docker/setup-buildx-action
1
0
Fork 0
mirror of https://github.com/docker/setup-buildx-action.git synced 2026-11-14 00:37:15 +08:00
Code Issues Packages Projects Releases Wiki Activity
500 Commits 18 Branches 56 Tags
Commit Graph

28 Commits

Author SHA1 Message Date
Stelian Ionescu
bbf3551cb8 Pin ubuntu-latest to 4cpu-gh-ubuntu24-x64 2026-10-15 14:32:04 -06:00
zi0Black
265af8a183 ci: harden GitHub Actions workflows (zizmor audit) 
- Pin all unpinned action refs to immutable commit SHAs (tag
  immutability verified via GitHub rulesets API for each repo;
  all returned false/empty so SHA pinning applied)
- Add top-level `permissions: contents: read` to ci.yml, test.yml,
  and validate.yml (publish.yml already had per-job permissions)
- Add `persist-credentials: false` to all actions/checkout steps
  to prevent credential leakage through GitHub Actions artifacts

Findings addressed: unpinned-uses (40 errors), excessive-permissions
(27 warnings), artipacked (26 warnings) — 93 findings total

Actions pinned:
  actions/checkout v4                  -> 34e114876b0b11c390a56381ad16ebd13914f8d5
  actions/publish-immutable-action v0.0.4 -> 4bc8754ffc40f27910afb20287dbbbb675a4e978
  docker/setup-qemu-action v3          -> c7c53464625b32c7a7e944ae62b3e17d2b600130
  docker/build-push-action v6          -> 10e90e3645eae34f1e60eeb005ba3a3d33f178e8
  docker/build-push-action master      -> 789f68658055d3ca993799b232b5c46dfe3f114d
  docker/bake-action v5                -> 4a9a8d494466d37134e2bfca2d3a8de8fb2681ad
  crazy-max/ghaction-dump-context v2   -> 5355a8e5e6ac5a302e746a1c4b7747a0393863c8
  codecov/codecov-action v4            -> b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238
  crazy-max/.github install-k3s        -> already SHA-pinned (skipped)
 2026-05-14 00:34:57 +02:00
dependabot[bot]
e9ab4c6a14
build(deps): bump docker/bake-action from 4 to 5 
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 4 to 5.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/v4...v5)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-06-18 04:09:56 +00:00
CrazyMax
74c5b717e5
bump codecov/codecov-action from 3 to 4 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2024-02-23 09:15:27 +01:00
dependabot[bot]
524ee0563f
build(deps): bump docker/bake-action from 3 to 4 
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 3 to 4.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/v3...v4)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-09-13 04:57:52 +00:00
CrazyMax
2afcb42c88
ci: missing concurrency checks 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
 2023-09-05 11:09:23 +02:00
dependabot[bot]
23d726350c
Bump actions/checkout from 3 to 4 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-09-05 04:34:21 +00:00
dependabot[bot]
8ec3610541
Bump docker/bake-action from 2 to 3 
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 2 to 3.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/v2...v3)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-04-19 04:57:04 +00:00
CrazyMax
81d4866861
ci: split validate and test workflow 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
 2023-03-12 13:58:14 +01:00
CrazyMax
39322d9057
don't depend on the GitHub API to check release 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
 2023-01-30 11:56:13 +01:00
CrazyMax
7c965aebec
use Octokit client to download buildx 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
 2023-01-28 01:48:35 +01:00
CrazyMax
7085ac52c5
Bump all Docker actions to latest major 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
 2022-05-05 19:43:45 +02:00
dependabot[bot]
5b77ad49e8
Bump codecov/codecov-action from 2 to 3 
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 2 to 3.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/master/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v2...v3)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-04-06 04:02:53 +00:00
dependabot[bot]
2895b304f6
Bump actions/checkout from 2 to 3 
Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-03-02 04:03:41 +00:00
CrazyMax
96016fa2cf
Use major 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
 2021-07-23 12:56:44 +02:00
dependabot[bot]
7c99741146
Bump codecov/codecov-action from 1 to 2.0.1 
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 1 to 2.0.1.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/master/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v1...v2.0.1)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-07-20 04:02:19 +00:00
CrazyMax
72750233ac
Enhance builder inspection 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
 2021-04-23 18:14:58 +02:00
CrazyMax
cb02c5f3d1
Enhance workflow 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
 2021-04-02 01:19:20 +02:00
CrazyMax
3e60c35816
Use major version of actions 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
 2020-11-18 18:13:18 +01:00
dependabot[bot]
0c969bab1f
Bump actions/checkout from v2.3.3 to v2.3.4 
Bumps [actions/checkout](https://github.com/actions/checkout) from v2.3.3 to v2.3.4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2.3.3...5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f)

Signed-off-by: dependabot[bot] <support@github.com>
 2020-11-04 06:07:09 +00:00
dependabot[bot]
19625e207e
Bump codecov/codecov-action from v1.0.13 to v1.0.14 
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from v1.0.13 to v1.0.14.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Commits](https://github.com/codecov/codecov-action/compare/v1.0.13...7d5dfa54903bd909319c580a00535b483d1efcf3)

Signed-off-by: dependabot[bot] <support@github.com>
 2020-10-19 04:17:50 +00:00
dependabot[bot]
a96332da3d
Bump actions/checkout from v2.3.2 to v2.3.3 
Bumps [actions/checkout](https://github.com/actions/checkout) from v2.3.2 to v2.3.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2.3.2...a81bbbf8298c0fa03ea29cdc473d45769f953675)

Signed-off-by: dependabot[bot] <support@github.com>
 2020-09-24 04:22:55 +00:00
dependabot[bot]
c6558dc722
Bump codecov/codecov-action from v1.0.7 to v1.0.13 
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from v1.0.7 to v1.0.13.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Commits](https://github.com/codecov/codecov-action/compare/v1.0.7...6004246f47ab62d32be025ce173b241cd84ac58e)

Signed-off-by: dependabot[bot] <support@github.com>
 2020-08-28 04:22:08 +00:00
CrazyMax
a98999d27d
Enable Codecov and upload coverage 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
 2020-08-27 17:41:10 +02:00
Tõnis Tiigi
41ae3d0e5f
Add container based dev flow (#4) 
* add container based dev flow

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

* Fix yarn test for container based dev flow

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

* Update contributing guidelines and test workflow

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Co-authored-by: CrazyMax <crazy-max@users.noreply.github.com>
 2020-08-26 23:48:38 +00:00
dependabot[bot]
71d3c9c7b8
Bump actions/checkout from v2.3.1 to v2.3.2 (#2) 
Bumps [actions/checkout](https://github.com/actions/checkout) from v2.3.1 to v2.3.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2.3.1...2036a08e25fa78bbd946711a407b529a0a1204bf)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2020-08-19 11:25:48 +00:00
CrazyMax
8cc9abb19a
Trigger workflow 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
 2020-08-18 17:45:23 +02:00
CrazyMax
04eaa7c789
Initial commit (docker/build-push-action#87) 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
 2020-08-18 17:40:31 +02:00