docker + directory: /service/http + schedule: + interval: daily + + - package-ecosystem: pip + directory: /service/ossse + schedule: + interval: daily diff --git a/.github/workflows/alice_async_comms.yml b/.github/workflows/alice_async_comms.yml index 9f69722a0d..108dce0548 100644 --- a/.github/workflows/alice_async_comms.yml +++ b/.github/workflows/alice_async_comms.yml @@ -16,7 +16,12 @@ jobs: name: Create Async Comms Posts in Relevant Locations runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Post engineering log entry env: GITHUB_TOKEN: ${{ github.token }} diff --git a/.github/workflows/alice_please_contribute_recommended_community_standards.yml b/.github/workflows/alice_please_contribute_recommended_community_standards.yml index 5c0808dc28..cce8447d06 100644 --- a/.github/workflows/alice_please_contribute_recommended_community_standards.yml +++ b/.github/workflows/alice_please_contribute_recommended_community_standards.yml @@ -9,13 +9,21 @@ on: type: string +permissions: + contents: read + jobs: contribute: name: Contribute runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + - name: Set up Python 3.9 - uses: actions/setup-python@v5 + uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 with: python-version: 3.9 - name: Configure git user info diff --git a/.github/workflows/alice_shouldi_contribute.yml b/.github/workflows/alice_shouldi_contribute.yml index d2d33d5578..f387d336a0 100644 --- a/.github/workflows/alice_shouldi_contribute.yml +++ b/.github/workflows/alice_shouldi_contribute.yml @@ -9,13 +9,21 @@ on: type: string +permissions: + contents: read + jobs: collector: name: Collector runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + - name: Set up Python 3.9 - uses: actions/setup-python@v5 + uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 with: python-version: 3.9 - name: Configure git user info @@ -59,7 +67,7 @@ jobs: set -x pwd alice shouldi contribute -keys "${REPO_URL}" -log debug - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0 with: name: collector_output path: .tools/open-architecture/innersource/repos.json diff --git a/.github/workflows/build_images_containers.yml b/.github/workflows/build_images_containers.yml index eb94c6b9fc..fa05f3de84 100644 --- a/.github/workflows/build_images_containers.yml +++ b/.github/workflows/build_images_containers.yml @@ -54,6 +54,9 @@ on: type: string description: 'https://github.com/intel/dffml/tree/main/schema/dffml/image/container/build/0.0.1.schema.json' +permissions: + contents: read + jobs: build: name: Build container images @@ -63,7 +66,12 @@ jobs: max-parallel: 40 matrix: ${{ fromJSON(inputs.manifests) }} steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 with: repository: '${{ github.repository }}' ref: '${{ matrix.commit }}' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000000..5e9b61091b --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,78 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: ["main"] + pull_request: + # The branches below must be a subset of the branches above + branches: ["main"] + schedule: + - cron: "0 0 * * 1" + +permissions: + contents: read + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: ["javascript", "python"] + # CodeQL supports [ $supported-codeql-languages ] + # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + + steps: + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - name: Checkout repository + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12 + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12 + with: + category: "/language:${{matrix.language}}" diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000000..fd27e55b6e --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,27 @@ +# Dependency Review Action +# +# This Action will scan dependency manifest files that change as part of a Pull Request, +# surfacing known-vulnerable versions of the packages declared or updated in the PR. +# Once installed, if the workflow run is marked as required, +# PRs introducing known-vulnerable packages will be blocked from merging. +# +# Source repository: https://github.com/actions/dependency-review-action +name: 'Dependency Review' +on: [pull_request] + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - name: 'Checkout Repository' + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - name: 'Dependency Review' + uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1 diff --git a/.github/workflows/dffml_build_images_containers.yml b/.github/workflows/dffml_build_images_containers.yml index 44a7ef8bd0..16c082d6ae 100644 --- a/.github/workflows/dffml_build_images_containers.yml +++ b/.github/workflows/dffml_build_images_containers.yml @@ -32,7 +32,12 @@ jobs: length: ${{ steps.create-manifest-instance.outputs.length }} manifest: ${{ steps.create-manifest-instance.outputs.github_actions_manifest }} steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Build manifest from changed dockerfiles uses: "./.github/actions/create_manifest_instance_build_images_containers" id: create-manifest-instance diff --git a/.github/workflows/dispatch_build_images_containers.yml b/.github/workflows/dispatch_build_images_containers.yml index 1ae4ec6b30..bcfc1e2e05 100644 --- a/.github/workflows/dispatch_build_images_containers.yml +++ b/.github/workflows/dispatch_build_images_containers.yml @@ -17,8 +17,13 @@ jobs: outputs: manifest: ${{ steps.create-manifest-instance.outputs.manifest }} steps: + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + - name: Set up Python 3.9 - uses: actions/setup-python@v5 + uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 with: python-version: 3.9 - name: Build manifest diff --git a/.github/workflows/new_2nd_party_tcb_eval.yml b/.github/workflows/new_2nd_party_tcb_eval.yml index 6802ea222a..39ee53bdb4 100644 --- a/.github/workflows/new_2nd_party_tcb_eval.yml +++ b/.github/workflows/new_2nd_party_tcb_eval.yml @@ -16,7 +16,12 @@ jobs: repo_name: ${{ steps.issue-parser.outputs.issueparser_repo_name }} runs-on: ubuntu-latest steps: - - uses: stefanbuck/github-issue-parser@v3 + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - uses: stefanbuck/github-issue-parser@51ca3d60963b9cea813101636b0c596945082867 # v3 id: issue-parser with: template-path: .github/ISSUE_TEMPLATE/new_plugin.yml diff --git a/.github/workflows/pin_downstream.yml b/.github/workflows/pin_downstream.yml index 0cf8af5f14..35179f9304 100644 --- a/.github/workflows/pin_downstream.yml +++ b/.github/workflows/pin_downstream.yml @@ -16,6 +16,9 @@ on: branches: - main +permissions: + contents: read + jobs: manifest: runs-on: ubuntu-latest @@ -25,11 +28,16 @@ jobs: length: ${{ steps.create-manifest-instance.outputs.length }} manifest: ${{ steps.create-manifest-instance.outputs.github_actions_manifest }} steps: + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 with: python-version: "3.11" - - uses: actions/checkout@v4 + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Build manifest from plugins.json from pull request id: create-manifest-instance env: @@ -70,6 +78,8 @@ jobs: pin_downstream_pep_440: + permissions: + contents: write # for Git to git push name: "Pin downstream to latest commit" runs-on: ubuntu-latest # Disabled currently @@ -88,6 +98,11 @@ jobs: max-parallel: 100 matrix: ${{ fromJSON(needs.manifest.outputs.manifest) }} steps: + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + - name: Checkout downstream env: # TODO Pull requests on pull requests, probably from renovate/dependabot diff --git a/.github/workflows/rfc.yml b/.github/workflows/rfc.yml index 64d82cdabf..9e01d9e589 100644 --- a/.github/workflows/rfc.yml +++ b/.github/workflows/rfc.yml @@ -6,15 +6,25 @@ on: - 'docs/rfc/**' - '.github/workflows/rfc.yml' +permissions: + contents: read + jobs: htmlize: + permissions: + contents: write # for Git to git push runs-on: ubuntu-latest strategy: matrix: python-version: [3.7] steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Checkout full upstream repo run: | git remote set-url origin https://github.com/intel/dffml @@ -23,7 +33,7 @@ jobs: git config --global user.email "dffml@intel.com" git config --global user.name "DFFML CI/CD" - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 with: python-version: ${{ matrix.python-version }} - name: Get pip cache @@ -31,7 +41,7 @@ jobs: run: | python -c "from pip._internal.locations import USER_CACHE_DIR; print('::set-output name=dir::' + USER_CACHE_DIR)" - name: pip cache - uses: actions/cache@v3 + uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2 with: path: ${{ steps.pip-cache.outputs.dir }} key: ${{ runner.os }}-pip-${{ hashFiles('**/setup.py') }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 8faf2db520..9521e24d9b 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -15,6 +15,11 @@ jobs: security-events: write id-token: write steps: + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + - name: "Checkout code" uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 with: diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml index 63fb519a3d..3c10ebf348 100644 --- a/.github/workflows/testing.yml +++ b/.github/workflows/testing.yml @@ -20,9 +20,14 @@ jobs: python-version: - "3.12" steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 with: python-version: ${{ matrix.python-version }} - name: Get pip cache @@ -30,7 +35,7 @@ jobs: run: | python -c "from pip._internal.locations import USER_CACHE_DIR; print('::set-output name=dir::' + USER_CACHE_DIR)" - name: pip cache - uses: actions/cache@v3 + uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2 with: path: ${{ steps.pip-cache.outputs.dir }} key: ${{ runner.os }}-pip-${{ hashFiles('**/setup.cfg') }} @@ -78,7 +83,7 @@ jobs: EOF echo "GITHUB_OUTPUT_EOF" >> $GITHUB_OUTPUT - name: Checkout public-keys branch - uses: actions/checkout@v4 + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 with: ref: public-keys path: public-keys @@ -166,7 +171,7 @@ jobs: scitt-url: https://scitt.unstable.chadig.com - name: Create Pull Request if: ${{ steps.generate-sbom.outputs.changed }} - uses: peter-evans/create-pull-request@v5.0.2 + uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2 with: commit-message: "chore: update SBOM for Python ${{ matrix.python-version }}" title: "chore: update SBOM for Python ${{ matrix.python-version }}" @@ -203,7 +208,12 @@ jobs: node-version: [12.x] steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Checkout full upstream repo run: | git remote set-url origin https://github.com/intel/dffml @@ -212,11 +222,11 @@ jobs: git config --global user.email "dffml@intel.com" git config --global user.name "DFFML CI/CD" - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 with: python-version: ${{ matrix.python-version }} - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1 with: node-version: ${{ matrix.node-version }} - name: Get pip cache @@ -224,7 +234,7 @@ jobs: run: | python -c "from pip._internal.locations import USER_CACHE_DIR; print('::set-output name=dir::' + USER_CACHE_DIR)" - name: pip cache - uses: actions/cache@v3 + uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2 with: path: ${{ steps.pip-cache.outputs.dir }} key: ${{ runner.os }}-pip-${{ hashFiles('**/setup.py') }} @@ -243,7 +253,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Install dependencies run: | set -x @@ -285,7 +300,12 @@ jobs: - "3.12" steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Checkout full upstream repo run: | git remote set-url origin https://github.com/intel/dffml @@ -297,7 +317,7 @@ jobs: run: | sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 with: python-version: ${{ matrix.python-version }} - name: Get pip cache @@ -305,14 +325,14 @@ jobs: run: | python -c "from pip._internal.locations import USER_CACHE_DIR; print('::set-output name=dir::' + USER_CACHE_DIR)" - name: pip cache - uses: actions/cache@v3 + uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2 with: path: ${{ steps.pip-cache.outputs.dir }} key: ${{ runner.os }}-pip-${{ hashFiles('**/setup.py') }} restore-keys: | ${{ runner.os }}-pip- - name: shouldi test binary cache - uses: actions/cache@v3 + uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2 with: path: examples/shouldi/tests/downloads key: ${{ hashFiles('examples/shouldi/tests/binaries.py') }} @@ -401,7 +421,12 @@ jobs: - docs/tutorials/sources/file.rst steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Checkout full upstream repo run: | git remote set-url origin https://github.com/intel/dffml @@ -410,7 +435,7 @@ jobs: git config --global user.email "dffml@intel.com" git config --global user.name "DFFML CI/CD" - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 with: python-version: ${{ matrix.python-version }} - name: Get pip cache @@ -418,7 +443,7 @@ jobs: run: | python -c "from pip._internal.locations import USER_CACHE_DIR; print('::set-output name=dir::' + USER_CACHE_DIR)" - name: pip cache - uses: actions/cache@v3 + uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2 with: path: ${{ steps.pip-cache.outputs.dir }} key: ${{ runner.os }}-pip-${{ hashFiles('**/setup.py') }} @@ -446,7 +471,12 @@ jobs: matrix: python-version: [3.7] steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Checkout full upstream repo run: | git remote set-url origin https://github.com/intel/dffml @@ -454,7 +484,7 @@ jobs: git config --global user.email "dffml@intel.com" git config --global user.name "DFFML CI/CD" - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 with: python-version: ${{ matrix.python-version }} - name: Get pip cache @@ -462,7 +492,7 @@ jobs: run: | python -c "from pip._internal.locations import USER_CACHE_DIR; print('::set-output name=dir::' + USER_CACHE_DIR)" - name: pip cache - uses: actions/cache@v3 + uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2 with: path: ${{ steps.pip-cache.outputs.dir }} key: ${{ runner.os }}-pip-${{ hashFiles('**/setup.py') }} diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index fe26568c66..e868b7a922 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -3,3 +3,24 @@ repos: rev: 19.10b0 hooks: - id: black + - repo: https://github.com/gitleaks/gitleaks + rev: v8.16.3 + hooks: + - id: gitleaks + - repo: https://github.com/jumanjihouse/pre-commit-hooks + rev: 3.0.0 + hooks: + - id: shellcheck + - repo: https://github.com/pre-commit/mirrors-eslint + rev: v8.38.0 + hooks: + - id: eslint + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.4.0 + hooks: + - id: end-of-file-fixer + - id: trailing-whitespace + - repo: https://github.com/pylint-dev/pylint + rev: v2.17.2 + hooks: + - id: pylint diff --git a/Dockerfile b/Dockerfile index 48658ebd4f..8867ec4d91 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM python:3.11-buster +FROM python:3.11-buster@sha256:3a19b4d6ce4402d11bb19aa11416e4a262a60a57707a5cda5787a81285df2666 # ========================== BEGIN DOCKER SETUP ================================ # diff --git a/dffml/skel/operations/Dockerfile b/dffml/skel/operations/Dockerfile index 4db00b3a6b..b8728e7c40 100644 --- a/dffml/skel/operations/Dockerfile +++ b/dffml/skel/operations/Dockerfile @@ -3,7 +3,7 @@ # docker run --rm -ti -p 80:8080 REPLACE_ORG_NAME/REPLACE_IMPORT_PACKAGE_NAME -insecure -log debug # # curl -v http://127.0.0.1:80/list/sources -FROM ubuntu:20.04 +FROM ubuntu:20.04@sha256:f2034e7195f61334e6caff6ecf2e965f92d11e888309065da85ff50c617732b8 RUN apt-get update && \ apt-get install -y \ diff --git a/examples/ffmpeg/Dockerfile b/examples/ffmpeg/Dockerfile index 566ea3f79c..657dc553cd 100644 --- a/examples/ffmpeg/Dockerfile +++ b/examples/ffmpeg/Dockerfile @@ -3,7 +3,7 @@ # docker run --rm -ti -p 8080:8080 $USER/ffmpeg -mc-config deploy -insecure -log debug # # curl -v --request POST --data-binary @input.mp4 http://localhost:8080/ffmpeg -o output.gif -FROM ubuntu:20.04 +FROM ubuntu:20.04@sha256:f2034e7195f61334e6caff6ecf2e965f92d11e888309065da85ff50c617732b8 ENV DEBIAN_FRONTEND=noninteractive RUN apt-get update && \ diff --git a/operations/binsec/Dockerfile b/operations/binsec/Dockerfile index 5edc594113..b9f7daacd0 100644 --- a/operations/binsec/Dockerfile +++ b/operations/binsec/Dockerfile @@ -2,7 +2,7 @@ # docker build -t intelotc/dffml_operations_binsec . # docker run --rm -ti -p 80:8080 intelotc/operations -insecure -log debug # curl -v http://127.0.0.1:80/list/sources -FROM ubuntu:20.04 +FROM ubuntu:20.04@sha256:f2034e7195f61334e6caff6ecf2e965f92d11e888309065da85ff50c617732b8 RUN apt-get update && \ apt-get install -y \ diff --git a/operations/data/Dockerfile b/operations/data/Dockerfile index b97ce970a7..0e4d981cea 100644 --- a/operations/data/Dockerfile +++ b/operations/data/Dockerfile @@ -3,7 +3,7 @@ # docker run --rm -ti -p 80:8080 gitpod/dffml_operations_data -insecure -log debug # # curl -v http://127.0.0.1:80/list/sources -FROM ubuntu:20.04 +FROM ubuntu:20.04@sha256:f2034e7195f61334e6caff6ecf2e965f92d11e888309065da85ff50c617732b8 RUN apt-get update && \ apt-get install -y \ diff --git a/operations/deploy/Dockerfile b/operations/deploy/Dockerfile index f55ef90f55..e8da23879a 100644 --- a/operations/deploy/Dockerfile +++ b/operations/deploy/Dockerfile @@ -2,7 +2,7 @@ # docker build -t dffml/deploy . # docker run --rm -ti -p 80:8080 dffml/deploy -insecure -log debug # -FROM ubuntu:20.04 +FROM ubuntu:20.04@sha256:f2034e7195f61334e6caff6ecf2e965f92d11e888309065da85ff50c617732b8 RUN apt-get update && \ apt-get install -y \ diff --git a/operations/image/Dockerfile b/operations/image/Dockerfile index 8eb641c727..a28e4d971d 100644 --- a/operations/image/Dockerfile +++ b/operations/image/Dockerfile @@ -3,7 +3,7 @@ # docker run --rm -ti -p 80:8080 dffml/image -insecure -log debug # # curl -v http://127.0.0.1:80/list/sources -FROM ubuntu:20.04 +FROM ubuntu:20.04@sha256:f2034e7195f61334e6caff6ecf2e965f92d11e888309065da85ff50c617732b8 RUN apt-get update && \ apt-get install -y \ diff --git a/operations/neo4j/Dockerfile b/operations/neo4j/Dockerfile index a2ebb90b23..878dc7ed95 100644 --- a/operations/neo4j/Dockerfile +++ b/operations/neo4j/Dockerfile @@ -3,7 +3,7 @@ # docker run --rm -ti -p 80:8080 pdxjohnny/dffml_operations_neo4j -insecure -log debug # # curl -v http://127.0.0.1:80/list/sources -FROM ubuntu:20.04 +FROM ubuntu:20.04@sha256:f2034e7195f61334e6caff6ecf2e965f92d11e888309065da85ff50c617732b8 RUN apt-get update && \ apt-get install -y \ diff --git a/operations/nlp/Dockerfile b/operations/nlp/Dockerfile index 04d1baf7ea..5d05acc337 100644 --- a/operations/nlp/Dockerfile +++ b/operations/nlp/Dockerfile @@ -3,7 +3,7 @@ # docker run --rm -ti -p 80:8080 himanshu/nlp -insecure -log debug # # curl -v http://127.0.0.1:80/list/sources -FROM ubuntu:20.04 +FROM ubuntu:20.04@sha256:f2034e7195f61334e6caff6ecf2e965f92d11e888309065da85ff50c617732b8 RUN apt-get update && \ apt-get install -y \