⬆️ Update kairos-io/kairos-factory-action action to v1 (#4002)

* ⬆️ Update kairos-io/kairos-factory-action action to v1

* use scan policy enforce

* branch

* pin to v1.0.1

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Mauro Morales <contact@mauromorales.com>

Author: renovate[bot]

.github/workflows/image-master-arm.yaml

@@ -17,7 +17,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@c237359bb72f160ee19232ca5d8472062ebc2cad # v0.0.14
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
@@ -29,6 +29,7 @@ jobs:
       arch: "arm64"
       version: "auto"
       grype: ${{ matrix.grype }}
+      security_scan_mode: "enforce"
       registry_domain: "quay.io"
       registry_namespace: "kairos"
       registry_repository: "ci-temp-images"

.github/workflows/image-master.yaml

@@ -16,7 +16,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@c237359bb72f160ee19232ca5d8472062ebc2cad # v0.0.14
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
@@ -29,6 +29,7 @@ jobs:
       version: "auto"
       iso: true
       grype: true
+      security_scan_mode: "enforce"
       registry_domain: "quay.io"
       registry_namespace: "kairos"
       registry_repository: "ci-temp-images"

.github/workflows/image-pr-arm.yaml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@c237359bb72f160ee19232ca5d8472062ebc2cad # v0.0.14
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
@@ -44,6 +44,7 @@ jobs:
       version: "auto"
       raw: ${{ matrix.model == 'rpi3' || matrix.model == 'rpi4' }} # only produce raw images for rpi3 and rpi4
       grype: ${{ matrix.grype }}
+      security_scan_mode: "enforce"
       registry_domain: "quay.io"
       registry_namespace: "kairos"
       registry_repository: "ci-temp-images"

.github/workflows/image-pr.yaml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@c237359bb72f160ee19232ca5d8472062ebc2cad # v0.0.14
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
@@ -35,6 +35,7 @@ jobs:
       version: "auto"
       iso: true
       grype: true
+      security_scan_mode: "enforce"
       registry_domain: "quay.io"
       registry_namespace: "kairos"
       registry_repository: "ci-temp-images"

.github/workflows/release-arm.yaml

@@ -8,7 +8,7 @@ permissions: read-all
 jobs:
   core:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@c237359bb72f160ee19232ca5d8472062ebc2cad # v0.0.14
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
@@ -50,6 +50,7 @@ jobs:
       grype_sarif: ${{ matrix.grype }}
       trivy: true
       trivy_sarif: true
+      security_scan_mode: "enforce"
       list_release_artifacts: true
       cosign: true
       release: true
@@ -83,7 +84,7 @@ jobs:
           echo "kubernetes_versions=$kubernetes_versions" >> $GITHUB_OUTPUT
   standard:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@c237359bb72f160ee19232ca5d8472062ebc2cad # v0.0.14
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
@@ -131,6 +132,7 @@ jobs:
       grype_sarif: ${{ matrix.grype }}
       trivy: true
       trivy_sarif: true
+      security_scan_mode: "enforce"
       list_release_artifacts: true
       cosign: true
       release: true

.github/workflows/release.yaml

@@ -8,7 +8,7 @@ permissions: read-all
 jobs:
   core:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@c237359bb72f160ee19232ca5d8472062ebc2cad # v0.0.14
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
     permissions:
       id-token: write  # OIDC support
       contents: write
@@ -41,6 +41,7 @@ jobs:
       grype_sarif: true
       trivy: true
       trivy_sarif: true
+      security_scan_mode: "enforce"
       list_release_artifacts: ${{ !matrix.trusted_boot }}
       cosign: true
       release: ${{ !matrix.trusted_boot }}
@@ -102,7 +103,7 @@ jobs:
 
   standard-k3s:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@c237359bb72f160ee19232ca5d8472062ebc2cad # v0.0.14
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
     needs:
       - get-k3s-versions
     permissions:
@@ -136,12 +137,13 @@ jobs:
       grype_sarif: true
       trivy: true
       trivy_sarif: true
+      security_scan_mode: "enforce"
       list_release_artifacts: true
       cosign: true
       release: true
   standard-k0s:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@c237359bb72f160ee19232ca5d8472062ebc2cad # v0.0.14
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
     needs:
       - get-k0s-versions
     permissions:
@@ -175,6 +177,7 @@ jobs:
       grype_sarif: true
       trivy: true
       trivy_sarif: true
+      security_scan_mode: "enforce"
       list_release_artifacts: true
       cosign: true
       release: true

.github/workflows/uki.yaml

@@ -16,7 +16,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@c237359bb72f160ee19232ca5d8472062ebc2cad # v0.0.14
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
@@ -34,6 +34,7 @@ jobs:
       version: "auto"
       iso: true
       grype: false
+      security_scan_mode: "enforce"
       registry_domain: "quay.io"
       registry_namespace: "kairos"
       registry_repository: "ci-temp-images"