Skip to content

Commit d936a2a

Browse files
crazy-maxcrazy-max
authored
Merge pull request #391 from crazy-max/zizmor
ci: zizmor workflow
2 parents c39c588 + 757e26a commit d936a2a

25 files changed

Lines changed: 210 additions & 70 deletions

‎.github/dependabot.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@ updates:
55
directory: "/"
66
schedule:
77
interval: "daily"
8+
cooldown:
9+
default-days: 2
10+
groups:
11+
crazy-max-dot-github:
12+
patterns:
13+
- "crazy-max/.github/*"
814
labels:
915
- "area/dependencies"
1016
- "bot"

‎.github/workflows/.build.yml‎

Lines changed: 56 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
# reusable workflow
22
name: .build
33

4+
permissions:
5+
contents: read
6+
47
on:
58
workflow_call:
69
inputs:
@@ -16,6 +19,17 @@ on:
1619
distros:
1720
required: false
1821
type: string
22+
secrets:
23+
rh_user:
24+
required: false
25+
rh_pass:
26+
required: false
27+
dockerpublicbot_username:
28+
required: false
29+
dockerpublicbot_write_pat:
30+
required: false
31+
ghtoken:
32+
required: false
1933

2034
env:
2135
REPO_SLUG: dockereng/packaging
@@ -30,11 +44,11 @@ jobs:
3044
steps:
3145
-
3246
name: Checkout
33-
uses: actions/checkout@v6
47+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3448
-
3549
name: Matrix
3650
id: matrix
37-
uses: actions/github-script@v8
51+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
3852
env:
3953
INPUT_NAME: ${{ inputs.name }}
4054
INPUT_RELEASE: ${{ inputs.release }}
@@ -109,61 +123,63 @@ jobs:
109123
timeout-minutes: 60
110124
needs:
111125
- prepare
126+
env:
127+
INPUT_ENVS: ${{ inputs.envs }}
128+
INPUT_NAME: ${{ inputs.name }}
112129
strategy:
113130
fail-fast: false
114131
matrix:
115132
include: ${{ fromJson(needs.prepare.outputs.includes) }}
116133
steps:
117134
-
118135
name: Checkout
119-
uses: actions/checkout@v6
136+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
120137
-
121138
name: Environment variables
122139
run: |
123-
for l in "${{ inputs.envs }}"; do
124-
echo "${l?}" >> $GITHUB_ENV
125-
done
140+
if [ -n "$INPUT_ENVS" ]; then
141+
printf '%s\n' "$INPUT_ENVS" >> "$GITHUB_ENV"
142+
fi
126143
-
127144
name: Prepare
128-
# Set platform pair for artifact upload
129145
run: |
130146
platform=${{ matrix.platform }}
131147
echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
132148
-
133149
name: Set up QEMU
134-
uses: docker/setup-qemu-action@v4
150+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
135151
-
136152
name: Set up Docker Buildx
137-
uses: docker/setup-buildx-action@v4
153+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
138154
with:
139155
version: latest
140156
-
141157
name: Build
142-
uses: docker/bake-action@v7
158+
uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
143159
with:
144160
source: .
145161
targets: pkg-${{ inputs.name }}-${{ matrix.distro }}
146162
set: |
147163
*.platform=${{ matrix.platform }}
148164
env:
149-
RH_USER: ${{ secrets.RH_USER }}
150-
RH_PASS: ${{ secrets.RH_PASS }}
165+
RH_USER: ${{ secrets.rh_user }}
166+
RH_PASS: ${{ secrets.rh_pass }}
151167
-
152168
name: List artifacts
153169
run: |
154-
tree -nh ./bin/pkg/${{ inputs.name }}
170+
tree -nh "./bin/pkg/${INPUT_NAME}"
155171
-
156172
name: Verify
157173
if: ${{ matrix.verify }}
158-
uses: docker/bake-action@v7
174+
uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
159175
with:
160176
source: .
161177
targets: verify-${{ inputs.name }}-${{ matrix.distro }}
162178
set: |
163179
*.platform=${{ matrix.platform }}
164180
-
165181
name: Upload artifacts
166-
uses: actions/upload-artifact@v7
182+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
167183
with:
168184
name: build-pkg-${{ inputs.name }}-${{ matrix.distro }}-${{ env.PLATFORM_PAIR }}
169185
path: ./bin/pkg/${{ inputs.name }}/*
@@ -175,55 +191,58 @@ jobs:
175191
timeout-minutes: 10
176192
needs:
177193
- build
194+
env:
195+
INPUT_ENVS: ${{ inputs.envs }}
196+
INPUT_NAME: ${{ inputs.name }}
178197
steps:
179198
-
180199
name: Checkout
181-
uses: actions/checkout@v6
200+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
182201
-
183202
name: Environment variables
184203
run: |
185-
for l in "${{ inputs.envs }}"; do
186-
echo "${l?}" >> $GITHUB_ENV
187-
done
204+
if [ -n "$INPUT_ENVS" ]; then
205+
printf '%s\n' "$INPUT_ENVS" >> "$GITHUB_ENV"
206+
fi
188207
-
189208
name: Set up Docker Buildx
190-
uses: docker/setup-buildx-action@v4
209+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
191210
with:
192211
version: latest
193212
-
194213
name: Download artifacts
195-
uses: actions/download-artifact@v8
214+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
196215
with:
197216
path: ./bin/pkg/${{ inputs.name }}
198217
pattern: build-pkg-${{ inputs.name }}-*
199218
merge-multiple: true
200219
-
201220
name: List artifacts
202221
run: |
203-
tree -nh ./bin/pkg/${{ inputs.name }}
222+
tree -nh "./bin/pkg/${INPUT_NAME}"
204223
-
205224
name: Generate metadata
206-
uses: docker/bake-action@v7
225+
uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
207226
with:
208227
source: .
209228
targets: metadata-${{ inputs.name }}
210229
provenance: false
211230
-
212231
name: Resolve metadata
213232
run: |
214-
for l in $(cat ./bin/pkg/${{ inputs.name }}/metadata.env); do
233+
while IFS= read -r l; do
215234
export "${l?}"
216-
echo "${l?}" >> $GITHUB_ENV
217-
done
235+
printf '%s\n' "${l?}" >> "$GITHUB_ENV"
236+
done < "./bin/pkg/${INPUT_NAME}/metadata.env"
218237
if [ "${{ github.event_name }}" = "schedule" ]; then
219-
echo "GIT_TAG=nightly/${{ inputs.name }}/$VERSION" >> $GITHUB_ENV
238+
echo "GIT_TAG=nightly/${INPUT_NAME}/$VERSION" >> "$GITHUB_ENV"
220239
else
221-
echo "GIT_TAG=${{ inputs.name }}/$VERSION" >> $GITHUB_ENV
240+
echo "GIT_TAG=${INPUT_NAME}/$VERSION" >> "$GITHUB_ENV"
222241
fi
223242
-
224243
name: Docker meta
225244
id: meta
226-
uses: docker/metadata-action@v6
245+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
227246
with:
228247
images: |
229248
${{ env.REPO_SLUG }}
@@ -238,15 +257,15 @@ jobs:
238257
bake-target: meta-helper
239258
-
240259
name: Login to Docker Hub
241-
uses: docker/login-action@v4
260+
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
242261
if: ${{ inputs.release || github.event_name == 'schedule' }}
243262
with:
244-
username: ${{ secrets.DOCKERPUBLICBOT_USERNAME }}
245-
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
263+
username: ${{ secrets.dockerpublicbot_username }}
264+
password: ${{ secrets.dockerpublicbot_write_pat }}
246265
-
247266
name: Build release
248267
id: build
249-
uses: docker/bake-action@v7
268+
uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
250269
with:
251270
source: .
252271
files: |
@@ -262,7 +281,7 @@ jobs:
262281
name: List release artifacts
263282
run: |
264283
mkdir -p /tmp/release-squashed
265-
cp ./bin/pkg/${{ inputs.name }}/metadata.env /tmp/release-squashed/
284+
cp "./bin/pkg/${INPUT_NAME}/metadata.env" /tmp/release-squashed/
266285
find /tmp/release -mindepth 2 -maxdepth 2 ! -name metadata.env -exec cp -r -t /tmp/release-squashed {} +
267286
tree -nh /tmp/release-squashed | tee /tmp/packages.txt
268287
rm -rf /tmp/release-squashed
@@ -284,7 +303,7 @@ jobs:
284303
* commit: [\`${COMMIT}\`](${REPO}/commit/${COMMIT})
285304
EOF
286305
287-
if [ "${{ inputs.name }}" = "containerd" ]; then
306+
if [ "$INPUT_NAME" = "containerd" ]; then
288307
cat >> "/tmp/summary.txt" <<-EOF
289308
* runc
290309
* repo: ${RUNC_REPO}
@@ -315,7 +334,7 @@ jobs:
315334
EOF
316335
-
317336
name: Set outputs
318-
uses: actions/github-script@v8
337+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
319338
id: release-metadata
320339
with:
321340
script: |
@@ -351,4 +370,4 @@ jobs:
351370
$ undock --wrap --rm-dist --all ${{ env.REPO_SLUG }}:${{ steps.meta.outputs.version }} ./${{ inputs.name }}/${{ env.VERSION }}
352371
```
353372
env:
354-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
373+
GITHUB_TOKEN: ${{ secrets.ghtoken || github.token }}

‎.github/workflows/.pkgs.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
# reusable workflow
22
name: .pkgs
33

4+
permissions:
5+
contents: read
6+
47
on:
58
workflow_call:
69
outputs:
@@ -16,11 +19,11 @@ jobs:
1619
steps:
1720
-
1821
name: Checkout
19-
uses: actions/checkout@v6
22+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2023
-
2124
name: Set pkgs output
2225
id: set
23-
uses: actions/github-script@v8
26+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
2427
with:
2528
script: |
2629
const fs = require('fs');

‎.github/workflows/build-agent.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: build-agent
22

3+
permissions:
4+
contents: read
5+
36
concurrency:
47
group: ${{ github.workflow }}-${{ github.ref }}
58
cancel-in-progress: true
@@ -31,4 +34,3 @@ jobs:
3134
uses: ./.github/workflows/.build.yml
3235
with:
3336
name: agent
34-
secrets: inherit

‎.github/workflows/build-buildx.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: build-buildx
22

3+
permissions:
4+
contents: read
5+
36
concurrency:
47
group: ${{ github.workflow }}-${{ github.ref }}
58
cancel-in-progress: true
@@ -31,4 +34,3 @@ jobs:
3134
uses: ./.github/workflows/.build.yml
3235
with:
3336
name: buildx
34-
secrets: inherit

‎.github/workflows/build-compose.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: build-compose
22

3+
permissions:
4+
contents: read
5+
36
concurrency:
47
group: ${{ github.workflow }}-${{ github.ref }}
58
cancel-in-progress: true
@@ -31,4 +34,3 @@ jobs:
3134
uses: ./.github/workflows/.build.yml
3235
with:
3336
name: compose
34-
secrets: inherit

‎.github/workflows/build-containerd.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: build-containerd
22

3+
permissions:
4+
contents: read
5+
36
concurrency:
47
group: ${{ github.workflow }}-${{ github.ref }}
58
cancel-in-progress: true
@@ -31,4 +34,3 @@ jobs:
3134
uses: ./.github/workflows/.build.yml
3235
with:
3336
name: containerd
34-
secrets: inherit

‎.github/workflows/build-credential-helpers.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: build-credential-helpers
22

3+
permissions:
4+
contents: read
5+
36
concurrency:
47
group: ${{ github.workflow }}-${{ github.ref }}
58
cancel-in-progress: true
@@ -31,4 +34,3 @@ jobs:
3134
uses: ./.github/workflows/.build.yml
3235
with:
3336
name: credential-helpers
34-
secrets: inherit

‎.github/workflows/build-docker-cli.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: build-docker-cli
22

3+
permissions:
4+
contents: read
5+
36
concurrency:
47
group: ${{ github.workflow }}-${{ github.ref }}
58
cancel-in-progress: true
@@ -31,4 +34,3 @@ jobs:
3134
uses: ./.github/workflows/.build.yml
3235
with:
3336
name: docker-cli
34-
secrets: inherit

‎.github/workflows/build-docker-engine.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: build-docker-engine
22

3+
permissions:
4+
contents: read
5+
36
concurrency:
47
group: ${{ github.workflow }}-${{ github.ref }}
58
cancel-in-progress: true
@@ -31,4 +34,3 @@ jobs:
3134
uses: ./.github/workflows/.build.yml
3235
with:
3336
name: docker-engine
34-
secrets: inherit

0 commit comments

Comments
 (0)