mirror of
https://github.com/docker/setup-buildx-action.git
synced 2026-11-14 00:37:15 +08:00
- Pin all unpinned action refs to immutable commit SHAs (tag immutability verified via GitHub rulesets API for each repo; all returned false/empty so SHA pinning applied) - Add top-level `permissions: contents: read` to ci.yml, test.yml, and validate.yml (publish.yml already had per-job permissions) - Add `persist-credentials: false` to all actions/checkout steps to prevent credential leakage through GitHub Actions artifacts Findings addressed: unpinned-uses (40 errors), excessive-permissions (27 warnings), artipacked (26 warnings) — 93 findings total Actions pinned: actions/checkout v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 actions/publish-immutable-action v0.0.4 -> 4bc8754ffc40f27910afb20287dbbbb675a4e978 docker/setup-qemu-action v3 -> c7c53464625b32c7a7e944ae62b3e17d2b600130 docker/build-push-action v6 -> 10e90e3645eae34f1e60eeb005ba3a3d33f178e8 docker/build-push-action master -> 789f68658055d3ca993799b232b5c46dfe3f114d docker/bake-action v5 -> 4a9a8d494466d37134e2bfca2d3a8de8fb2681ad crazy-max/ghaction-dump-context v2 -> 5355a8e5e6ac5a302e746a1c4b7747a0393863c8 codecov/codecov-action v4 -> b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 crazy-max/.github install-k3s -> already SHA-pinned (skipped)
40 lines
850 B
YAML
40 lines
850 B
YAML
name: test
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- 'master'
|
|
- 'releases/v*'
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
with:
|
|
persist-credentials: false
|
|
-
|
|
name: Set up Docker Buildx
|
|
uses: ./
|
|
-
|
|
name: Test
|
|
uses: docker/bake-action@4a9a8d494466d37134e2bfca2d3a8de8fb2681ad # v5
|
|
with:
|
|
targets: test
|
|
-
|
|
name: Upload coverage
|
|
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
|
|
with:
|
|
file: ./coverage/clover.xml
|
|
token: ${{ secrets.CODECOV_TOKEN }}
|