Skip to content

Commit 61515d6

Browse files
jvanzjvanz
committed
fix(ci): fix zizmor warnings
Fix all the warnings reported by Zizmor. Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com> Assisted-by: Github copilot
1 parent 3668518 commit 61515d6

12 files changed

Lines changed: 205 additions & 82 deletions

‎.github/workflows/attestation.yml‎

Lines changed: 25 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ jobs:
2020
env:
2121
CRANE_VERSION: v0.20.5
2222
CRANE_CHECKSUM: ad4cd9af2568c62c97e346de6d1295ee8c6ce3341f7b71cf02d41292b4532680
23+
COMPONENT: ${{ inputs.component }}
24+
ARCH: ${{ inputs.arch }}
25+
REPOSITORY_OWNER: ${{ github.repository_owner }}
26+
GIT_REF: ${{ github.ref }}
2327

2428
steps:
2529
- name: Install cosign
@@ -50,36 +54,36 @@ jobs:
5054
working-directory: ${{ runner.temp }}/digests
5155
run: |
5256
set -e
53-
DIGEST=$(cat ${{ inputs.component }}-${{ inputs.arch }}.txt)
57+
DIGEST="$(cat -- "$COMPONENT-$ARCH.txt")"
5458
echo "DIGEST=${DIGEST}" >> "$GITHUB_ENV"
5559
- name: Find attestation digest
5660
run: |
5761
set -e
58-
DIGEST=$(crane manifest ghcr.io/${{ github.repository_owner }}/${{ inputs.component }}@${{ env.DIGEST }} \
62+
DIGEST=$(crane manifest ghcr.io/$REPOSITORY_OWNER/$COMPONENT@$DIGEST \
5963
| jq -r '.manifests[]
6064
| select(.annotations["vnd.docker.reference.type"] == "attestation-manifest")
6165
| .digest')
6266
if [[ -z "${DIGEST}" ]]; then
63-
echo "ERROR: No attestation manifest found for ${{ inputs.component }} (${{ inputs.arch }})"
67+
echo "ERROR: No attestation manifest found for $COMPONENT ($ARCH)"
6468
exit 1
6569
fi
6670
echo "ATTESTATION_MANIFEST_DIGEST=${DIGEST}" >> "$GITHUB_ENV"
6771
- name: Find provenance manifest digest
6872
run: |
6973
set -e
70-
DIGEST=$(crane manifest ghcr.io/${{ github.repository_owner }}/${{ inputs.component }}@${{ env.ATTESTATION_MANIFEST_DIGEST }} |
74+
DIGEST=$(crane manifest ghcr.io/$REPOSITORY_OWNER/$COMPONENT@$ATTESTATION_MANIFEST_DIGEST |
7175
jq -r '.layers[]
7276
| select(.annotations["in-toto.io/predicate-type"] == "https://slsa.dev/provenance/v1")
7377
| .digest')
7478
if [[ -z "${DIGEST}" ]]; then
75-
echo "ERROR: No SLSA provenance layer found in attestation manifest for ${{ inputs.component }} (${{ inputs.arch }})"
79+
echo "ERROR: No SLSA provenance layer found in attestation manifest for $COMPONENT ($ARCH)"
7680
exit 1
7781
fi
7882
echo "PROVENANCE_DIGEST=${DIGEST}" >> "$GITHUB_ENV"
7983
- name: Find SBOM manifest layer digest
8084
run: |
8185
set -e
82-
DIGEST=$(crane manifest ghcr.io/${{github.repository_owner}}/${{ inputs.component }}@${{ env.ATTESTATION_MANIFEST_DIGEST}} | \
86+
DIGEST=$(crane manifest ghcr.io/$REPOSITORY_OWNER/$COMPONENT@$ATTESTATION_MANIFEST_DIGEST | \
8387
jq -r '.layers
8488
| map(select(.annotations["in-toto.io/predicate-type"] == "https://spdx.dev/Document"))
8589
| map(.digest)
@@ -88,7 +92,7 @@ jobs:
8892
else error("ERROR: Multiple SBOM layers found in attestation manifest")
8993
end')
9094
if [[ -z "${DIGEST}" ]]; then
91-
echo "ERROR: No SBOM layer found in attestation manifest for ${{ inputs.component }} (${{ inputs.arch }})"
95+
echo "ERROR: No SBOM layer found in attestation manifest for $COMPONENT ($ARCH)"
9296
exit 1
9397
fi
9498
echo "SBOM_DIGEST=${DIGEST}" >> "$GITHUB_ENV"
@@ -99,30 +103,30 @@ jobs:
99103
- name: Download provenance and SBOM files
100104
run: |
101105
set -e
102-
crane blob ghcr.io/${{github.repository_owner}}/${{ inputs.component }}@${{ env.PROVENANCE_DIGEST}} \
103-
> ${{ inputs.component }}-attestation-${{ inputs.arch }}-provenance.intoto.jsonl
104-
crane blob ghcr.io/${{github.repository_owner}}/${{ inputs.component }}@${{ env.SBOM_DIGEST}} \
105-
> ${{ inputs.component }}-attestation-${{ inputs.arch }}-sbom.json
106+
crane blob ghcr.io/$REPOSITORY_OWNER/$COMPONENT@$PROVENANCE_DIGEST \
107+
> $COMPONENT-attestation-$ARCH-provenance.intoto.jsonl
108+
crane blob ghcr.io/$REPOSITORY_OWNER/$COMPONENT@$SBOM_DIGEST \
109+
> $COMPONENT-attestation-$ARCH-sbom.json
106110
- name: Sign provenance and SBOM files
107111
run: |
108112
set -e
109113
cosign sign-blob --yes \
110-
--bundle ${{ inputs.component }}-attestation-${{ inputs.arch }}-provenance.intoto.jsonl.bundle.sigstore \
111-
${{ inputs.component }}-attestation-${{ inputs.arch }}-provenance.intoto.jsonl
114+
--bundle $COMPONENT-attestation-$ARCH-provenance.intoto.jsonl.bundle.sigstore \
115+
$COMPONENT-attestation-$ARCH-provenance.intoto.jsonl
112116
cosign verify-blob \
113-
--bundle ${{ inputs.component }}-attestation-${{ inputs.arch }}-provenance.intoto.jsonl.bundle.sigstore \
117+
--bundle $COMPONENT-attestation-$ARCH-provenance.intoto.jsonl.bundle.sigstore \
114118
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
115-
--certificate-identity="https://github.com/${{github.repository_owner}}/kubewarden-controller/.github/workflows/attestation.yml@${{ github.ref }}" \
116-
${{ inputs.component }}-attestation-${{ inputs.arch }}-provenance.intoto.jsonl
119+
--certificate-identity="https://github.com/$REPOSITORY_OWNER/kubewarden-controller/.github/workflows/attestation.yml@$GIT_REF" \
120+
$COMPONENT-attestation-$ARCH-provenance.intoto.jsonl
117121
118122
cosign sign-blob --yes \
119-
--bundle ${{ inputs.component }}-attestation-${{ inputs.arch }}-sbom.json.bundle.sigstore \
120-
${{ inputs.component }}-attestation-${{ inputs.arch }}-sbom.json
123+
--bundle $COMPONENT-attestation-$ARCH-sbom.json.bundle.sigstore \
124+
$COMPONENT-attestation-$ARCH-sbom.json
121125
cosign verify-blob \
122-
--bundle ${{ inputs.component }}-attestation-${{ inputs.arch }}-sbom.json.bundle.sigstore \
126+
--bundle $COMPONENT-attestation-$ARCH-sbom.json.bundle.sigstore \
123127
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
124-
--certificate-identity="https://github.com/${{github.repository_owner}}/kubewarden-controller/.github/workflows/attestation.yml@${{ github.ref }}" \
125-
${{ inputs.component }}-attestation-${{ inputs.arch }}-sbom.json
128+
--certificate-identity="https://github.com/$REPOSITORY_OWNER/kubewarden-controller/.github/workflows/attestation.yml@$GIT_REF" \
129+
$COMPONENT-attestation-$ARCH-sbom.json
126130
127131
- name: Upload SBOMs as artifacts
128132
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0

‎.github/workflows/build-containers.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ jobs:
3131
steps:
3232
- name: Checkout code
3333
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
34+
with:
35+
persist-credentials: false
3436
- name: Build, sign, and upload digest
3537
uses: kubewarden/github-actions/container-build@f1695ca9a575bf58b85d6c3652c7ff7d1d12ec24 # v4.5.16
3638
with:
@@ -59,8 +61,10 @@ jobs:
5961
echo "TAG_NAME=latest-$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_ENV
6062
- name: Retrieve tag name (release)
6163
if: ${{ !startsWith(github.ref, 'refs/heads/') }}
64+
env:
65+
INPUT_VERSION: ${{ inputs.version }}
6266
run: |
63-
echo TAG_NAME=${{ inputs.version }} >> $GITHUB_ENV
67+
echo TAG_NAME=$INPUT_VERSION >> $GITHUB_ENV
6468
- name: Merge multi-arch images
6569
uses: kubewarden/github-actions/merge-multiarch@f1695ca9a575bf58b85d6c3652c7ff7d1d12ec24 # v4.5.16
6670
with:

‎.github/workflows/build-kwctl.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,15 @@ jobs:
3636
changes:
3737
name: Detect kwctl changes
3838
runs-on: ubuntu-latest
39+
permissions:
40+
contents: read
3941
outputs:
4042
kwctl: ${{ steps.changed-files.outputs.kwctl }}
4143
steps:
4244
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4345
with:
4446
fetch-depth: 0
47+
persist-credentials: false
4548
- name: Detect kwctl-related file changes
4649
id: changed-files
4750
run: |
@@ -91,6 +94,8 @@ jobs:
9194

9295
- name: checkout code
9396
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
97+
with:
98+
persist-credentials: false
9499

95100
- name: Install cross-rs
96101
run: |
@@ -194,6 +199,8 @@ jobs:
194199
attestations: write
195200
steps:
196201
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
202+
with:
203+
persist-credentials: false
197204

198205
- uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
199206
if: ${{ !inputs.build_only }}
@@ -281,6 +288,8 @@ jobs:
281288
attestations: write
282289
steps:
283290
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
291+
with:
292+
persist-credentials: false
284293

285294
- uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
286295
if: ${{ !inputs.build_only }}

0 commit comments

Comments
 (0)