From 5cb80fd09ceb48ed3c1dfc5a80b2761fe0b23d31 Mon Sep 17 00:00:00 2001 From: Miguel Martinez Trivino Date: Thu, 21 Sep 2023 13:17:06 +0200 Subject: [PATCH 1/2] fix: add pinned dependencies Signed-off-by: Miguel Martinez Trivino --- .github/workflows/codeql.yml | 33 -------------------------- .github/workflows/release.yaml | 4 ++-- app/artifact-cas/Dockerfile | 2 +- app/artifact-cas/Dockerfile.goreleaser | 2 +- app/controlplane/Dockerfile | 2 +- app/controlplane/Dockerfile.goreleaser | 2 +- 6 files changed, 6 insertions(+), 39 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 683106f2a..085a948f7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,14 +1,3 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# name: "CodeQL" on: @@ -36,15 +25,8 @@ jobs: fail-fast: false matrix: language: ["go"] - # CodeQL supports [ $supported-codeql-languages ] - # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit - - name: Checkout repository uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 @@ -53,25 +35,10 @@ jobs: uses: github/codeql-action/init@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 with: languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). - # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild uses: github/codeql-action/autobuild@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - # If the Autobuild fails above, remove it and uncomment the following three lines. - # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. - - # - run: | - # echo "Run, Build Application using script" - # ./location_of_script_within_repo/buildscript.sh - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 with: diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 3c41fa6a0..cf5986327 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -23,7 +23,7 @@ jobs: packages: write # to push container images pull-requests: write env: - CHAINLOOP_VERSION: 0.17.1 + CHAINLOOP_VERSION: 0.18.0 CHAINLOOP_ROBOT_ACCOUNT: ${{ secrets.CHAINLOOP_ROBOT_ACCOUNT }} CONTAINER_IMAGE_CP: ghcr.io/chainloop-dev/chainloop/control-plane:${{ github.ref_name }} CONTAINER_IMAGE_CAS: ghcr.io/chainloop-dev/chainloop/artifact-cas:${{ github.ref_name }} @@ -35,7 +35,7 @@ jobs: - name: Install Chainloop run: | - curl -sfL https://docs.chainloop.dev/install.sh | bash -s -- --version v${{ env.CHAINLOOP_VERSION }} + curl -sfL https://raw.githubusercontent.com/chainloop-dev/docs/78c862b6b34178928e54aa42308e706de7910501/static/install.sh | bash -s -- --version v${{ env.CHAINLOOP_VERSION }} - name: Download jq run: | diff --git a/app/artifact-cas/Dockerfile b/app/artifact-cas/Dockerfile index 2c8aa84a8..e66fefdce 100644 --- a/app/artifact-cas/Dockerfile +++ b/app/artifact-cas/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.20 AS builder +FROM golang:1.21@sha256:afccce40fb4a6b6a80d0386d6296737c68207f8d69086d0e16aa9cb9dbb753db AS builder # Not linked libraries since it will be injected into a scratch container ENV CGO_ENABLED=0 diff --git a/app/artifact-cas/Dockerfile.goreleaser b/app/artifact-cas/Dockerfile.goreleaser index 652f80b0d..4d8e997aa 100644 --- a/app/artifact-cas/Dockerfile.goreleaser +++ b/app/artifact-cas/Dockerfile.goreleaser @@ -1,4 +1,4 @@ -FROM golang:1.18 AS builder +FROM golang:1.21@sha256:afccce40fb4a6b6a80d0386d6296737c68207f8d69086d0e16aa9cb9dbb753db AS builder FROM scratch diff --git a/app/controlplane/Dockerfile b/app/controlplane/Dockerfile index 9d180ad61..95970f381 100644 --- a/app/controlplane/Dockerfile +++ b/app/controlplane/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.20@sha256:6e1a67ec11cc4eaa7a9699bc6e5385b00001669531284005ebd2ada4129138d9 AS builder +FROM golang:1.21@sha256:afccce40fb4a6b6a80d0386d6296737c68207f8d69086d0e16aa9cb9dbb753db AS builder # Not linked libraries since it will be injected into a scratch container ENV CGO_ENABLED=0 diff --git a/app/controlplane/Dockerfile.goreleaser b/app/controlplane/Dockerfile.goreleaser index e1597d8b5..c70884342 100644 --- a/app/controlplane/Dockerfile.goreleaser +++ b/app/controlplane/Dockerfile.goreleaser @@ -1,4 +1,4 @@ -FROM golang:1.20 AS builder +FROM golang:1.21@sha256:afccce40fb4a6b6a80d0386d6296737c68207f8d69086d0e16aa9cb9dbb753db AS builder FROM scratch From d5ced3bf13c034313f94a677fcc0abca850046dd Mon Sep 17 00:00:00 2001 From: Miguel Martinez Trivino Date: Fri, 22 Sep 2023 23:23:44 +0200 Subject: [PATCH 2/2] fix workflows Signed-off-by: Miguel Martinez Trivino --- .github/workflows/codeql.yml | 5 +++++ .github/workflows/lint.yml | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 085a948f7..72d059fb1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,6 +30,11 @@ jobs: - name: Checkout repository uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - name: Set up Go + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 + with: + go-version: "1.21" + # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL uses: github/codeql-action/init@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 26cdac20a..42084f9d3 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -26,7 +26,7 @@ jobs: steps: - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 with: - go-version: "1.20" + go-version: "1.21" - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0