mirror of
https://github.com/krkn-chaos/krkn.git
synced 2026-09-08 09:47:17 +00:00
Paige PattonandClaude Sonnet 4.6
496e866d8b
Scorecard Token-Permissions check (alert #4) flags release.yml for missing top-level permissions, which means GITHUB_TOKEN defaults to broad write access across all jobs. Adding permissions: read-all at the top level enforces least privilege by default; the release job already declares contents: write at job level for the permissions it actually needs. Signed-off-by: Paige Patton <prubenda@redhat.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
64 lines
2.1 KiB
YAML
64 lines
2.1 KiB
YAML
name: Create Release
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
permissions: read-all
|
|
|
|
jobs:
|
|
release:
|
|
permissions:
|
|
contents: write
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: calculate previous tag
|
|
run: |
|
|
git fetch --tags origin
|
|
PREVIOUS_TAG=$(git tag --sort=-creatordate | sed -n '2 p')
|
|
echo $PREVIOUS_TAG
|
|
echo "PREVIOUS_TAG=$PREVIOUS_TAG" >> "$GITHUB_ENV"
|
|
|
|
- name: generate release notes from template
|
|
id: release-notes
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
NOTES=$(gh api \
|
|
--method POST \
|
|
-H "Accept: application/vnd.github+json" \
|
|
-H "X-GitHub-Api-Version: 2022-11-28" \
|
|
/repos/krkn-chaos/krkn/releases/generate-notes \
|
|
-f "tag_name=${{ github.ref_name }}" -f "target_commitish=main" -f "previous_tag_name=${{ env.PREVIOUS_TAG }}" | jq -r .body)
|
|
echo "NOTES<<EOF" >> $GITHUB_ENV
|
|
echo "$NOTES" >> $GITHUB_ENV
|
|
echo "EOF" >> $GITHUB_ENV
|
|
|
|
- name: replace placeholders in template
|
|
run: |
|
|
echo "${{ env.NOTES }}"
|
|
TEMPLATE=$(cat .github/release-template.md)
|
|
VERSION=${{ github.ref_name }}
|
|
NOTES="${{ env.NOTES }}"
|
|
OUTPUT=${TEMPLATE//\{VERSION\}/$VERSION}
|
|
OUTPUT=${OUTPUT//\{CHANGES\}/$NOTES}
|
|
echo "$OUTPUT" > release-notes.md
|
|
- name: create release
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
gh release create ${{ github.ref_name }} --title "${{ github.ref_name }}" -F release-notes.md
|
|
|
|
- name: Install Syft
|
|
run: |
|
|
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sudo sh -s -- -b /usr/local/bin
|
|
|
|
- name: Generate SBOM
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
syft . --scope all-layers --output cyclonedx-json > sbom.json
|
|
echo "SBOM generated successfully!"
|
|
gh release upload ${{ github.ref_name }} sbom.json
|