mirror of
https://github.com/docker/setup-buildx-action.git
synced 2026-11-14 00:37:15 +08:00
265af8a183
- Pin all unpinned action refs to immutable commit SHAs (tag immutability verified via GitHub rulesets API for each repo; all returned false/empty so SHA pinning applied) - Add top-level `permissions: contents: read` to ci.yml, test.yml, and validate.yml (publish.yml already had per-job permissions) - Add `persist-credentials: false` to all actions/checkout steps to prevent credential leakage through GitHub Actions artifacts Findings addressed: unpinned-uses (40 errors), excessive-permissions (27 warnings), artipacked (26 warnings) — 93 findings total Actions pinned: actions/checkout v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 actions/publish-immutable-action v0.0.4 -> 4bc8754ffc40f27910afb20287dbbbb675a4e978 docker/setup-qemu-action v3 -> c7c53464625b32c7a7e944ae62b3e17d2b600130 docker/build-push-action v6 -> 10e90e3645eae34f1e60eeb005ba3a3d33f178e8 docker/build-push-action master -> 789f68658055d3ca993799b232b5c46dfe3f114d docker/bake-action v5 -> 4a9a8d494466d37134e2bfca2d3a8de8fb2681ad crazy-max/ghaction-dump-context v2 -> 5355a8e5e6ac5a302e746a1c4b7747a0393863c8 codecov/codecov-action v4 -> b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 crazy-max/.github install-k3s -> already SHA-pinned (skipped)
53 lines
1.2 KiB
YAML
53 lines
1.2 KiB
YAML
name: validate
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- 'master'
|
|
- 'releases/v*'
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
prepare:
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
targets: ${{ steps.targets.outputs.matrix }}
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
with:
|
|
persist-credentials: false
|
|
-
|
|
name: Targets matrix
|
|
id: targets
|
|
run: |
|
|
echo "matrix=$(docker buildx bake validate --print | jq -cr '.group.validate.targets')" >> $GITHUB_OUTPUT
|
|
|
|
validate:
|
|
runs-on: ubuntu-latest
|
|
needs:
|
|
- prepare
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
target: ${{ fromJson(needs.prepare.outputs.targets) }}
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
with:
|
|
persist-credentials: false
|
|
-
|
|
name: Validate
|
|
uses: docker/bake-action@4a9a8d494466d37134e2bfca2d3a8de8fb2681ad # v5
|
|
with:
|
|
targets: ${{ matrix.target }}
|