Skip to content

Commit c1bc922

Browse files
authored
Pin non-immutable Actions to latest SHA and remediate dependency vulnerability (#720)
* Update vulnerable dependency Signed-off-by: Brett Logan <lindluni@github.com> * Pin non-immutable Actions in deploy-k8s Signed-off-by: Brett Logan <lindluni@github.com> * Pin non-immutable Actions in rc-release Signed-off-by: Brett Logan <lindluni@github.com> * Pin non-immutable Actions in create-pre-release Signed-off-by: Brett Logan <lindluni@github.com> * Pin non-immutable Actions in create-release Signed-off-by: Brett Logan <lindluni@github.com> * Remove dead reusable workflow Signed-off-by: Brett Logan <lindluni@github.com> * Add workflow permissions Signed-off-by: Brett Logan <lindluni@github.com> --------- Signed-off-by: Brett Logan <lindluni@github.com>
1 parent c1ee48c commit c1bc922

File tree

8 files changed

+74
-99
lines changed

8 files changed

+74
-99
lines changed

.github/actions/codeql-analysis/action.yml

Lines changed: 0 additions & 19 deletions
This file was deleted.

.github/workflows/create-pre-release.yml

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@ env:
3131
REGISTRY: ghcr.io
3232
IMAGE_NAME: ${{ github.repository }}
3333

34+
permissions:
35+
contents: write
36+
packages: write
37+
3438
jobs:
3539
build:
3640
if: ${{ github.actor != 'dependabot'}}
@@ -46,15 +50,15 @@ jobs:
4650
cache: 'npm'
4751
- run: npm install
4852
- name: Set up Docker Buildx
49-
uses: docker/setup-buildx-action@v3
53+
uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5
5054
- name: Log in to the Container registry
51-
uses: docker/login-action@v3
55+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
5256
with:
5357
registry: ${{ env.REGISTRY }}
5458
username: ${{ github.actor }}
5559
password: ${{ secrets.GITHUB_TOKEN }}
5660
- name: Build Docker Image Locally
57-
uses: docker/build-push-action@master
61+
uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355
5862
with:
5963
context: .
6064
file: ./Dockerfile
@@ -73,15 +77,15 @@ jobs:
7377
- run: echo "${{ github.ref }}"
7478
- name: Tag a final release
7579
id: prerelease
76-
uses: actionsdesk/semver@0.6.0-rc.10
80+
uses: actionsdesk/semver@82aa4310e4e21c59cd0020007a4278e733e81dcb
7781
with:
7882
bump: ${{ inputs.bump }}
7983
prerelease: ${{ inputs.prerelease }}
8084
prelabel: ${{ inputs.prelabel }}
8185
commitish: ${{ github.ref }}
8286
- name: Push Docker Image
8387
if: ${{ success() }}
84-
uses: docker/build-push-action@master
88+
uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355
8589
with:
8690
context: .
8791
file: ./Dockerfile

.github/workflows/create-release.yml

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ env:
99
REGISTRY: ghcr.io
1010
IMAGE_NAME: ${{ github.repository }}
1111

12+
permissions:
13+
contents: write
14+
packages: write
15+
1216
jobs:
1317
build:
1418
if: ${{ github.actor != 'dependabot'}}
@@ -24,15 +28,15 @@ jobs:
2428
cache: "npm"
2529
- run: npm install
2630
- name: Set up Docker Buildx
27-
uses: docker/setup-buildx-action@v3
31+
uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5
2832
- name: Log in to the Container registry
29-
uses: docker/login-action@v3
33+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
3034
with:
3135
registry: ${{ env.REGISTRY }}
3236
username: ${{ github.actor }}
3337
password: ${{ secrets.GITHUB_TOKEN }}
3438
- name: Build Docker Image Locally
35-
uses: docker/build-push-action@master
39+
uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355
3640
with:
3741
context: .
3842
file: ./Dockerfile
@@ -50,12 +54,12 @@ jobs:
5054
curl http://localhost:3000
5155
- name: Tag a final release
5256
id: finalrelease
53-
uses: actionsdesk/semver@0.6.0-rc.10
57+
uses: actionsdesk/semver@82aa4310e4e21c59cd0020007a4278e733e81dcb
5458
with:
5559
bump: final
5660
- name: Push Docker Image
5761
if: ${{ success() }}
58-
uses: docker/build-push-action@master
62+
uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355
5963
with:
6064
context: .
6165
file: ./Dockerfile

.github/workflows/deploy-k8s.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,27 +29,27 @@ jobs:
2929
steps:
3030
- name: Checkout repository
3131
uses: actions/checkout@v4
32-
- uses: azure/login@v2
32+
- uses: azure/login@a65d910e8af852a8061c627c456678983e180302
3333
with:
3434
client-id: ${{ secrets.AZURE_CLIENT_ID }}
3535
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
3636
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
37-
- uses: azure/aks-set-context@v4
37+
- uses: azure/aks-set-context@feeca6405be94202afcb1c395616ff29b1811b9f
3838
with:
3939
resource-group: ${{env.AZURE_RESOURCE_GROUP}}
4040
cluster-name: ${{env.AZURE_AKS_CLUSTER}}
4141
id: login
4242
- run: |
4343
kubectl get deployment
4444
- name: app-env
45-
uses: azure/k8s-create-secret@v5
45+
uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218
4646
with:
4747
namespace: 'default'
4848
secret-type: 'generic'
4949
arguments: --from-literal=APP_ID=${{ secrets.APP_ID }} --from-literal=PRIVATE_KEY=${{ secrets.PRIVATE_KEY }} --from-literal=WEBHOOK_SECRET=${{ secrets.WEBHOOK_SECRET }}
5050
secret-name: app-env
5151
- name: Set imagePullSecret
52-
uses: azure/k8s-create-secret@v5
52+
uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218
5353
with:
5454
namespace: ${{env.AZURE_AKS_NAMESPACE}}
5555
container-registry-url: ${{env.IMAGE_REGISTRY_URL}}

.github/workflows/node-ci.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ name: Node.js CI
22
on:
33
pull_request:
44

5+
permissions:
6+
contents: read
7+
58
concurrency:
69
group: ${{ github.workflow }}-${{ github.ref }}
710
cancel-in-progress: true

.github/workflows/rc-release.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
- name: Tag a rc release
3636
if: ${{ !github.event.pull_request.head.repo.fork }}
3737
id: rcrelease
38-
uses: actionsdesk/semver@0.6.0-rc.10
38+
uses: actionsdesk/semver@82aa4310e4e21c59cd0020007a4278e733e81dcb
3939
with:
4040
prerelease: withBuildNumber
4141
prelabel: rc
@@ -60,23 +60,23 @@ jobs:
6060
- run: echo ${{ github.actor }}
6161

6262
- name: Log in to the Container registry
63-
uses: docker/login-action@v3
63+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
6464
with:
6565
registry: ${{ env.REGISTRY }}
6666
username: ${{ github.actor }}
6767
password: ${{ secrets.GITHUB_TOKEN }}
6868

6969
- name: Extract metadata
7070
id: meta
71-
uses: docker/metadata-action@v5
71+
uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96
7272
with:
7373
images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
7474
- name: Set up QEMU
75-
uses: docker/setup-qemu-action@v3
75+
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf
7676
- name: Set up Docker Buildx
77-
uses: docker/setup-buildx-action@v3
77+
uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5
7878
- name: Build and push Docker image
79-
uses: docker/build-push-action@master
79+
uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355
8080
with:
8181
context: .
8282
push: true

package-lock.json

Lines changed: 41 additions & 57 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)