Skip to content

security: harden github actions #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
m1rm wants to merge 11 commits into
base: main
Choose a base branch
from
Open

security: harden github actions #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
ab9a4f3
security: harden github actions
m1rm May 20, 2026
2a177cb
pass maintenance token to update job so the bot can commit
m1rm Jun 14, 2026
045d287
Update justfile build recipe bc. of GH actions hardening
m1rm Jun 14, 2026
04083a1
Update test.yml bc. of GH actions hardening
m1rm Jun 14, 2026
f140387
Update Dockerfile; accept version env var
m1rm Jun 14, 2026
3a041da
Update justfile regarding VERSION env var changes in Dockerfile
m1rm Jun 14, 2026
1f4af09
Update dev.just regarding VERSION env var changes
m1rm Jun 14, 2026
9d4b1db
update lint action to latest
m1rm Jun 14, 2026
90716fc
refactor: avoid global version plumbing; Docker build gets version vi…
m1rm Jun 21, 2026
f99af8c
maintenance: update other action checkouts to latest, too
m1rm Jun 21, 2026
d43377f
refactor: git describe --tags only fails on fork
m1rm Jun 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/actions/setup/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,11 @@ runs:
using: "composite"
steps:
- name: Install Just
uses: extractions/setup-just@v3
uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4
env:
GITHUB_TOKEN: ${{ github.token }}
- name: Setup Go
uses: actions/setup-go@v6
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c #v6.4.0
with:
go-version: ${{ inputs.go-version }}
go-version-file: ${{ inputs.go-version && '' || 'go.mod' }}
15 changes: 10 additions & 5 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,13 +10,14 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
with:
fetch-depth: 0
persist-credentials: false
- name: Run Common Setup
uses: ./.github/actions/setup
- name: golangci-lint
uses: golangci/golangci-lint-action@v8
uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee #v9.2.1
with:
verify: false
- run: just lint
Expand All @@ -25,9 +26,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
with:
fetch-depth: 0
persist-credentials: false
- name: Run Common Setup
uses: ./.github/actions/setup
- run: just test
Expand All @@ -36,9 +38,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
with:
fetch-depth: 0
persist-credentials: false
- name: Run Common Setup
uses: ./.github/actions/setup
- run: just test-integration
Expand All @@ -52,7 +55,9 @@ jobs:
test: ['test', 'build', 'test-cpu-detection', 'test-os-detection']
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
with:
persist-credentials: false
- name: Run Common Setup
uses: ./.github/actions/setup
- name: Install Qemu
Expand Down
7 changes: 5 additions & 2 deletions .github/workflows/update-go.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,11 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
with:
token: ${{ secrets.MAINTENANCE_TOKEN }}
fetch-depth: 0
persist-credentials: false
- name: Run Common Setup
uses: ./.github/actions/setup
with:
Expand All @@ -29,7 +30,9 @@ jobs:
- name: Run all tests
run: just test-all
- name: Commit updates
uses: stefanzweifel/git-auto-commit-action@v7
uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 #v7.1.0
env:
GITHUB_TOKEN: ${{ secrets.MAINTENANCE_TOKEN }}
with:
commit_message: Update Go dependencies
commit_user_name: Maintenance Bob
Expand Down