From 002b8e4ddb90c48d1a8bb8f47d3c0c8e070dadc9 Mon Sep 17 00:00:00 2001 From: Marc Brugger Date: Mon, 8 Jun 2026 16:31:00 +0200 Subject: [PATCH] chore: update all gihub actions, use digest versioning and remove obsolete docs-lint workflow (#1955) Signed-off-by: bakito --- .github/workflows/check-actions.yml | 2 +- .github/workflows/check-commit.yml | 2 +- .github/workflows/check-pr.yml | 2 +- .github/workflows/coverage.yml | 10 ++++---- .github/workflows/docker-build.yml | 4 ++-- .github/workflows/docker-publish.yml | 6 ++--- .github/workflows/docs-lint.yml | 33 -------------------------- .github/workflows/e2e.yml | 8 +++---- .github/workflows/helm-publish.yml | 8 +++---- .github/workflows/helm-test.yml | 4 ++-- .github/workflows/lint.yml | 6 ++--- .github/workflows/releaser-dry-run.yml | 4 ++-- .github/workflows/releaser.yml | 4 ++-- .github/workflows/scorecard.yml | 4 ++-- .github/workflows/stale.yml | 2 +- Makefile | 4 ---- renovate.json | 2 +- 17 files changed, 34 insertions(+), 71 deletions(-) delete mode 100644 .github/workflows/docs-lint.yml diff --git a/.github/workflows/check-actions.yml b/.github/workflows/check-actions.yml index d877b020..559f2b45 100644 --- a/.github/workflows/check-actions.yml +++ b/.github/workflows/check-actions.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Ensure SHA pinned actions uses: zgosalvez/github-actions-ensure-sha-pinned-actions@ca46236c6ce584ae24bc6283ba8dcf4b3ec8a066 # v5.0.4 with: diff --git a/.github/workflows/check-commit.yml b/.github/workflows/check-commit.yml index 02c425d1..ac461865 100644 --- a/.github/workflows/check-commit.yml +++ b/.github/workflows/check-commit.yml @@ -16,7 +16,7 @@ jobs: commit_lint: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1 diff --git a/.github/workflows/check-pr.yml b/.github/workflows/check-pr.yml index 1703c09b..b3cfe08c 100644 --- a/.github/workflows/check-pr.yml +++ b/.github/workflows/check-pr.yml @@ -15,7 +15,7 @@ jobs: name: Validate PR title runs-on: ubuntu-latest steps: - - uses: amannn/action-semantic-pull-request@ac7e3fc035c47465748bbcb1a822c1583cf79bbc + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 4a0a45f3..8cd1e756 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: "Checkout Code" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Check secret id: checksecret uses: ./.github/actions/exists @@ -47,16 +47,16 @@ jobs: contents: read steps: - name: Checkout Source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version-file: 'go.mod' - name: Run Gosec Security Scanner - uses: securego/gosec@4a3bd8af174872c778439083ded7adbf3747e770 # v2.26.1 + uses: securego/gosec@9e6a9843d7a4a6e3e9a8539b02612c8a4aa3f889 # v2.27.1 with: args: '-no-fail -fmt sarif -out gosec.sarif ./...' - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@0ec47d036c68ae0cf94c629009b1029407111281 + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: sarif_file: gosec.sarif unit_tests: @@ -64,7 +64,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version-file: 'go.mod' diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index e37f4e46..415ede35 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -24,7 +24,7 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: ko build run: VERSION=${{ github.sha }} make ko-build-all - name: Trivy Scan Image @@ -40,6 +40,6 @@ jobs: # See: https://github.com/aquasecurity/trivy-action/issues/389#issuecomment-2385416577 TRIVY_DB_REPOSITORY: 'public.ecr.aws/aquasecurity/trivy-db:2' - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@0ec47d036c68ae0cf94c629009b1029407111281 + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: sarif_file: 'trivy-results.sarif' diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 5bae8bb6..399a1e2a 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -20,7 +20,7 @@ jobs: capsule-digest: ${{ steps.publish-capsule.outputs.digest }} steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Setup caches uses: ./.github/actions/setup-caches timeout-minutes: 5 @@ -36,7 +36,7 @@ jobs: output: 'trivy-results.sarif' severity: 'CRITICAL,HIGH' - name: Install Cosign - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: Publish Capsule id: publish-capsule uses: peak-scale/github-actions/make-ko-publish@a441cca016861c546ab7e065277e40ce41a3eb84 # v0.2.0 @@ -61,7 +61,7 @@ jobs: packages: write # To upload assets to release. actions: read # To read the workflow path. # NOTE: The container generator workflow is not officially released as GA. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 with: image: ghcr.io/${{ github.repository_owner }}/capsule digest: "${{ needs.publish-images.outputs.capsule-digest }}" diff --git a/.github/workflows/docs-lint.yml b/.github/workflows/docs-lint.yml deleted file mode 100644 index 8bc48843..00000000 --- a/.github/workflows/docs-lint.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: docs-lint -permissions: {} - -on: - push: - branches: - - "*" - paths: - - '.github/workflows/docs-lint.yml' - - 'docs/content/**' - pull_request: - branches: - - "*" - paths: - - '.github/workflows/docs-lint.yml' - - 'docs/content/**' - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - spelling: - name: Spell Check - runs-on: ubuntu-20.04 - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - fetch-depth: 0 - - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 - with: - node-version: 18 - - run: make docs-lint diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 2d61482d..a9d597b1 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -27,7 +27,7 @@ jobs: runs-on: labels: ubuntu-latest-8-cores steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 @@ -45,7 +45,7 @@ jobs: runs-on: labels: ubuntu-latest-8-cores steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 @@ -70,7 +70,7 @@ jobs: runs-on: labels: ubuntu-latest-8-cores steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: repository: ${{ github.event.client_payload.repo }} ref: ${{ github.event.client_payload.sha }} @@ -95,7 +95,7 @@ jobs: runs-on: ubuntu-latest-8-cores steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 diff --git a/.github/workflows/helm-publish.yml b/.github/workflows/helm-publish.yml index 7dacb836..58d24aec 100644 --- a/.github/workflows/helm-publish.yml +++ b/.github/workflows/helm-publish.yml @@ -16,7 +16,7 @@ jobs: if: github.repository_owner == 'projectcapsule' runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Extract Version" id: extract_version run: | @@ -45,8 +45,8 @@ jobs: outputs: chart-digest: ${{ steps.helm_publish.outputs.digest }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: "Extract Version" id: extract_version run: | @@ -74,7 +74,7 @@ jobs: packages: write # To upload assets to release. actions: read # To read the workflow path. # NOTE: The container generator workflow is not officially released as GA. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 with: image: ghcr.io/${{ github.repository_owner }}/charts/capsule digest: "${{ needs.publish-helm-oci.outputs.chart-digest }}" diff --git a/.github/workflows/helm-test.yml b/.github/workflows/helm-test.yml index b0b24eb1..ec979451 100644 --- a/.github/workflows/helm-test.yml +++ b/.github/workflows/helm-test.yml @@ -23,14 +23,14 @@ jobs: options: --user root steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Run ah lint working-directory: ./charts/ run: ah lint lint: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 - uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5 diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index e5b2173b..b7869eef 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -15,7 +15,7 @@ jobs: name: diff runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 @@ -36,7 +36,7 @@ jobs: name: yamllint runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Install yamllint run: pip install yamllint - name: Lint YAML files @@ -45,7 +45,7 @@ jobs: name: lint runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version-file: 'go.mod' diff --git a/.github/workflows/releaser-dry-run.yml b/.github/workflows/releaser-dry-run.yml index bd663c12..71d67c5b 100644 --- a/.github/workflows/releaser-dry-run.yml +++ b/.github/workflows/releaser-dry-run.yml @@ -23,7 +23,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 @@ -37,7 +37,7 @@ jobs: timeout-minutes: 5 continue-on-error: true - - uses: anchore/sbom-action/download-syft@f0d33c151c04af6fcbf4363834e838fcc7c87783 + - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 - name: Run GoReleaser dry run uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2 diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml index 7321500b..3474d085 100644 --- a/.github/workflows/releaser.yml +++ b/.github/workflows/releaser.yml @@ -18,7 +18,7 @@ jobs: id-token: write steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 - name: Install Go @@ -30,7 +30,7 @@ jobs: timeout-minutes: 5 continue-on-error: true - uses: creekorful/goreportcard-action@1f35ced8cdac2cba28c9a2f2288a16aacfd507f9 # v1.0 - - uses: anchore/sbom-action/download-syft@f0d33c151c04af6fcbf4363834e838fcc7c87783 + - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 - name: Install Cosign uses: sigstore/cosign-installer@fb28c2b6339dcd94da6e4cbcbc5e888961f6f8c3 # DO NOT UPDATE v3.9.0 - name: Run GoReleaser diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 34c12cb2..f1a71b57 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -20,7 +20,7 @@ jobs: id-token: write steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - name: Run analysis @@ -37,6 +37,6 @@ jobs: path: results.sarif retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: sarif_file: results.sarif diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index a634261d..539c739d 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -15,7 +15,7 @@ jobs: pull-requests: write steps: - name: Close stale pull requests - uses: actions/stale@db5d06a4c82d5e94513c09c406638111df61f63e + uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0 with: stale-issue-message: 'This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.' stale-pr-message: 'This pull request has been marked as stale because it has been inactive for more than 30 days. Please update this pull request or it will be automatically closed in 30 days.' diff --git a/Makefile b/Makefile index 040d59c3..e9b4e313 100644 --- a/Makefile +++ b/Makefile @@ -571,10 +571,6 @@ e2e-exec-config: ginkgo .PHONY: e2e-destroy e2e-destroy: dev-destroy -SPELL_CHECKER = npx spellchecker-cli -docs-lint: - cd docs/content && $(SPELL_CHECKER) -f "*.md" "*/*.md" "!general/crds-apis.md" -d dictionary.txt - #################### # -- Helpers #################### diff --git a/renovate.json b/renovate.json index 91014057..145b1844 100644 --- a/renovate.json +++ b/renovate.json @@ -1,7 +1,7 @@ { "minimumReleaseAge": null, "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": ["config:recommended", ":dependencyDashboard"], + "extends": ["config:recommended", ":dependencyDashboard", "helpers:pinGitHubActionDigests"], "baseBranches": ["main"], "prHourlyLimit": 0, "prConcurrentLimit": 0,