Skip to content

Commit 01d9111

Browse files
okuminokumin
authored
HIVE-29553: Pin third-party GitHub Actions (#6417)
* HIVE-29553: Pin third-party GitHub Actions * test * Narrow down permission * Remove workflow_dispatch * Add .github/workflows/asf-allowlist-check.yml * Use not main but master
1 parent d4d166d commit 01d9111

5 files changed

Lines changed: 112 additions & 9 deletions

File tree

‎.github/workflows/asf-allowlist-check.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
name: "ASF Allowlist Check"
18+
19+
on:
20+
pull_request:
21+
paths:
22+
- ".github/**"
23+
push:
24+
branches:
25+
- master
26+
paths:
27+
- ".github/**"
28+
29+
permissions:
30+
contents: read
31+
32+
jobs:
33+
asf-allowlist-check:
34+
runs-on: ubuntu-latest
35+
steps:
36+
- uses: actions/checkout@v6
37+
with:
38+
persist-credentials: false
39+
- uses: apache/infrastructure-actions/allowlist-check@main

‎.github/workflows/build.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ on:
2424
branches:
2525
- 'master'
2626

27+
permissions:
28+
contents: read
29+
2730
env:
2831
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
2932

‎.github/workflows/codeql.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
name: "CodeQL"
18+
19+
on:
20+
push:
21+
branches: [ "master" ]
22+
pull_request:
23+
branches: [ "master" ]
24+
schedule:
25+
- cron: '16 5 * * 1'
26+
27+
permissions:
28+
contents: read
29+
30+
jobs:
31+
analyze:
32+
name: Analyze Actions
33+
runs-on: ubuntu-slim
34+
permissions:
35+
contents: read
36+
security-events: write
37+
packages: read
38+
39+
steps:
40+
- name: Checkout repository
41+
uses: actions/checkout@v6
42+
with:
43+
persist-credentials: false
44+
45+
- name: Initialize CodeQL
46+
uses: github/codeql-action/init@v4
47+
with:
48+
languages: actions
49+
50+
- name: Perform CodeQL Analysis
51+
uses: github/codeql-action/analyze@v4
52+
with:
53+
category: "/language:actions"

‎.github/workflows/docker-images.yml‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
# See the License for the specific language governing permissions and
1515
# limitations under the License.
1616

17-
name: Build and Publish docker images for Hive GA
17+
name: Build and Publish docker images
1818

1919
on:
2020
create:
@@ -37,6 +37,9 @@ on:
3737
required: true
3838
default: '0.10.2'
3939

40+
permissions:
41+
contents: read
42+
4043
env:
4144
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
4245

@@ -115,16 +118,16 @@ jobs:
115118
ls ./standalone-metastore/packaging/src/docker/
116119
117120
- name: Login to Docker Hub
118-
uses: docker/login-action@v2
121+
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
119122
with:
120123
username: ${{ secrets.DOCKERHUB_USER }}
121124
password: ${{ secrets.DOCKERHUB_TOKEN }}
122125

123126
- name: Set up Docker Buildx
124-
uses: docker/setup-buildx-action@v2
127+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
125128

126129
- name: Build Hive Image locally
127-
uses: docker/build-push-action@v4
130+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
128131
with:
129132
context: ./packaging/src/docker/
130133
file: ./packaging/src/docker/Dockerfile
@@ -139,7 +142,7 @@ jobs:
139142
BUILD_ENV=${{ env.BUILD_ENV }}
140143

141144
- name: Build Standalone Metastore Image locally
142-
uses: docker/build-push-action@v4
145+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
143146
with:
144147
context: ./standalone-metastore/packaging/src/docker/
145148
file: ./standalone-metastore/packaging/src/docker/Dockerfile
@@ -153,10 +156,10 @@ jobs:
153156
BUILD_ENV=${{ env.BUILD_ENV }}
154157

155158
- name: Create k8s cluster
156-
uses: helm/kind-action@v1
159+
uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc
157160

158161
- name: Set up Helm
159-
uses: azure/setup-helm@v4
162+
uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2
160163

161164
- name: Load images
162165
run: kind load docker-image hive:test hive:standalone-metastore-test --name chart-testing
@@ -181,7 +184,7 @@ jobs:
181184
kind delete cluster --name chart-testing
182185
183186
- name: Build and push Hive Image to docker hub
184-
uses: docker/build-push-action@v4
187+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
185188
with:
186189
context: ./packaging/src/docker/
187190
file: ./packaging/src/docker/Dockerfile
@@ -196,7 +199,7 @@ jobs:
196199
BUILD_ENV=${{ env.BUILD_ENV }}
197200

198201
- name: Build and push Standalone Metastore Image to docker hub
199-
uses: docker/build-push-action@v4
202+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
200203
with:
201204
context: ./standalone-metastore/packaging/src/docker/
202205
file: ./standalone-metastore/packaging/src/docker/Dockerfile

‎.github/workflows/stale.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ on:
1919
schedule:
2020
- cron: "0 0 * * *"
2121

22+
permissions:
23+
contents: read
24+
issues: write
25+
pull-requests: write
26+
2227
jobs:
2328
stale:
2429
runs-on: ubuntu-latest

0 commit comments

Comments
 (0)