Skip to content

Commit daca5d7

Browse files
egibsegibs
authored
chore(action-lint): address findings (#1468)
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
1 parent 38f693f commit daca5d7

12 files changed

Lines changed: 113 additions & 29 deletions

File tree

‎.chainguard/source.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ spec:
77
identities:
88
- issuer: https://accounts.google.com
99
- issuer: https://github.com/login/oauth
10+
- issuer: https://token.actions.githubusercontent.com
11+
subject: https://github.com/chainguard-dev/malcontent/.github/workflows/digestabot.yaml@refs/heads/main
1012
- issuer: https://token.actions.githubusercontent.com
1113
subject: https://github.com/chainguard-dev/malcontent/.github/workflows/release.yaml@refs/heads/main
1214
- issuer: https://token.actions.githubusercontent.com
@@ -18,3 +20,6 @@ spec:
1820
- key:
1921
# allow commits signed by GitHub, e.g. the UI
2022
kms: https://github.com/web-flow.gpg
23+
# Allow GitHub verified ssh, gpg, and smime signatures
24+
github:
25+
verified: true

‎.github/actionlint.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Copyright 2026 Chainguard, Inc.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
# Custom GitHub-hosted runner labels used by Chainguard
5+
self-hosted-runner:
6+
labels:
7+
- ubuntu-latest-16-core
8+
- ubuntu-latest-arm-16-core

‎.github/chainguard/digestabot.sts.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
issuer: https://token.actions.githubusercontent.com
2+
subject: repo:chainguard-dev/malcontent:ref:refs/heads/main
3+
claim_pattern:
4+
workflow_ref: chainguard-dev/malcontent/.github/workflows/digestabot.yaml@refs/heads/main
5+
6+
permissions:
7+
contents: write
8+
pull_requests: write

‎.github/workflows/codeql.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ jobs:
4646
sum.golang.org:443
4747
uploads.github.com:443
4848
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
49+
with:
50+
persist-credentials: false
4951
- name: Cache yara-x-capi installation
5052
id: yara-x-capi
5153
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
@@ -56,6 +58,7 @@ jobs:
5658
if: steps.yara-x-capi.outputs.cache-hit != 'true'
5759
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5860
with:
61+
persist-credentials: false
5962
fetch-depth: 0
6063
fetch-tags: true
6164
repository: virusTotal/yara-x
@@ -135,6 +138,8 @@ jobs:
135138
uploads.github.com:443
136139
- name: Checkout repository
137140
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
141+
with:
142+
persist-credentials: false
138143
- name: Initialize CodeQL
139144
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
140145
with:

‎.github/workflows/digestabot.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Copyright 2026 Chainguard, Inc.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Image digest update
5+
6+
on:
7+
workflow_dispatch:
8+
schedule:
9+
- cron: "0 1 * * *"
10+
11+
permissions: {}
12+
13+
jobs:
14+
image-update:
15+
name: Image digest update
16+
runs-on: ubuntu-latest
17+
if: github.repository == 'chainguard-dev/malcontent'
18+
19+
permissions:
20+
contents: read
21+
id-token: write
22+
23+
steps:
24+
- uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
25+
with:
26+
egress-policy: block
27+
allowed-endpoints: >
28+
*.blob.core.windows.net:443
29+
*.githubapp.com:443
30+
api.github.com:443
31+
cgr.dev:443
32+
fulcio.sigstore.dev:443
33+
github.com:443
34+
octo-sts.dev:443
35+
rekor.sigstore.dev:443
36+
tuf-repo-cdn.sigstore.dev:443
37+
38+
- uses: chainguard-dev/actions/setup-gitsign@de68b87302e6266db5fb5220246f8aa46fe94b67
39+
40+
- uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
41+
id: octo-sts
42+
with:
43+
scope: ${{ github.repository }}
44+
identity: digestabot
45+
46+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
47+
# zizmor: ignore[artipacked] - credentials needed for digestabot to push and create PRs
48+
with:
49+
token: ${{ steps.octo-sts.outputs.token }}
50+
51+
- uses: chainguard-dev/digestabot@afe360aa3b0c29d88844138e8fa0349384398967 # v1.3.1
52+
with:
53+
token: ${{ steps.octo-sts.outputs.token }}
54+
include-files: ".github/workflows/*.yaml"

‎.github/workflows/fuzz.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ jobs:
108108
matrix:
109109
target: ${{ fromJson(needs.discover.outputs.targets) }}
110110
container:
111-
image: cgr.dev/chainguard/wolfi-base:latest # zizmor: ignore[unpinned-images]
111+
image: cgr.dev/chainguard/wolfi-base:latest@sha256:9a74366aa10eff2bf14dab0948123bd2c51703e1c553a73740ef687f723aecf4
112112
options: >-
113113
--cap-add DAC_OVERRIDE
114114
--cap-add SETGID

‎.github/workflows/go-tests.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
permissions:
2525
contents: read
2626
container:
27-
image: cgr.dev/chainguard/wolfi-base:latest # zizmor: ignore[unpinned-images]
27+
image: cgr.dev/chainguard/wolfi-base:latest@sha256:9a74366aa10eff2bf14dab0948123bd2c51703e1c553a73740ef687f723aecf4
2828
options: >-
2929
--cap-add DAC_OVERRIDE
3030
--cap-add SETGID
@@ -75,7 +75,7 @@ jobs:
7575
permissions:
7676
contents: read
7777
container:
78-
image: cgr.dev/chainguard/wolfi-base:latest # zizmor: ignore[unpinned-images]
78+
image: cgr.dev/chainguard/wolfi-base:latest@sha256:9a74366aa10eff2bf14dab0948123bd2c51703e1c553a73740ef687f723aecf4
7979
options: >-
8080
--cap-add DAC_OVERRIDE
8181
--cap-add SETGID

‎.github/workflows/release.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,15 +29,18 @@ jobs:
2929
github.com:443
3030
octo-sts.dev:443
3131
release-assets.githubusercontent.com:443
32-
- name: Checkout code
33-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3432
- uses: chainguard-dev/actions/setup-gitsign@de68b87302e6266db5fb5220246f8aa46fe94b67
3533
- name: Set up Octo-STS
3634
uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
3735
id: octo-sts
3836
with:
3937
scope: chainguard-dev/malcontent
4038
identity: release
39+
- name: Checkout code
40+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
41+
# zizmor: ignore[artipacked] - credentials needed for gh release create
42+
with:
43+
token: ${{ steps.octo-sts.outputs.token }}
4144
- name: Get Version
4245
id: get-version
4346
run: |

‎.github/workflows/style.yaml‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -83,18 +83,11 @@ jobs:
8383
with:
8484
persist-credentials: false
8585

86-
- name: Install yara-x
86+
- name: Run make yara-x-fmt
8787
run: |
88-
wget https://github.com/VirusTotal/yara-x/releases/download/v${{ env.YARA_X_RELEASE }}/yara-x-v${{ env.YARA_X_RELEASE }}-aarch64-unknown-linux-gnu.gz -O yara-x.gz
89-
gunzip yara-x.gz && tar -xvf yara-x && chmod +x yr && mv yr /usr/local/bin/ && rm yara-x
90-
- name: Verify yr installation
91-
run: |
92-
yr --version
93-
- name: Run yr fmt
94-
run: |
95-
find rules -type f -name "*.yara" | xargs -n 1 -I {} yr fmt {}
88+
make yara-x-fmt
9689
if [[ -n $(git status -s) ]]; then
97-
echo "Rule files updated; please run yr fmt locally and commit the changes"
90+
echo "Rule files updated; please run 'make yara-x-fmt' locally and commit the changes"
9891
exit 1
9992
fi
10093
@@ -178,7 +171,7 @@ jobs:
178171
permissions:
179172
contents: read
180173
container:
181-
image: cgr.dev/chainguard/wolfi-base:latest
174+
image: cgr.dev/chainguard/wolfi-base:latest@sha256:9a74366aa10eff2bf14dab0948123bd2c51703e1c553a73740ef687f723aecf4
182175
options: >-
183176
--cap-add DAC_OVERRIDE
184177
--cap-add SETGID

‎.github/workflows/third-party.yaml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
if: ${{ github.repository == 'chainguard-dev/malcontent' }}
2020
runs-on: ubuntu-latest-arm-16-core
2121
container:
22-
image: cgr.dev/chainguard/wolfi-base:latest
22+
image: cgr.dev/chainguard/wolfi-base:latest@sha256:9a74366aa10eff2bf14dab0948123bd2c51703e1c553a73740ef687f723aecf4
2323
options: >-
2424
--cap-add DAC_OVERRIDE
2525
--cap-add SETGID
@@ -41,7 +41,17 @@ jobs:
4141
run: |
4242
apk update
4343
apk add bash curl findutils gh git gnutar ${{ env.GO_RELEASE }} nodejs perl upx xz yara-x~${{ env.YARA_X_RELEASE }}
44+
- uses: chainguard-dev/actions/setup-gitsign@de68b87302e6266db5fb5220246f8aa46fe94b67
45+
- name: Set up Octo-STS
46+
uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
47+
id: octo-sts
48+
with:
49+
scope: chainguard-dev/malcontent
50+
identity: third-party
4451
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
52+
# zizmor: ignore[artipacked] - credentials needed for git push and gh pr create
53+
with:
54+
token: ${{ steps.octo-sts.outputs.token }}
4555
- name: Trust repository
4656
run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"
4757

@@ -73,14 +83,6 @@ jobs:
7383
- name: Prepare samples
7484
run: make samples
7585

76-
- uses: chainguard-dev/actions/setup-gitsign@de68b87302e6266db5fb5220246f8aa46fe94b67
77-
- name: Set up Octo-STS
78-
uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
79-
id: octo-sts
80-
with:
81-
scope: chainguard-dev/malcontent
82-
identity: third-party
83-
8486
- name: Run make update-third-party
8587
run: |
8688
make update-third-party

0 commit comments

Comments
 (0)