CI improvements from LXD#1333
Conversation
There was a problem hiding this comment.
Pull request overview
Updates GitHub Actions CI workflows to improve security posture (credential persistence, action pinning signals) and enhance vulnerability scanning (Trivy SARIF + KEV tagging), based on patterns from LXD.
Changes:
- Disable persisted git credentials on
actions/checkoutacross multiple workflows/jobs. - Rework Trivy security scanning to use
aquasecurity/trivy-action, upload SARIF, and tag KEV-listed CVEs. - Pin the documentation reusable workflow by commit and add
zizmorignore annotations for specific findings.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/triage.yml | Adds zizmor suppression for pull_request_target trigger warning. |
| .github/workflows/tests.yml | Disables checkout credential persistence in jobs; pins doc workflow by commit; adds zizmor suppression for an unpinned reusable action. |
| .github/workflows/security.yml | Migrates Trivy scanning to aquasecurity/trivy-action, adds KEV tagging logic, and adjusts permissions/conditions. |
| .github/workflows/codeql.yml | Disables checkout credential persistence for CodeQL job. |
| .github/actions/system-test/action.yml | Adds checkout credential hardening and zizmor suppressions; refactors input usage in bash steps. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
The Ceph failures are likely related to MicroCeph I just saw you have also added two commits for the MicroCeph versions checks. I have aligned it with the MicroOVN and LXD check to support the the current LTS + the latest/edge version. Also the test suite requires tweaks due to the switch to Microcluster v3 in MicroCeph. |
Ack, will rebase once it lands. |
|
Can be rebased now. |
Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
…zizmor) Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
…zmor) Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
|
Happy with the changes @simondeziel ? |
Oops, out of draft now ;) |
No description provided.