mirrors/krata
1
0
Fork 0
mirror of https://github.com/edera-dev/krata.git synced 2025-08-03 21:21:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Pin actions to digests and introduce Step Security Harden Runners (#137)

Browse Source 
Signed-off-by: Jed Salazar <jedsalazar@gmail.com>
This commit is contained in:
Jed Salazar
2024-05-10 17:00:56 -07:00
committed by GitHub
parent 485f6e8319
commit 0193921053
8 changed files with 100 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
.github/workflows/check.yml vendored
View File

@ -11,10 +11,14 @@ jobs:
name: fmt name: fmt
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
with: with:
components: rustfmt components: rustfmt
- run: ./hack/ci/install-linux-deps.sh - run: ./hack/ci/install-linux-deps.sh
@ -23,7 +27,11 @@ jobs:
name: shellcheck name: shellcheck
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
- run: ./hack/code/shellcheck.sh - run: ./hack/code/shellcheck.sh

12
.github/workflows/client.yml vendored
View File

@ -27,18 +27,22 @@ jobs:
run: run:
shell: bash shell: bash
steps: steps:
- name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- run: git config --global core.autocrlf false && git config --global core.eol lf - run: git config --global core.autocrlf false && git config --global core.eol lf
if: ${{ matrix.platform.os == 'windows' }} if: ${{ matrix.platform.os == 'windows' }}
- uses: actions/checkout@v4 - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
if: ${{ matrix.platform.os != 'darwin' }} if: ${{ matrix.platform.os != 'darwin' }}
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
with: with:
targets: "${{ matrix.platform.arch }}-apple-darwin" targets: "${{ matrix.platform.arch }}-apple-darwin"
if: ${{ matrix.platform.os == 'darwin' }} if: ${{ matrix.platform.os == 'darwin' }}
- uses: homebrew/actions/setup-homebrew@master - uses: homebrew/actions/setup-homebrew@4b34604e75af8f8b23b454f0b5ffb7c5d8ce0056 # master
if: ${{ matrix.platform.os == 'darwin' }} if: ${{ matrix.platform.os == 'darwin' }}
- run: ./hack/ci/install-${{ matrix.platform.deps }}-deps.sh - run: ./hack/ci/install-${{ matrix.platform.deps }}-deps.sh
- run: ./hack/build/cargo.sh build --bin kratactl - run: ./hack/build/cargo.sh build --bin kratactl

8
.github/workflows/kernel.yml vendored
View File

@ -22,10 +22,14 @@ jobs:
TARGET_ARCH: "${{ matrix.arch }}" TARGET_ARCH: "${{ matrix.arch }}"
name: kernel build ${{ matrix.arch }} name: kernel build ${{ matrix.arch }}
steps: steps:
- uses: actions/checkout@v4 - name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
- run: ./hack/ci/install-linux-deps.sh - run: ./hack/ci/install-linux-deps.sh
- run: ./hack/kernel/build.sh - run: ./hack/kernel/build.sh
env: env:

34
.github/workflows/nightly.yml vendored
View File

@ -16,17 +16,22 @@ jobs:
TARGET_ARCH: "${{ matrix.arch }}" TARGET_ARCH: "${{ matrix.arch }}"
name: nightly server ${{ matrix.arch }} name: nightly server ${{ matrix.arch }}
steps: steps:
- uses: actions/checkout@v4 - name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
with: with:
targets: "${{ matrix.arch }}-unknown-linux-gnu,${{ matrix.arch }}-unknown-linux-musl" targets: "${{ matrix.arch }}-unknown-linux-gnu,${{ matrix.arch }}-unknown-linux-musl"
- run: ./hack/ci/install-linux-deps.sh - run: ./hack/ci/install-linux-deps.sh
- run: ./hack/dist/bundle.sh - run: ./hack/dist/bundle.sh
env: env:
KRATA_KERNEL_BUILD_JOBS: "5" KRATA_KERNEL_BUILD_JOBS: "5"
- uses: actions/upload-artifact@v4 - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with: with:
name: krata-bundle-systemd-${{ matrix.arch }} name: krata-bundle-systemd-${{ matrix.arch }}
path: "target/dist/bundle-systemd-${{ matrix.arch }}.tgz" path: "target/dist/bundle-systemd-${{ matrix.arch }}.tgz"
@ -34,7 +39,7 @@ jobs:
- run: ./hack/dist/deb.sh - run: ./hack/dist/deb.sh
env: env:
KRATA_KERNEL_BUILD_SKIP: "1" KRATA_KERNEL_BUILD_SKIP: "1"
- uses: actions/upload-artifact@v4 - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with: with:
name: krata-debian-${{ matrix.arch }} name: krata-debian-${{ matrix.arch }}
path: "target/dist/*.deb" path: "target/dist/*.deb"
@ -42,7 +47,7 @@ jobs:
- run: ./hack/dist/apk.sh - run: ./hack/dist/apk.sh
env: env:
KRATA_KERNEL_BUILD_SKIP: "1" KRATA_KERNEL_BUILD_SKIP: "1"
- uses: actions/upload-artifact@v4 - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with: with:
name: krata-alpine-${{ matrix.arch }} name: krata-alpine-${{ matrix.arch }}
path: "target/dist/*_${{ matrix.arch }}.apk" path: "target/dist/*_${{ matrix.arch }}.apk"
@ -50,7 +55,7 @@ jobs:
- run: ./hack/os/build.sh - run: ./hack/os/build.sh
env: env:
KRATA_KERNEL_BUILD_SKIP: "1" KRATA_KERNEL_BUILD_SKIP: "1"
- uses: actions/upload-artifact@v4 - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with: with:
name: krata-os-${{ matrix.arch }} name: krata-os-${{ matrix.arch }}
path: "target/os/krata-${{ matrix.arch }}.qcow2" path: "target/os/krata-${{ matrix.arch }}.qcow2"
@ -75,27 +80,32 @@ jobs:
run: run:
shell: bash shell: bash
steps: steps:
- name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- run: git config --global core.autocrlf false && git config --global core.eol lf - run: git config --global core.autocrlf false && git config --global core.eol lf
if: ${{ matrix.platform.os == 'windows' }} if: ${{ matrix.platform.os == 'windows' }}
- uses: actions/checkout@v4 - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
if: ${{ matrix.platform.os != 'darwin' }} if: ${{ matrix.platform.os != 'darwin' }}
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
with: with:
targets: "${{ matrix.platform.arch }}-apple-darwin" targets: "${{ matrix.platform.arch }}-apple-darwin"
if: ${{ matrix.platform.os == 'darwin' }} if: ${{ matrix.platform.os == 'darwin' }}
- uses: homebrew/actions/setup-homebrew@master - uses: homebrew/actions/setup-homebrew@4b34604e75af8f8b23b454f0b5ffb7c5d8ce0056 # master
if: ${{ matrix.platform.os == 'darwin' }} if: ${{ matrix.platform.os == 'darwin' }}
- run: ./hack/ci/install-${{ matrix.platform.deps }}-deps.sh - run: ./hack/ci/install-${{ matrix.platform.deps }}-deps.sh
- run: ./hack/build/cargo.sh build --release --bin kratactl - run: ./hack/build/cargo.sh build --release --bin kratactl
- uses: actions/upload-artifact@v4 - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with: with:
name: kratactl-${{ matrix.platform.os }}-${{ matrix.platform.arch }} name: kratactl-${{ matrix.platform.os }}-${{ matrix.platform.arch }}
path: "target/*/release/kratactl" path: "target/*/release/kratactl"
if: ${{ matrix.platform.os != 'windows' }} if: ${{ matrix.platform.os != 'windows' }}
- uses: actions/upload-artifact@v4 - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with: with:
name: kratactl-${{ matrix.platform.os }}-${{ matrix.platform.arch }} name: kratactl-${{ matrix.platform.os }}-${{ matrix.platform.arch }}
path: "target/*/release/kratactl.exe" path: "target/*/release/kratactl.exe"

10
.github/workflows/os.yml vendored
View File

@ -23,17 +23,21 @@ jobs:
TARGET_ARCH: "${{ matrix.arch }}" TARGET_ARCH: "${{ matrix.arch }}"
name: os build ${{ matrix.arch }} name: os build ${{ matrix.arch }}
steps: steps:
- uses: actions/checkout@v4 - name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
with: with:
targets: "${{ matrix.arch }}-unknown-linux-gnu,${{ matrix.arch }}-unknown-linux-musl" targets: "${{ matrix.arch }}-unknown-linux-gnu,${{ matrix.arch }}-unknown-linux-musl"
- run: ./hack/ci/install-linux-deps.sh - run: ./hack/ci/install-linux-deps.sh
- run: ./hack/os/build.sh - run: ./hack/os/build.sh
env: env:
KRATA_KERNEL_BUILD_JOBS: "5" KRATA_KERNEL_BUILD_JOBS: "5"
- uses: actions/upload-artifact@v4 - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with: with:
name: krata-os-${{ matrix.arch }} name: krata-os-${{ matrix.arch }}
path: "target/os/krata-${{ matrix.arch }}.qcow2" path: "target/os/krata-${{ matrix.arch }}.qcow2"

18
.github/workflows/release-binaries.yml vendored
View File

@ -25,10 +25,14 @@ jobs:
TARGET_ARCH: "${{ matrix.arch }}" TARGET_ARCH: "${{ matrix.arch }}"
name: release-binaries server ${{ matrix.arch }} name: release-binaries server ${{ matrix.arch }}
steps: steps:
- uses: actions/checkout@v4 - name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
with: with:
targets: "${{ matrix.arch }}-unknown-linux-gnu,${{ matrix.arch }}-unknown-linux-musl" targets: "${{ matrix.arch }}-unknown-linux-gnu,${{ matrix.arch }}-unknown-linux-musl"
- run: ./hack/ci/install-linux-deps.sh - run: ./hack/ci/install-linux-deps.sh
@ -72,16 +76,20 @@ jobs:
shell: bash shell: bash
timeout-minutes: 60 timeout-minutes: 60
steps: steps:
- uses: actions/checkout@v4 - name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
if: ${{ matrix.platform.os != 'darwin' }} if: ${{ matrix.platform.os != 'darwin' }}
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@stable
with: with:
targets: "${{ matrix.platform.arch }}-apple-darwin" targets: "${{ matrix.platform.arch }}-apple-darwin"
if: ${{ matrix.platform.os == 'darwin' }} if: ${{ matrix.platform.os == 'darwin' }}
- uses: homebrew/actions/setup-homebrew@master - uses: homebrew/actions/setup-homebrew@4b34604e75af8f8b23b454f0b5ffb7c5d8ce0056 # master
if: ${{ matrix.platform.os == 'darwin' }} if: ${{ matrix.platform.os == 'darwin' }}
- run: ./hack/ci/install-${{ matrix.platform.deps }}-deps.sh - run: ./hack/ci/install-${{ matrix.platform.deps }}-deps.sh
- run: ./hack/build/cargo.sh build --release --bin kratactl - run: ./hack/build/cargo.sh build --release --bin kratactl

12
.github/workflows/release-plz.yml vendored
View File

@ -14,20 +14,24 @@ jobs:
name: release-plz name: release-plz
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/create-github-app-token@v1 - name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- uses: actions/create-github-app-token@a0de6af83968303c8c955486bf9739a57d23c7f1 # v1.10.0
id: generate-token id: generate-token
with: with:
app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}" app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}" private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
- uses: actions/checkout@v4 - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
fetch-depth: 0 fetch-depth: 0
token: "${{ steps.generate-token.outputs.token }}" token: "${{ steps.generate-token.outputs.token }}"
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
- run: ./hack/ci/install-linux-deps.sh - run: ./hack/ci/install-linux-deps.sh
- name: release-plz - name: release-plz
uses: MarcoIeni/release-plz-action@v0.5 uses: MarcoIeni/release-plz-action@76e66a600f00c1f47dd1a2f3169f97a5213dc90b # v0.5.55
env: env:
GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}" GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}"
CARGO_REGISTRY_TOKEN: "${{ secrets.KRATA_RELEASE_CARGO_TOKEN }}" CARGO_REGISTRY_TOKEN: "${{ secrets.KRATA_RELEASE_CARGO_TOKEN }}"

33
.github/workflows/server.yml vendored
View File

@ -19,10 +19,14 @@ jobs:
TARGET_ARCH: "${{ matrix.arch }}" TARGET_ARCH: "${{ matrix.arch }}"
name: server build ${{ matrix.arch }} name: server build ${{ matrix.arch }}
steps: steps:
- uses: actions/checkout@v4 - name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
- run: ./hack/ci/install-linux-deps.sh - run: ./hack/ci/install-linux-deps.sh
- run: ./hack/build/cargo.sh build - run: ./hack/build/cargo.sh build
test: test:
@ -36,10 +40,15 @@ jobs:
TARGET_ARCH: "${{ matrix.arch }}" TARGET_ARCH: "${{ matrix.arch }}"
name: server test ${{ matrix.arch }} name: server test ${{ matrix.arch }}
steps: steps:
- uses: actions/checkout@v4 - name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
- run: ./hack/ci/install-linux-deps.sh - run: ./hack/ci/install-linux-deps.sh
- run: ./hack/build/cargo.sh test - run: ./hack/build/cargo.sh test
clippy: clippy:
@ -53,10 +62,14 @@ jobs:
TARGET_ARCH: "${{ matrix.arch }}" TARGET_ARCH: "${{ matrix.arch }}"
name: server clippy ${{ matrix.arch }} name: server clippy ${{ matrix.arch }}
steps: steps:
- uses: actions/checkout@v4 - name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
with: with:
components: clippy components: clippy
- run: ./hack/ci/install-linux-deps.sh - run: ./hack/ci/install-linux-deps.sh
@ -72,10 +85,14 @@ jobs:
TARGET_ARCH: "${{ matrix.arch }}" TARGET_ARCH: "${{ matrix.arch }}"
name: server initrd ${{ matrix.arch }} name: server initrd ${{ matrix.arch }}
steps: steps:
- uses: actions/checkout@v4 - name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with: with:
submodules: recursive submodules: recursive
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
with: with:
targets: "${{ matrix.arch }}-unknown-linux-gnu,${{ matrix.arch }}-unknown-linux-musl" targets: "${{ matrix.arch }}-unknown-linux-gnu,${{ matrix.arch }}-unknown-linux-musl"
- run: ./hack/ci/install-linux-deps.sh - run: ./hack/ci/install-linux-deps.sh