Skip to content

Commit 913e8b4

Browse files
ryjonesryjones
committed
chore: harden GHA
Signed-off-by: Ry Jones <ry@linux.com>
1 parent dd0d56d commit 913e8b4

4 files changed

Lines changed: 47 additions & 30 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 30 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -42,19 +42,22 @@ jobs:
4242
runs-on: ubuntu-24.04
4343
steps:
4444
- name: Checkout Fabric Code
45-
uses: actions/checkout@v5
45+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
46+
with:
47+
persist-credentials: false
4648
- name: Install Go
47-
uses: actions/setup-go@v6
49+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
4850
with:
4951
go-version-file: go.mod
52+
cache: false
5053
- name: Compile Binary and Create Tarball
5154
run: ./ci/scripts/create_binary_package.sh
5255
env:
5356
TARGET: ${{ matrix.target }}-${{ matrix.arch }}
5457
RELEASE: ${{ env.FABRIC_VER }}
5558

5659
- name: Publish Release Artifact
57-
uses: actions/upload-artifact@v4
60+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
5861
with:
5962
# <name> of the artifact must not collide between platform/arch builds
6063
name: release-${{ matrix.target }}-${{ matrix.arch }}
@@ -93,31 +96,33 @@ jobs:
9396

9497
steps:
9598
- name: Checkout
96-
uses: actions/checkout@v5
99+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
100+
with:
101+
persist-credentials: false
97102

98103
- name: Set GO_VER environment variable from go.mod
99104
run: |
100105
awk '/^go[ /t]/ { gsub(/^go[ \t]+|[ \t]+^/, ""); print "GO_VER="$0; exit }' < go.mod >> "${GITHUB_ENV}"
101106
102107
- name: Login to the ${{ matrix.registry }} Container Registry
103-
uses: docker/login-action@v3
108+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
104109
with:
105110
registry: ${{ matrix.registry }}
106111
username: ${{ matrix.registry == 'docker.io' && secrets.DOCKERHUB_USERNAME || github.actor }}
107112
password: ${{ matrix.registry == 'docker.io' && secrets.DOCKERHUB_TOKEN || secrets.GITHUB_TOKEN }}
108113

109114
- name: Set up Docker Buildx
110-
uses: docker/setup-buildx-action@v3
115+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
111116

112117
- name: Docker meta
113118
id: meta
114-
uses: docker/metadata-action@v5
119+
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
115120
with:
116121
images: ${{ matrix.registry }}/${{ github.repository_owner }}/fabric-${{ matrix.component.name }}
117122

118123
- name: Build and push ${{ matrix.component.name }} Image
119124
id: build-and-push
120-
uses: docker/build-push-action@v6
125+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
121126
with:
122127
context: ${{ matrix.component.context }}
123128
file: images/${{ matrix.component.name }}/Dockerfile
@@ -136,7 +141,7 @@ jobs:
136141
touch "${{ runner.temp }}/digests/${{ matrix.registry }}/${{ matrix.component.name }}/${digest#sha256:}"
137142
138143
- name: Upload digest
139-
uses: actions/upload-artifact@v4
144+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
140145
with:
141146
name: digests-${{ matrix.registry }}-${{ matrix.component.name }}-${{ matrix.runner }}
142147
path: ${{ runner.temp }}/digests/${{ matrix.registry }}/${{ matrix.component.name }}/*
@@ -174,25 +179,25 @@ jobs:
174179

175180
steps:
176181
- name: Download digests
177-
uses: actions/download-artifact@v5
182+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
178183
with:
179184
path: ${{ runner.temp }}/digests/${{ matrix.registry }}/${{ matrix.component.name }}
180185
pattern: digests-${{ matrix.registry }}-${{ matrix.component.name }}-*
181186
merge-multiple: true
182187

183188
- name: Login to the ${{ matrix.registry }} Container Registry
184-
uses: docker/login-action@v3
189+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
185190
with:
186191
registry: ${{ matrix.registry }}
187192
username: ${{ matrix.registry == 'docker.io' && secrets.DOCKERHUB_USERNAME || github.actor }}
188193
password: ${{ matrix.registry == 'docker.io' && secrets.DOCKERHUB_TOKEN || secrets.GITHUB_TOKEN }}
189194

190195
- name: Set up Docker Buildx
191-
uses: docker/setup-buildx-action@v3
196+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
192197

193198
- name: Docker meta
194199
id: meta
195-
uses: docker/metadata-action@v5
200+
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
196201
with:
197202
images: ${{ matrix.registry }}/${{ github.repository_owner }}/fabric-${{ matrix.component.name }}
198203
tags: |
@@ -204,11 +209,16 @@ jobs:
204209
working-directory: ${{ runner.temp }}/digests/${{ matrix.registry }}/${{ matrix.component.name }}
205210
run: |
206211
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
207-
$(printf '${{ matrix.registry }}/${{ github.repository_owner }}/fabric-${{ matrix.component.name }}@sha256:%s ' *)
212+
$(printf '${MATRIX_REGISTRY}/${{ github.repository_owner }}/fabric-${{ matrix.component.name }}@sha256:%s ' *)
213+
env:
214+
MATRIX_REGISTRY: ${{ matrix.registry }}
208215

209216
- name: Inspect image
210217
run: |
211-
docker buildx imagetools inspect ${{ matrix.registry }}/${{ github.repository_owner }}/fabric-${{ matrix.component.name }}:${{ steps.meta.outputs.version }}
218+
docker buildx imagetools inspect ${MATRIX_REGISTRY}/${{ github.repository_owner }}/fabric-${{ matrix.component.name }}:${STEPS_META_OUTPUTS_VERSION}
219+
env:
220+
MATRIX_REGISTRY: ${{ matrix.registry }}
221+
STEPS_META_OUTPUTS_VERSION: ${{ steps.meta.outputs.version }}
212222

213223
create-release:
214224
name: Create GitHub Release
@@ -220,16 +230,18 @@ jobs:
220230
contents: write
221231
steps:
222232
- name: Checkout Fabric Code
223-
uses: actions/checkout@v5
233+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
234+
with:
235+
persist-credentials: false
224236

225237
- name: Download Artifacts
226238
id: download
227-
uses: actions/download-artifact@v5
239+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
228240
with:
229241
pattern: "release-*"
230242

231243
- name: Release Fabric Version
232-
uses: ncipollo/release-action@v1
244+
uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
233245
with:
234246
allowUpdates: "true"
235247
artifacts: "release-*-*/*.tar.gz"

‎.github/workflows/scorecard.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737

3838
steps:
3939
- name: "Checkout code"
40-
uses: actions/checkout@v5
40+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4141
with:
4242
persist-credentials: false
4343

@@ -64,7 +64,7 @@ jobs:
6464
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6565
# format to the repository Actions tab.
6666
- name: "Upload artifact"
67-
uses: actions/upload-artifact@v4
67+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
6868
with:
6969
name: SARIF file
7070
path: results.sarif
@@ -73,6 +73,6 @@ jobs:
7373
# Upload the results to GitHub's code scanning dashboard (optional).
7474
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
7575
- name: "Upload to code-scanning"
76-
uses: github/codeql-action/upload-sarif@v4
76+
uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
7777
with:
7878
sarif_file: results.sarif

‎.github/workflows/verify-build.yml‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,12 @@ jobs:
2222
name: Basic Checks
2323
runs-on: ${{ github.repository == 'hyperledger/fabric' && 'fabric-ubuntu-24.04' || 'ubuntu-24.04' }}
2424
steps:
25-
- uses: actions/checkout@v5
25+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2626
name: Checkout Fabric Code
2727
with:
2828
fetch-depth: 0
29-
- uses: actions/setup-go@v6
29+
persist-credentials: false
30+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
3031
name: Install Go
3132
with:
3233
go-version-file: go.mod
@@ -48,11 +49,12 @@ jobs:
4849
needs: basic-checks
4950
runs-on: ${{ github.repository == 'hyperledger/fabric' && 'fabric-ubuntu-24.04' || 'ubuntu-24.04' }}
5051
steps:
51-
- uses: actions/checkout@v5
52+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5253
with:
5354
fetch-depth: 0
55+
persist-credentials: false
5456
name: Checkout Fabric Code
55-
- uses: actions/setup-go@v6
57+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
5658
name: Install Go
5759
with:
5860
go-version-file: go.mod
@@ -78,9 +80,11 @@ jobs:
7880
- sbe nwo msp
7981
runs-on: ${{ github.repository == 'hyperledger/fabric' && 'fabric-ubuntu-24.04' || 'ubuntu-24.04' }}
8082
steps:
81-
- uses: actions/checkout@v5
83+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8284
name: Checkout Fabric Code
83-
- uses: actions/setup-go@v6
85+
with:
86+
persist-credentials: false
87+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
8488
name: Install Go
8589
with:
8690
go-version-file: go.mod

‎.github/workflows/vulnerability-scan.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
ref:
2828
- main
2929
- release-2.5
30-
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@main"
30+
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@3adb4b14a2b0623876d18d863a498b785fb3752d" # v2.3.8
3131
with:
3232
scan-args: |-
3333
--lockfile=./go.mod
@@ -52,10 +52,11 @@ jobs:
5252
output_release-25: ${{ steps.latest_release.outputs.tag_release_25 }}
5353
steps:
5454
- name: Checkout ${{ matrix.ref.branch }} branch
55-
uses: actions/checkout@v5
55+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5656
with:
5757
ref: ${{ matrix.ref.branch }}
5858
fetch-depth: 0
59+
persist-credentials: false
5960
- name: Get latest release
6061
id: latest_release
6162
run: |
@@ -74,7 +75,7 @@ jobs:
7475
tag: ${{ needs.get-latest-releases.outputs.output_main }}
7576
- branch: release-2.5
7677
tag: ${{ needs.get-latest-releases.outputs.output_release-25 }}
77-
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@main"
78+
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@3adb4b14a2b0623876d18d863a498b785fb3752d" # v2.3.8
7879
with:
7980
scan-args: |-
8081
--lockfile=./go.mod

0 commit comments

Comments
 (0)