Skip to content

Commit b83c413

Browse files
brian-kim31brian-kim31
authored
Harden workflows (#1135)
1 parent 6f1f908 commit b83c413

7 files changed

Lines changed: 100 additions & 80 deletions

File tree

‎.github/labeler.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,4 +26,4 @@ dependencies:
2626
- "app/next-client-app/**"
2727

2828
"Area: Workers":
29-
- "app/workers/**"
29+
- "app/workers/**"

‎.github/workflows/ci.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ jobs:
55
format_python_code:
66
runs-on: ubuntu-latest
77
steps:
8-
- uses: actions/checkout@v2
8+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
99
with:
1010
submodules: "recursive"
1111
ref: ${{ github.ref }}
@@ -20,14 +20,14 @@ jobs:
2020
env:
2121
RUNNER_ALLOW_RUNASROOT: true
2222
steps:
23-
- uses: actions/checkout@v2
23+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2424
with:
2525
submodules: "recursive"
2626
- name: Build the docker image
2727
working-directory: ./app
2828
run: docker build -f api/Dockerfile -t ccom-build:latest .
2929
- name: Install Node.js
30-
uses: actions/setup-node@v3
30+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
3131
with:
3232
node-version: "20"
3333
- name: Install dependencies and build Next.js app

‎.github/workflows/deploy.production.yml‎

Lines changed: 35 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,25 @@ env:
1313
repo-owner: health-informatics-uon
1414
registry: ghcr.io
1515

16+
permissions:
17+
contents: read # Required to read the repository contents
18+
packages: write # Required to publish packages
19+
1620
jobs:
21+
dependency-review:
22+
runs-on: ubuntu-latest
23+
steps:
24+
- name: Dependency Review
25+
uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1
26+
1727
build-and-publish-workers:
1828
runs-on: ubuntu-latest
1929
steps:
2030
- name: "Checkout GitHub Action"
21-
uses: actions/checkout@v4
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2232

2333
- name: Setup Python ${{ env.PYTHON_VERSION }} Environment
24-
uses: actions/setup-python@v5
34+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
2535
with:
2636
python-version: ${{ env.PYTHON_VERSION }}
2737

@@ -45,7 +55,7 @@ jobs:
4555
popd
4656
4757
- name: Upload artifact for deployment job
48-
uses: actions/upload-artifact@v4
58+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
4959
with:
5060
name: functionsapp
5161
path: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
@@ -55,20 +65,20 @@ jobs:
5565
runs-on: "ubuntu-latest"
5666

5767
steps:
58-
- uses: actions/checkout@v4
68+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5969

6070
- name: Set up Docker Buildx
61-
uses: docker/setup-buildx-action@v3
71+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
6272

6373
- name: Log in to registry
64-
uses: docker/login-action@v3
74+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
6575
with:
6676
registry: ccomreg.azurecr.io
6777
username: ${{ secrets.REGISTRY_USERNAME_DEV }}
6878
password: ${{ secrets.REGISTRY_PASSWORD_DEV }}
6979

7080
- name: Build and push container image to registry
71-
uses: docker/build-push-action@v5
81+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
7282
with:
7383
context: ./app
7484
push: true
@@ -82,10 +92,10 @@ jobs:
8292
BACKEND_ORIGIN: ${{ secrets.BACKEND_ORIGIN }}
8393

8494
steps:
85-
- uses: actions/checkout@v4
95+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
8696

8797
- name: Use Node.js ${{ env.NODE_VERSION }}
88-
uses: actions/setup-node@v4
98+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
8999
with:
90100
node-version: ${{ env.NODE_VERSION }}
91101

@@ -95,7 +105,7 @@ jobs:
95105
working-directory: ${{ env.AZURE_WEBAPP_PACKAGE_PATH }}
96106

97107
- name: Cache .next/cache
98-
uses: actions/cache@v4
108+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
99109
env:
100110
cache-name: cache-node-modules
101111
with:
@@ -115,7 +125,7 @@ jobs:
115125
working-directory: ${{ env.AZURE_WEBAPP_PACKAGE_PATH }}
116126

117127
- name: Publish webapp artifact
118-
uses: actions/upload-artifact@v4
128+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
119129
with:
120130
path: ${{ env.AZURE_WEBAPP_PACKAGE_PATH }}/.next/standalone
121131
name: frontendwebapp
@@ -127,10 +137,10 @@ jobs:
127137
packages: write
128138
steps:
129139
- name: Check out the repo
130-
uses: actions/checkout@v4
140+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
131141

132142
- name: Set up QEMU
133-
uses: docker/setup-qemu-action@v3
143+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
134144

135145
- name: Set up Docker Buildx
136146
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
@@ -148,7 +158,7 @@ jobs:
148158
# Tag and build webserver of airflow
149159
- name: Extract webserver Docker metadata
150160
id: airflow_webserver_meta
151-
uses: docker/metadata-action@v5.5.1
161+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
152162
with:
153163
images: ${{ env.registry }}/${{ env.repo-owner }}/${{ env.app-name }}/airflow-webserver
154164
tags: |
@@ -157,7 +167,7 @@ jobs:
157167
${{ env.RUN_TIMESTAMP }}
158168
159169
- name: Build and push webserver image
160-
uses: docker/build-push-action@v5.3.0
170+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
161171
with:
162172
context: ./app/airflow
163173
file: ./app/airflow/Dockerfile
@@ -169,7 +179,7 @@ jobs:
169179
# Tag and build scheduler of airflow
170180
- name: Extract scheduler Docker metadata
171181
id: scheduler_meta
172-
uses: docker/metadata-action@v5.5.1
182+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
173183
with:
174184
images: ${{ env.registry }}/${{ env.repo-owner }}/${{ env.app-name }}/airflow-scheduler
175185
tags: |
@@ -178,7 +188,7 @@ jobs:
178188
${{ env.RUN_TIMESTAMP }}
179189
180190
- name: Build and push scheduler image
181-
uses: docker/build-push-action@v5.3.0
191+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
182192
with:
183193
context: ./app/airflow
184194
file: ./app/airflow/Dockerfile
@@ -195,13 +205,13 @@ jobs:
195205

196206
steps:
197207
- name: Download artifact from build job
198-
uses: actions/download-artifact@v4
208+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
199209
with:
200210
path: functionsapp
201211
name: functionsapp
202212

203213
- name: "Run Azure Functions Action"
204-
uses: Azure/functions-action@v1.5.1
214+
uses: Azure/functions-action@0bd707f87c0b6385742bab336c74e1afc61f6369 # v1.5.3
205215
id: fa
206216
with:
207217
app-name: ${{ vars.AZURE_FUNCTIONS_NAME }}
@@ -220,7 +230,7 @@ jobs:
220230
steps:
221231
- name: Deploy to Azure Web App
222232
id: deploy-to-webapp
223-
uses: azure/webapps-deploy@v2
233+
uses: azure/webapps-deploy@2fdd5c3ebb4e540834e86ecc1f6fdcd5539023ee # v3.0.2
224234
with:
225235
app-name: ${{ vars.AZURE_WEBAPP_NAME }}
226236
slot-name: "production"
@@ -234,16 +244,16 @@ jobs:
234244
environment: production
235245

236246
steps:
237-
- uses: actions/checkout@v4
247+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
238248

239249
- name: Download artifact from build job
240-
uses: actions/download-artifact@v4
250+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
241251
with:
242252
path: frontendwebapp
243253
name: frontendwebapp
244254

245255
- name: Deploy to Azure WebApp
246-
uses: azure/webapps-deploy@v2
256+
uses: azure/webapps-deploy@2fdd5c3ebb4e540834e86ecc1f6fdcd5539023ee # v3.0.2
247257
with:
248258
app-name: ${{ vars.AZURE_WEBAPP_NEXT_NAME }}
249259
publish-profile: ${{ secrets.AZURE_WEBAPP_NEXT_PUBLISH_PROFILE }}
@@ -262,7 +272,7 @@ jobs:
262272
steps:
263273
- name: Deploy to Azure Web App
264274
id: deploy-airflow-webserver-production
265-
uses: azure/webapps-deploy@v2
275+
uses: azure/webapps-deploy@2fdd5c3ebb4e540834e86ecc1f6fdcd5539023ee # v3.0.2
266276
with:
267277
app-name: ${{ vars.AIRFLOW_WEBSERVER_NAME }}
268278
publish-profile: ${{ secrets.AIRFLOW_WEBSERVER_PUBLISH_PROFILE }}
@@ -281,7 +291,7 @@ jobs:
281291
steps:
282292
- name: Deploy to Azure Web App
283293
id: deploy-airflow-scheduler-production
284-
uses: azure/webapps-deploy@v2
294+
uses: azure/webapps-deploy@2fdd5c3ebb4e540834e86ecc1f6fdcd5539023ee # v3.0.2
285295
with:
286296
app-name: ${{ vars.AIRFLOW_SCHEDULER_NAME }}
287297
publish-profile: ${{ secrets.AIRFLOW_SCHEDULER_PUBLISH_PROFILE }}

0 commit comments

Comments
 (0)