Skip to content

Commit f32fc77

Browse files
hu-ahmedhu-ahmed
committed
fix zizmor-flagged workflow security issues
1 parent 0cdfae9 commit f32fc77

12 files changed

Lines changed: 91 additions & 17 deletions

‎.github/workflows/docker-nightly.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ jobs:
2828
-
2929
name: Checkout
3030
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
31+
with:
32+
persist-credentials: false
3133
-
3234
name: Set up QEMU
3335
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

‎.github/workflows/gh-pages.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ jobs:
3535
egress-policy: audit
3636

3737
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
38+
with:
39+
persist-credentials: false
3840
- name: Use Node.js 18.x
3941
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
4042
with:

‎.github/workflows/helm-chart-release.yml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ jobs:
3333
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3434
with:
3535
fetch-depth: 0
36+
persist-credentials: false
3637

3738
- name: Set up Helm
3839
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
@@ -45,11 +46,15 @@ jobs:
4546

4647
- name: Helm | Package
4748
shell: bash
48-
run: helm package deployment/helm/ditto --dependency-update --version ${{ inputs.chartVersion }}
49+
env:
50+
CHART_VERSION: ${{ inputs.chartVersion }}
51+
run: helm package deployment/helm/ditto --dependency-update --version "$CHART_VERSION"
4952

5053
- name: Helm | Push
5154
shell: bash
52-
run: helm push ditto-${{ inputs.chartVersion }}.tgz oci://registry-1.docker.io/eclipse
55+
env:
56+
CHART_VERSION: ${{ inputs.chartVersion }}
57+
run: helm push "ditto-${CHART_VERSION}.tgz" oci://registry-1.docker.io/eclipse
5358

5459
- name: Helm | Logout
5560
shell: bash
@@ -58,4 +63,6 @@ jobs:
5863
- name: Helm | Output
5964
id: output
6065
shell: bash
61-
run: echo "image=registry-1.docker.io/eclipse/ditto:${{ inputs.chartVersion }}" >> $GITHUB_OUTPUT
66+
env:
67+
CHART_VERSION: ${{ inputs.chartVersion }}
68+
run: echo "image=registry-1.docker.io/eclipse/ditto:${CHART_VERSION}" >> $GITHUB_OUTPUT

‎.github/workflows/helm-chart.yml‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ jobs:
3636
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3737
with:
3838
fetch-depth: 0
39+
persist-credentials: false
3940
- name: Set up Helm
4041
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
4142
with:
@@ -50,14 +51,20 @@ jobs:
5051
version: ${{ env.VERSION_CHART_TESTING }}
5152
- name: Run chart-testing (list-changed)
5253
id: list-changed
54+
env:
55+
CT_CONFIG: ${{ env.CONFIG_OPTION_CHART_TESTING }}
56+
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
5357
run: |
54-
changed=$(ct list-changed ${{ env.CONFIG_OPTION_CHART_TESTING }} --target-branch ${{ github.event.repository.default_branch }})
58+
changed=$(ct list-changed $CT_CONFIG --target-branch "$DEFAULT_BRANCH")
5559
if [[ -n "$changed" ]]; then
5660
echo "changed=true" >> "$GITHUB_OUTPUT"
5761
fi
5862
- name: Run chart-testing (lint)
5963
if: steps.list-changed.outputs.changed == 'true'
60-
run: ct lint ${{ env.CONFIG_OPTION_CHART_TESTING }} --target-branch ${{ github.event.repository.default_branch }}
64+
env:
65+
CT_CONFIG: ${{ env.CONFIG_OPTION_CHART_TESTING }}
66+
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
67+
run: ct lint $CT_CONFIG --target-branch "$DEFAULT_BRANCH"
6168

6269
kubeval-chart:
6370
runs-on: ubuntu-latest
@@ -79,6 +86,8 @@ jobs:
7986

8087
- name: Checkout
8188
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
89+
with:
90+
persist-credentials: false
8291
- name: Fetch history for chart testing
8392
run: git fetch --prune --unshallow
8493
- name: Set up Helm
@@ -113,6 +122,8 @@ jobs:
113122

114123
- name: Checkout
115124
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
125+
with:
126+
persist-credentials: false
116127
- name: Fetch history for chart testing
117128
run: git fetch --prune --unshallow
118129
- name: Set up Helm
@@ -129,8 +140,11 @@ jobs:
129140
version: ${{ env.VERSION_CHART_TESTING }}
130141
- name: Run chart-testing (list-changed)
131142
id: list-changed
143+
env:
144+
CT_CONFIG: ${{ env.CONFIG_OPTION_CHART_TESTING }}
145+
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
132146
run: |
133-
changed=$(ct list-changed ${{ env.CONFIG_OPTION_CHART_TESTING }} --target-branch ${{ github.event.repository.default_branch }})
147+
changed=$(ct list-changed $CT_CONFIG --target-branch "$DEFAULT_BRANCH")
134148
if [[ -n "$changed" ]]; then
135149
echo "changed=true" >> "$GITHUB_OUTPUT"
136150
fi
@@ -141,4 +155,7 @@ jobs:
141155
node_image: kindest/node:${{ matrix.k8s }}
142156
- name: Run chart-testing (install)
143157
if: steps.list-changed.outputs.changed == 'true'
144-
run: ct install ${{ env.CONFIG_OPTION_CHART_TESTING }} --target-branch ${{ github.event.repository.default_branch }}
158+
env:
159+
CT_CONFIG: ${{ env.CONFIG_OPTION_CHART_TESTING }}
160+
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
161+
run: ct install $CT_CONFIG --target-branch "$DEFAULT_BRANCH"

‎.github/workflows/license-check.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ jobs:
2424
egress-policy: audit
2525

2626
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
27+
with:
28+
persist-credentials: false
2729
- uses: jitterbit/get-changed-files@b17fbb00bdc0c0f63fcf166580804b4d2cdc2a42 # v1
2830
id: the-files
2931
continue-on-error: true

‎.github/workflows/maven.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ jobs:
3939
egress-policy: audit
4040

4141
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
42+
with:
43+
persist-credentials: false
4244

4345
- name: Set up JDK 25
4446
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0

‎.github/workflows/push-dockerhub-on-demand.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ jobs:
4242
-
4343
name: Checkout
4444
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
45+
with:
46+
persist-credentials: false
4547
-
4648
name: Set up QEMU
4749
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
@@ -66,11 +68,13 @@ jobs:
6668
-
6769
name: Branch name
6870
id: branch_name
71+
env:
72+
DITTO_VERSION_INPUT: ${{ inputs.dittoVersion }}
6973
run: |
70-
echo "IMAGE_TAG=${{ inputs.dittoVersion }}" >> $GITHUB_ENV
71-
echo "IMAGE_MINOR_TAG=$(echo ${{ inputs.dittoVersion }} | cut -d. -f-2)" >> $GITHUB_ENV
72-
echo "IMAGE_MAJOR_TAG=$(echo ${{ inputs.dittoVersion }} | cut -d. -f-1)" >> $GITHUB_ENV
73-
echo "MILESTONE_OR_RC_SUFFIX=$(echo ${{ inputs.dittoVersion }} | cut -d- -f2)" >> $GITHUB_ENV
74+
echo "IMAGE_TAG=$DITTO_VERSION_INPUT" >> $GITHUB_ENV
75+
echo "IMAGE_MINOR_TAG=$(echo "$DITTO_VERSION_INPUT" | cut -d. -f-2)" >> $GITHUB_ENV
76+
echo "IMAGE_MAJOR_TAG=$(echo "$DITTO_VERSION_INPUT" | cut -d. -f-1)" >> $GITHUB_ENV
77+
echo "MILESTONE_OR_RC_SUFFIX=$(echo "$DITTO_VERSION_INPUT" | cut -d- -f2)" >> $GITHUB_ENV
7478
-
7579
name: Building Docker images for tag
7680
run: |

‎.github/workflows/push-dockerhub.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ jobs:
2727
-
2828
name: Checkout
2929
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
30+
with:
31+
persist-credentials: false
3032
-
3133
name: Set up QEMU
3234
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

‎.github/workflows/system-tests.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ jobs:
9898
ref: ${{ env.DITTO_BRANCH }}
9999
token: ${{ secrets.GITHUB_TOKEN }}
100100
path: ditto
101+
persist-credentials: false
101102

102103
- name: Checkout ditto-testing repo
103104
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -106,6 +107,7 @@ jobs:
106107
ref: ${{ env.DITTO_TESTING_BRANCH }}
107108
token: ${{ secrets.GITHUB_TOKEN }}
108109
path: ditto-testing
110+
persist-credentials: false
109111

110112
- name: Checkout ditto-clients repo
111113
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -114,6 +116,7 @@ jobs:
114116
ref: 'master'
115117
token: ${{ secrets.GITHUB_TOKEN }}
116118
path: ditto-clients
119+
persist-credentials: false
117120

118121
- name: Set up JDK 25
119122
uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3.14.1

‎.github/workflows/ui-ci.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ jobs:
3232
egress-policy: audit
3333

3434
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
35+
with:
36+
persist-credentials: false
3537
- name: Use Node.js 18.x
3638
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
3739
with:

0 commit comments

Comments
 (0)