Stelian Ionescu
|
bbf3551cb8
|
Pin ubuntu-latest to 4cpu-gh-ubuntu24-x64
|
2026-10-15 14:32:04 -06:00 |
|
zi0Black
|
265af8a183
|
ci: harden GitHub Actions workflows (zizmor audit)
- Pin all unpinned action refs to immutable commit SHAs (tag
immutability verified via GitHub rulesets API for each repo;
all returned false/empty so SHA pinning applied)
- Add top-level `permissions: contents: read` to ci.yml, test.yml,
and validate.yml (publish.yml already had per-job permissions)
- Add `persist-credentials: false` to all actions/checkout steps
to prevent credential leakage through GitHub Actions artifacts
Findings addressed: unpinned-uses (40 errors), excessive-permissions
(27 warnings), artipacked (26 warnings) — 93 findings total
Actions pinned:
actions/checkout v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5
actions/publish-immutable-action v0.0.4 -> 4bc8754ffc40f27910afb20287dbbbb675a4e978
docker/setup-qemu-action v3 -> c7c53464625b32c7a7e944ae62b3e17d2b600130
docker/build-push-action v6 -> 10e90e3645eae34f1e60eeb005ba3a3d33f178e8
docker/build-push-action master -> 789f68658055d3ca993799b232b5c46dfe3f114d
docker/bake-action v5 -> 4a9a8d494466d37134e2bfca2d3a8de8fb2681ad
crazy-max/ghaction-dump-context v2 -> 5355a8e5e6ac5a302e746a1c4b7747a0393863c8
codecov/codecov-action v4 -> b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238
crazy-max/.github install-k3s -> already SHA-pinned (skipped)
|
2026-05-14 00:34:57 +02:00 |
|
CrazyMax
|
d036b3238c
|
ci: publish as immutable action workflow
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
|
2024-10-25 13:22:55 +02:00 |
|
CrazyMax
|
e027232c25
|
Merge pull request #332 from docker/dependabot/github_actions/docker/bake-action-5
build(deps): bump docker/bake-action from 4 to 5
|
2024-06-20 17:59:29 +02:00 |
|
dependabot[bot]
|
e9ab4c6a14
|
build(deps): bump docker/bake-action from 4 to 5
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 4 to 5.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/v4...v5)
---
updated-dependencies:
- dependency-name: docker/bake-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2024-06-18 04:09:56 +00:00 |
|
dependabot[bot]
|
748835b452
|
build(deps): bump docker/build-push-action from 5 to 6
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5 to 6.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v5...v6)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2024-06-18 04:09:53 +00:00 |
|
CrazyMax
|
f876da6242
|
rename and align config inputs
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
|
2024-03-01 10:10:00 +01:00 |
|
CrazyMax
|
a4180f835d
|
cache-binary input to enable/disable caching binary to GHA cache backend
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
|
2024-02-23 10:57:39 +01:00 |
|
CrazyMax
|
74c5b717e5
|
bump codecov/codecov-action from 3 to 4
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
|
2024-02-23 09:15:27 +01:00 |
|
CrazyMax
|
8bda7f18d0
|
Merge pull request #274 from docker/dependabot/github_actions/docker/setup-qemu-action-3
build(deps): bump docker/setup-qemu-action from 2 to 3
|
2023-09-13 08:33:53 +02:00 |
|
CrazyMax
|
36dc84a6af
|
Merge pull request #273 from docker/dependabot/github_actions/docker/bake-action-4
build(deps): bump docker/bake-action from 3 to 4
|
2023-09-13 08:32:14 +02:00 |
|
dependabot[bot]
|
35db0cdb94
|
build(deps): bump docker/setup-qemu-action from 2 to 3
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 2 to 3.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/v2...v3)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2023-09-13 04:57:57 +00:00 |
|
dependabot[bot]
|
524ee0563f
|
build(deps): bump docker/bake-action from 3 to 4
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 3 to 4.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/v3...v4)
---
updated-dependencies:
- dependency-name: docker/bake-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2023-09-13 04:57:52 +00:00 |
|
dependabot[bot]
|
91c74bb1dc
|
build(deps): bump docker/build-push-action from 4 to 5
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 4 to 5.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v4...v5)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2023-09-13 04:57:48 +00:00 |
|
CrazyMax
|
2afcb42c88
|
ci: missing concurrency checks
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2023-09-05 11:09:23 +02:00 |
|
dependabot[bot]
|
23d726350c
|
Bump actions/checkout from 3 to 4
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3...v4)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2023-09-05 04:34:21 +00:00 |
|
CrazyMax
|
e5fad018d0
|
ci: check lab releases
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2023-08-26 14:03:23 +02:00 |
|
CrazyMax
|
93b8ecaa2c
|
ci: docker-ce packages are now installed on GitHub Runners
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2023-08-26 14:03:22 +02:00 |
|
CrazyMax
|
a6c26a99ef
|
update ci workflow
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2023-07-06 23:24:05 +02:00 |
|
CrazyMax
|
5bb6d36be0
|
ci: set up and build with k3s
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2023-06-02 14:27:38 +02:00 |
|
dependabot[bot]
|
8ec3610541
|
Bump docker/bake-action from 2 to 3
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 2 to 3.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/v2...v3)
---
updated-dependencies:
- dependency-name: docker/bake-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2023-04-19 04:57:04 +00:00 |
|
CrazyMax
|
81d4866861
|
ci: split validate and test workflow
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2023-03-12 13:58:14 +01:00 |
|
CrazyMax
|
8b13d483f2
|
cleanup input to remove builder and temp files
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2023-03-03 12:08:20 +01:00 |
|
CrazyMax
|
05ca2e6f5e
|
fix current context as builder name for docker driver
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2023-03-02 19:49:22 +01:00 |
|
dependabot[bot]
|
dd904132a2
|
Bump crazy-max/ghaction-dump-context from 1 to 2
Bumps [crazy-max/ghaction-dump-context](https://github.com/crazy-max/ghaction-dump-context) from 1 to 2.
- [Release notes](https://github.com/crazy-max/ghaction-dump-context/releases)
- [Changelog](https://github.com/crazy-max/ghaction-dump-context/blob/master/CHANGELOG.md)
- [Commits](https://github.com/crazy-max/ghaction-dump-context/compare/v1...v2)
---
updated-dependencies:
- dependency-name: crazy-max/ghaction-dump-context
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2023-02-13 04:56:50 +00:00 |
|
CrazyMax
|
9407e67a52
|
update build-push-action to v4
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2023-01-30 19:39:05 +01:00 |
|
CrazyMax
|
39322d9057
|
don't depend on the GitHub API to check release
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2023-01-30 11:56:13 +01:00 |
|
CrazyMax
|
7c965aebec
|
use Octokit client to download buildx
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2023-01-28 01:48:35 +01:00 |
|
CrazyMax
|
f6efb5fcbb
|
platforms input
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2022-10-14 11:47:46 +02:00 |
|
CrazyMax
|
2dfca373f3
|
append nodes to builder support
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2022-10-14 11:46:19 +02:00 |
|
CrazyMax
|
aa0df6f73a
|
nodes metadata JSON ouput
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2022-09-22 03:01:45 +02:00 |
|
CrazyMax
|
7085ac52c5
|
Bump all Docker actions to latest major
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2022-05-05 19:43:45 +02:00 |
|
CrazyMax
|
aa877a9d36
|
ci: fix standalone test
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2022-05-05 18:33:06 +02:00 |
|
CrazyMax
|
7117987c01
|
Merge pull request #119 from crazy-max/standalone
Standalone mode
|
2022-04-26 14:16:39 +02:00 |
|
CrazyMax
|
17ebdd4d65
|
ci: add jobs to check standalone behavior
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2022-04-17 17:22:11 +02:00 |
|
dependabot[bot]
|
5b77ad49e8
|
Bump codecov/codecov-action from 2 to 3
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 2 to 3.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/master/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v2...v3)
---
updated-dependencies:
- dependency-name: codecov/codecov-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2022-04-06 04:02:53 +00:00 |
|
dependabot[bot]
|
2895b304f6
|
Bump actions/checkout from 2 to 3
Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2...v3)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2022-03-02 04:03:41 +00:00 |
|
CrazyMax
|
34e94a5fed
|
Add config-inline input
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2021-09-03 22:21:33 +02:00 |
|
CrazyMax
|
93fe949311
|
Update generated content
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2021-08-20 10:56:04 +02:00 |
|
CrazyMax
|
96016fa2cf
|
Use major
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2021-07-23 12:56:44 +02:00 |
|
dependabot[bot]
|
7c99741146
|
Bump codecov/codecov-action from 1 to 2.0.1
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 1 to 2.0.1.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/master/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v1...v2.0.1)
---
updated-dependencies:
- dependency-name: codecov/codecov-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2021-07-20 04:02:19 +00:00 |
|
CrazyMax
|
580d5c72a2
|
Explicit version spec for caching
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2021-07-11 22:42:24 +02:00 |
|
CrazyMax
|
f40e8894f1
|
Allow building buildx from source
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2021-07-02 07:02:33 +02:00 |
|
CrazyMax
|
36d8e005ca
|
Display BuildKit version
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2021-04-28 18:09:01 +02:00 |
|
CrazyMax
|
881cacd606
|
Remove os limitation
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2021-04-23 22:43:09 +02:00 |
|
CrazyMax
|
f4b1b8d38d
|
Add test job for config input
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2021-04-23 22:26:59 +02:00 |
|
CrazyMax
|
5b1c96aee8
|
Display BuildKit container logs
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2021-04-23 22:08:45 +02:00 |
|
CrazyMax
|
72750233ac
|
Enhance builder inspection
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2021-04-23 18:14:58 +02:00 |
|
CrazyMax
|
cb02c5f3d1
|
Enhance workflow
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2021-04-02 01:19:20 +02:00 |
|
CrazyMax
|
33d65376eb
|
Remove label workflow
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2021-03-18 20:08:45 +01:00 |
|