Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Harden GHA Workflows #86

Merged
merged 3 commits into from
Jul 31, 2024
Merged

Harden GHA Workflows #86

merged 3 commits into from
Jul 31, 2024

Conversation

egibs
Copy link
Member

@egibs egibs commented Jul 30, 2024 •
edited
Loading

This PR implements best practices around GitHub Actions hardening including:

  • Pinning Actions to digests
  • Adding dependabot.yml configuration to keep Actions updated
  • Scoping the GitHub token permissions appropriately (read-only except for the release.yml Workflow)
    • The release.yml Workflow calls a reusable Workflow so we can't add the hardening Action as a step to this job

Two of the matrix tests were failing because of an issue locating libcurl~8.5.0 so I fixed those as well.

@egibs egibs changed the title Harden Workflows via digest-pinning and explicit GH token permissions Harden GHA Workflows Jul 30, 2024
@egibs egibs marked this pull request as ready for review July 30, 2024 20:37
@egibs egibs requested a review from mattmoor July 30, 2024 20:40
mattmoor
mattmoor approved these changes Jul 30, 2024
View reviewed changes
Copy link
Member

@mattmoor mattmoor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc @alexeagle

This LGTM

@egibs egibs merged commit 298a1ef into chainguard-dev:main Jul 31, 2024
10 checks passed
@egibs egibs deleted the gha-hardening branch July 31, 2024 12:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mattmoor mattmoor mattmoor approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@egibs @mattmoor