From 26419014dfb9ac80dd7c113d02abf1c3408a65d1 Mon Sep 17 00:00:00 2001 From: Nic Cheneweth Date: Fri, 17 May 2024 11:06:00 -0500 Subject: [PATCH] [nc] revert ref bak to @main until all the initial actions are correct Signed-off-by: Nic Cheneweth --- .../workflows/job-container-dev-release.yaml | 22 +++++++------- .github/workflows/publish-container.yaml | 29 ++++++++++++------- .github/workflows/release-version.yaml | 2 +- .github/workflows/static-code-analysis.yaml | 6 ++-- README.md | 2 +- op.env | 7 ----- 6 files changed, 34 insertions(+), 34 deletions(-) delete mode 100644 op.env diff --git a/.github/workflows/job-container-dev-release.yaml b/.github/workflows/job-container-dev-release.yaml index 99e5932..03d8fa4 100644 --- a/.github/workflows/job-container-dev-release.yaml +++ b/.github/workflows/job-container-dev-release.yaml @@ -240,7 +240,7 @@ on: description: default is latest type: string required: false - default: "twdps/gha-container-builder:0.1.0" + default: "latest" jobs: @@ -257,7 +257,7 @@ jobs: uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 - name: install dev-release dependencies - uses: ThoughtWorks-DPS/gha-tools-action/install@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/install@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: op-version: ${{ inputs.op-version }} teller-version: ${{ inputs.teller-version }} @@ -275,7 +275,7 @@ jobs: instance: ${{ inputs.before-static-analysis }} - name: hadolint dockerfile - uses: ThoughtWorks-DPS/gha-tools-action/hadolint@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/hadolint@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} path: ${{ inputs.path }} @@ -283,7 +283,7 @@ jobs: hadolint-additional-args: ${{ inputs.hadolint-additional-args }} - name: confirm registry credentials and access - uses: ThoughtWorks-DPS/gha-tools-action/confirm-registry@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/confirm-registry@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: registry: ${{ inputs.registry }} @@ -295,14 +295,14 @@ jobs: - name: set org.opencontainer creation date and version labels if: ${{ inputs.opencontainer-labels == 'true' }} - uses: ThoughtWorks-DPS/gha-tools-action/set-labels@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/set-labels@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} path: ${{ inputs.path }} dockerfile: ${{ inputs.dockerfile }} - name: build gha container image - uses: ThoughtWorks-DPS/gha-tools-action/build@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/build@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} registry: ${{ inputs.registry}} @@ -314,7 +314,7 @@ jobs: - name: perform snyk cve scan if: ${{ inputs.snyk-scan == 'true' }} - uses: ThoughtWorks-DPS/gha-tools-action/snyk-scan@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/snyk-scan@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} registry: ${{ inputs.registry}} @@ -330,7 +330,7 @@ jobs: - name: perform trivy image scan if: ${{ inputs.trivy-scan == 'true' }} - uses: ThoughtWorks-DPS/gha-tools-action/trivy-scan@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/trivy-scan@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} registry: ${{ inputs.registry}} @@ -341,7 +341,7 @@ jobs: - name: perform grype image scan if: ${{ inputs.grype-scan == 'true' }} - uses: ThoughtWorks-DPS/gha-tools-action/grype-scan@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/grype-scan@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} registry: ${{ inputs.registry}} @@ -352,7 +352,7 @@ jobs: - name: run bats test against running container if: ${{ inputs.bats-test == 'true' }} - uses: ThoughtWorks-DPS/gha-tools-action/bats-test@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/bats-test@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} registry: ${{ inputs.registry }} @@ -369,7 +369,7 @@ jobs: instance: ${{ inputs.after-build }} - name: push image to container registry - uses: ThoughtWorks-DPS/gha-tools-action/push@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/push@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} registry: ${{ inputs.registry}} diff --git a/.github/workflows/publish-container.yaml b/.github/workflows/publish-container.yaml index dc059d6..d1e70fb 100644 --- a/.github/workflows/publish-container.yaml +++ b/.github/workflows/publish-container.yaml @@ -156,11 +156,18 @@ on: type: string default: "false" + builder-image-version: + description: default is latest + type: string + required: false + default: "latest" + jobs: publish-container: name: publish job container to registry runs-on: ubuntu-latest + container: ${{ inputs.builder-image-version }} env: OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} @@ -170,7 +177,7 @@ jobs: uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 - name: install publish dependencies - uses: ThoughtWorks-DPS/gha-tools-action/install@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/install@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: op-version: ${{ inputs.op-version }} teller-version: ${{ inputs.teller-version }} @@ -186,12 +193,12 @@ jobs: instance: ${{ inputs.before-publish }} - name: confirm registry credentials and access - uses: ThoughtWorks-DPS/gha-tools-action/confirm-registry@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/confirm-registry@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: registry: ${{ inputs.registry }} - name: pull image to be published - uses: ThoughtWorks-DPS/gha-tools-action/pull@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/pull@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} registry: ${{ inputs.registry}} @@ -199,7 +206,7 @@ jobs: tag: ${{ inputs.pull-tag }} - name: tag image with release version - uses: ThoughtWorks-DPS/gha-tools-action/tag@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/tag@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} registry: ${{ inputs.registry}} @@ -209,7 +216,7 @@ jobs: - name: create additional release version tag if: ${{ inputs.release-tag != 'false' }} - uses: ThoughtWorks-DPS/gha-tools-action/tag@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/tag@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} registry: ${{ inputs.registry}} @@ -218,7 +225,7 @@ jobs: release-tag: ${{ inputs.release-tag }} - name: push image to container registry - uses: ThoughtWorks-DPS/gha-tools-action/push@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/push@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} registry: ${{ inputs.registry}} @@ -227,7 +234,7 @@ jobs: - name: push additional release tag to container registry if: ${{ inputs.release-tag != 'false' }} - uses: ThoughtWorks-DPS/gha-tools-action/push@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/push@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} registry: ${{ inputs.registry}} @@ -242,7 +249,7 @@ jobs: - name: sign image using cosign if: ${{ inputs.sign-image == 'true' }} - uses: ThoughtWorks-DPS/gha-tools-action/sign@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/sign@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} registry: ${{ inputs.registry}} @@ -254,7 +261,7 @@ jobs: - name: generate sbom if: ${{ inputs.sign-image == 'true' }} - uses: ThoughtWorks-DPS/gha-tools-action/sbom@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/sbom@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: working-directory: ${{ inputs.working-directory }} registry: ${{ inputs.registry}} @@ -262,13 +269,13 @@ jobs: - name: generate release notes if: ${{ inputs.gren == 'true' }} - uses: ThoughtWorks-DPS/common-actions/gren@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/common-actions/gren@4baf5677df945981d15017f0ffed8acaba1c6d8f # v0.2.1 with: gren-additional-args: ${{ inputs.gren-additional-args }} - name: post new release message if: ${{ inputs.release-message != 'false' }} - uses: ThoughtWorks-DPS/common-actions/slack-bot@b7cf3979fa5745551c5a62afa5e8e07f75ffa687 # v0.1.0 + uses: ThoughtWorks-DPS/common-actions/slack-bot@f99d7641298c1d30a991c6bb51a5ce335901c47e # v0.2.0 with: channel: lab-events message: ${{ inputs.release-message }} diff --git a/.github/workflows/release-version.yaml b/.github/workflows/release-version.yaml index 0e3c331..e855b88 100644 --- a/.github/workflows/release-version.yaml +++ b/.github/workflows/release-version.yaml @@ -66,7 +66,7 @@ jobs: - name: post new release message if: ${{ inputs.release-message != 'false' }} - uses: ThoughtWorks-DPS/common-actions/slack-bot@b7cf3979fa5745551c5a62afa5e8e07f75ffa687 # v0.1.0 + uses: ThoughtWorks-DPS/common-actions/slack-bot@main with: channel: lab-events message: ${{ inputs.release-message }} diff --git a/.github/workflows/static-code-analysis.yaml b/.github/workflows/static-code-analysis.yaml index 8df83ae..79b96bc 100644 --- a/.github/workflows/static-code-analysis.yaml +++ b/.github/workflows/static-code-analysis.yaml @@ -109,10 +109,10 @@ jobs: instance: ${{ inputs.before-static-analysis }} - name: gha-tools-action/lint - uses: ThoughtWorks-DPS/gha-tools-action/lint@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/lint@main - name: gha-tools-action/check - uses: ThoughtWorks-DPS/gha-tools-action/check@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/check@main with: working-directory: ${{ inputs.working-directory }} shellcheck-version: ${{ inputs.shellcheck-version }} @@ -126,7 +126,7 @@ jobs: shellcheck-format: ${{ inputs.shellcheck-format }} - name: gha-tools-action/scorecard - uses: ThoughtWorks-DPS/gha-tools-action/scorecard@62fed61ee4a732fb309006ef6c55f348b7db3441 # v0.2.0 + uses: ThoughtWorks-DPS/gha-tools-action/scorecard@main - name: run custom after-static-analysis action if: ${{ inputs.after-static-analysis != 'false' }} diff --git a/README.md b/README.md index 5eb82b6..818260b 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ Provides four workflows: ### static-code-analysis workflow -Performs the following actions. +Performs the following static code analysis. 1. yamllint 2. shellcheck 3. ossf/scorecard and upload results to repo security dashboard diff --git a/op.env b/op.env deleted file mode 100644 index fe9a891..0000000 --- a/op.env +++ /dev/null @@ -1,7 +0,0 @@ -export DOCKER_LOGIN=op://empc-lab/svc-dockerhub/username -export DOCKER_PASSWORD=op://empc-lab/svc-dockerhub/password -export COSIGN_PASSWORD=op://empc-lab/svc-cosign/passphrase -export SNYK_TOKEN=op://empc-lab/svc-snyk/api-token -export GREN_GITHUB_TOKEN=op://empc-lab/svc-github/access-token -export SLACK_BOT_TOKEN=op://empc-lab/svc-slack/post-bot-token -export CIRCLE_TOKEN=op://empc-lab/svc-circleci/api-token \ No newline at end of file