feat: Update GitHub actions jobs (#131)

* feat: update trivvy image and code scans Signed-off-by: Sean O'Hair <[email protected]> * feat: update scanning tools versions Signed-off-by: Sean O'Hair <[email protected]> * feat: update test jobs and build job Signed-off-by: Sean O'Hair <[email protected]> --------- Signed-off-by: Sean O'Hair <[email protected]>
intel-retail · Nov 14, 2024 · 8c7d5b6 · 8c7d5b6
1 parent 154171f
commit 8c7d5b6
Show file tree

Hide file tree

Showing 9 changed files with 66 additions and 44 deletions.
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -1,6 +1,11 @@
 name: Build docker images
 
-on: workflow_dispatch
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
 
 permissions:
   contents: read
@@ -10,7 +15,19 @@ jobs:
       runs-on: ubuntu-latest
       steps:
           - name: Checkout code
-            uses: actions/checkout@v3
-          - name: Make Docker images
+            uses: actions/checkout@v4
+          - name: Make Docker image cv-roi
             run: |
-              make docker
+              make cv-roi
+          - name: Make Docker image device-scale
+            run: |
+              make device-scale
+          - name: Make Docker image reconciler
+            run: |
+              make reconciler
+          - name: Make Docker image loss-detector
+            run: |
+              make loss-detector
+          - name: Make Docker image product-loookup
+            run: |
+              make product-lookup
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
@@ -42,11 +42,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3.27.3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -60,7 +60,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3.27.3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -73,6 +73,6 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3.27.3
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/gotest.yaml b/.github/workflows/gotest.yaml
@@ -11,8 +11,8 @@ jobs:
         os: [ubuntu-latest] # macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/setup-go@v3
+    - uses: actions/setup-go@v5.1.0
       with:
         go-version: ${{ matrix.go-version }}
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - run: make go-test 
diff --git a/.github/workflows/integrationTest.yaml b/.github/workflows/integrationTest.yaml
@@ -1,6 +1,11 @@
 name: Integration Test
 
-on: workflow_dispatch
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
 
 permissions:
   contents: read
@@ -10,9 +15,9 @@ jobs:
       runs-on: ubuntu-latest
       steps:
           - name: Checkout code
-            uses: actions/checkout@v3
+            uses: actions/checkout@v4
           - name: Install go
-            uses: actions/setup-go@v4
+            uses: actions/setup-go@v5.1.0
             with:
               go-version: '1.20'
           - name: Make Docker images
@@ -21,7 +26,7 @@ jobs:
               make run-base
               sleep 15
               cd rtsf-at-checkout-event-simulator && mkdir -p "$PWD"/test_results && go run main.go > "$PWD"/test_results/results.txt
-          - uses: actions/upload-artifact@v3
+          - uses: actions/upload-artifact@v4.4.3
             with:
               name: test_results
               path: ${{ github.workspace }}/test_results/
diff --git a/.github/workflows/reports.yaml b/.github/workflows/reports.yaml
@@ -28,7 +28,7 @@ jobs:
           template: report
           token: ${{ secrets.SECURITY_TOKEN }}
       - name: GitHub Upload Release Artifacts
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4.4.3
         with:
           name: report
           path: ./*.pdf
diff --git a/.github/workflows/reviewdog.yaml b/.github/workflows/reviewdog.yaml
@@ -13,11 +13,11 @@ jobs:
       pull-requests: write
     steps:
         - name: Checkout code
-          uses: actions/checkout@v3
+          uses: actions/checkout@v4
           with:
             ref: ${{ github.event.pull_request.head.sha }}
         - name: Install go
-          uses: actions/setup-go@v4
+          uses: actions/setup-go@v5.1.0
           with:
             go-version: '1.20'
         - name: Install golangci-lint
@@ -52,7 +52,7 @@ jobs:
           run: |
             mkdir -p "$PWD"/scan_results
             ./bin/reviewdog -conf .github/.reviewdogConfig.yml -reporter=github-pr-check
-        - uses: actions/upload-artifact@v3
+        - uses: actions/upload-artifact@v4.4.3
           with:
             name: scan_results
             path: ${{ github.workspace }}/scan_results/

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -32,12 +32,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # 2.3.1
+        uses: ossf/scorecard-action@v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -59,14 +59,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
+        uses: actions/upload-artifact@v4.4.3
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4
+        uses: github/codeql-action/upload-sarif@v3.27.3
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/trivy-scan.yaml b/.github/workflows/trivy-scan.yaml
@@ -2,7 +2,7 @@ name: trivy code scan
 on:
   push:
     branches:
-    - master
+    - main
   pull_request:
 permissions:
   contents: read
@@ -13,10 +13,10 @@ jobs:
       contents: read  # for actions/checkout to fetch code
       security-events: write  # for github/codeql-action/upload-sarif to upload SARIF results
     name: trivy scan
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Run Trivy vulnerability scanner in fs mode
       uses: aquasecurity/trivy-action@master
@@ -28,6 +28,6 @@ jobs:
         trivy-config: ./github/.trivyConf.yaml
 
     - name: Upload Trivy scan results to GitHub Security tab
-      uses: github/codeql-action/upload-sarif@v2
+      uses: github/codeql-action/upload-sarif@v3.27.3
       with:
         sarif_file: 'trivy-results.sarif'
diff --git a/.github/workflows/trivyimagescan.yaml b/.github/workflows/trivyimagescan.yaml
@@ -5,12 +5,12 @@
 
 name: trivy_image_scan
 
-# on: workflow_dispatch
 on:
+  workflow_dispatch:
+  pull_request:
   push:
     branches:
-    - master
-  pull_request:
+      - main
 
 permissions:
   contents: read
@@ -25,7 +25,7 @@ jobs:
       runs-on: "ubuntu-latest"
       steps:
         - name: Checkout code
-          uses: actions/checkout@v3
+          uses: actions/checkout@v4
           with:
             ref: main
         # cv-region-of-interest
@@ -34,15 +34,15 @@ jobs:
             echo "running make build benchmark"
             make cv-roi
         - name: Run Trivy vulnerability scanner
-          uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
+          uses: aquasecurity/trivy-action@master
           with:
             image-ref: 'rtsf-at-checkout/cv-region-of-interest:dev'
             format: 'template'
             template: '@/contrib/sarif.tpl'
             output: 'trivy-results-cv-region-of-interest.sarif'
             severity: 'CRITICAL,HIGH'
         - name: Upload Trivy scan results to GitHub Security tab
-          uses: github/codeql-action/upload-sarif@v2
+          uses: github/codeql-action/upload-sarif@v3.27.3
           with:
             sarif_file: 'trivy-results-cv-region-of-interest.sarif'
 
@@ -55,7 +55,7 @@ jobs:
       runs-on: "ubuntu-latest"
       steps:
         - name: Checkout code
-          uses: actions/checkout@v3
+          uses: actions/checkout@v4
           with:
             ref: main
         # device-scale
@@ -64,15 +64,15 @@ jobs:
             echo "running make build benchmark"
             make device-scale
         - name: Run Trivy vulnerability scanner
-          uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
+          uses: aquasecurity/trivy-action@master
           with:
             image-ref: 'rtsf-at-checkout/device-scale:dev'
             format: 'template'
             template: '@/contrib/sarif.tpl'
             output: 'trivy-results-device-scale.sarif'
             severity: 'CRITICAL,HIGH'
         - name: Upload Trivy scan results to GitHub Security tab
-          uses: github/codeql-action/upload-sarif@v2
+          uses: github/codeql-action/upload-sarif@v3.27.3
           with:
             sarif_file: 'trivy-results-device-scale.sarif'
 
@@ -85,7 +85,7 @@ jobs:
       runs-on: "ubuntu-latest"
       steps:
         - name: Checkout code
-          uses: actions/checkout@v3
+          uses: actions/checkout@v4
           with:
             ref: main
         # reconciler
@@ -94,15 +94,15 @@ jobs:
             echo "running make build benchmark"
             make reconciler
         - name: Run Trivy vulnerability scanner
-          uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
+          uses: aquasecurity/trivy-action@master
           with:
             image-ref: 'rtsf-at-checkout/event-reconciler:dev'
             format: 'template'
             template: '@/contrib/sarif.tpl'
             output: 'trivy-results-reconciler.sarif'
             severity: 'CRITICAL,HIGH'
         - name: Upload Trivy scan results to GitHub Security tab
-          uses: github/codeql-action/upload-sarif@v2
+          uses: github/codeql-action/upload-sarif@v3.27.3
           with:
             sarif_file: 'trivy-results-reconciler.sarif'
 
@@ -115,7 +115,7 @@ jobs:
       runs-on: "ubuntu-latest"
       steps:
         - name: Checkout code
-          uses: actions/checkout@v3
+          uses: actions/checkout@v4
           with:
             ref: main
         # loss-detector
@@ -124,15 +124,15 @@ jobs:
             echo "running make build benchmark"
             make loss-detector
         - name: Run Trivy vulnerability scanner
-          uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
+          uses: aquasecurity/trivy-action@master
           with:
             image-ref: 'rtsf-at-checkout/loss-detector:dev'
             format: 'template'
             template: '@/contrib/sarif.tpl'
             output: 'trivy-results-loss-detector.sarif'
             severity: 'CRITICAL,HIGH'
         - name: Upload Trivy scan results to GitHub Security tab
-          uses: github/codeql-action/upload-sarif@v2
+          uses: github/codeql-action/upload-sarif@v3.27.3
           with:
             sarif_file: 'trivy-results-loss-detector.sarif'
 
@@ -145,7 +145,7 @@ jobs:
       runs-on: "ubuntu-latest"
       steps:
         - name: Checkout code
-          uses: actions/checkout@v3
+          uses: actions/checkout@v4
           with:
             ref: main
         # product-lookup
@@ -154,14 +154,14 @@ jobs:
             echo "running make build benchmark"
             make product-lookup
         - name: Run Trivy vulnerability scanner
-          uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
+          uses: aquasecurity/trivy-action@master
           with:
             image-ref: 'rtsf-at-checkout/product-lookup:dev'
             format: 'template'
             template: '@/contrib/sarif.tpl'
             output: 'trivy-results-product-lookup.sarif'
             severity: 'CRITICAL,HIGH'
         - name: Upload Trivy scan results to GitHub Security tab
-          uses: github/codeql-action/upload-sarif@v2
+          uses: github/codeql-action/upload-sarif@v3.27.3
           with:
             sarif_file: 'trivy-results-product-lookup.sarif'