Skip to content

Commit 265f5d0

Browse files
author
Kamal Chaturvedi
committed
Merge remote-tracking branch 'upstream/main' into nginx_one_security_monitoring
2 parents 5271a0f + 9e67328 commit 265f5d0

File tree

117 files changed

+4895
-1429
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

117 files changed

+4895
-1429
lines changed

‎.github/workflows/assertion.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,9 @@ on:
3939
ARTIFACTORY_URL:
4040
required: true
4141

42+
permissions:
43+
contents: read
44+
4245
jobs:
4346
build-assertion-document:
4447
name: Create Assertion Document
@@ -64,7 +67,7 @@ jobs:
6467

6568
- name: Download nginx-agent binary artifacts
6669
if: ${{ inputs.runId != '' }}
67-
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # 6.0.0
70+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # 7.0.0
6871
with:
6972
name: nginx-agent-binaries-${{ inputs.packageVersion }}-${{ matrix.osarch }}
7073
path: binaries

‎.github/workflows/ci.yml‎

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747
run: go install github.com/goreleaser/nfpm/v2/cmd/nfpm@${{ env.NFPM_VERSION }}
4848
- name: Fix golang dependency permissions
4949
run: chmod -R 0755 ~/go/pkg/mod ~/.cache/go-build
50-
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
50+
- uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
5151
with:
5252
path: |
5353
~/.cache/go-build
@@ -71,7 +71,7 @@ jobs:
7171
with:
7272
go-version-file: 'go.mod'
7373
cache: false
74-
- uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
74+
- uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
7575
with:
7676
path: |
7777
~/.cache/go-build
@@ -81,20 +81,20 @@ jobs:
8181
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
8282
with:
8383
version: v2.4.0
84+
skip-cache: true
8485

8586
vulnerability-scan:
8687
name: Vulnerability Scan
8788
uses: ./.github/workflows/vulncheck.yml
8889
permissions:
89-
security-events: write
90+
contents: read
91+
security-events: write # for reporting vulnerabilities via code-scanning API
9092
with:
9193
target-branch: ${{ github.event.pull_request.base.ref || github.ref_name }}
9294

9395
unit-test:
9496
name: Unit Tests
9597
runs-on: ubuntu-22.04
96-
permissions:
97-
contents: write
9898
steps:
9999
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
100100
- name: Configure Go Proxy
@@ -107,7 +107,7 @@ jobs:
107107
with:
108108
go-version-file: 'go.mod'
109109
cache: false
110-
- uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
110+
- uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
111111
with:
112112
path: |
113113
~/.cache/go-build
@@ -116,7 +116,7 @@ jobs:
116116
- name: Run Unit Tests
117117
run: make unit-test
118118
- name: Uplaod Test Coverage
119-
uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
119+
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
120120
with:
121121
files: ./build/test/coverage.out
122122
token: ${{ secrets.CODECOV_TOKEN }}
@@ -136,7 +136,7 @@ jobs:
136136
with:
137137
go-version-file: 'go.mod'
138138
cache: false
139-
- uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
139+
- uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
140140
with:
141141
path: |
142142
~/.cache/go-build
@@ -168,7 +168,7 @@ jobs:
168168
run: go install github.com/goreleaser/nfpm/v2/cmd/nfpm@${{ env.NFPM_VERSION }}
169169
- name: Fix golang dependency permissions
170170
run: chmod -R 0755 ~/go/pkg/mod ~/.cache/go-build
171-
- uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
171+
- uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
172172
with:
173173
path: |
174174
~/.cache/go-build
@@ -178,7 +178,7 @@ jobs:
178178
run: |
179179
make clean local-deb-package local-rpm-package local-apk-package
180180
- name: Upload Artifacts
181-
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
181+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
182182
with:
183183
name: nginx-agent-unsigned-snapshots
184184
path: build
@@ -209,14 +209,14 @@ jobs:
209209
with:
210210
go-version-file: 'go.mod'
211211
cache: false
212-
- uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
212+
- uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
213213
with:
214214
path: |
215215
~/.cache/go-build
216216
~/go/pkg/mod
217217
key: ${{ runner.os }}-go-
218218
- name: Download Packages
219-
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
219+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
220220
with:
221221
name: nginx-agent-unsigned-snapshots
222222
path: build
@@ -265,14 +265,14 @@ jobs:
265265
with:
266266
go-version-file: 'go.mod'
267267
cache: false
268-
- uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
268+
- uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
269269
with:
270270
path: |
271271
~/.cache/go-build
272272
~/go/pkg/mod
273273
key: ${{ runner.os }}-go-
274274
- name: Download Packages
275-
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
275+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
276276
with:
277277
name: nginx-agent-unsigned-snapshots
278278
path: build
@@ -328,14 +328,14 @@ jobs:
328328
with:
329329
go-version-file: 'go.mod'
330330
cache: false
331-
- uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
331+
- uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
332332
with:
333333
path: |
334334
~/.cache/go-build
335335
~/go/pkg/mod
336336
key: ${{ runner.os }}-go-
337337
- name: Download Packages
338-
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
338+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
339339
with:
340340
name: nginx-agent-unsigned-snapshots
341341
path: build
@@ -401,14 +401,14 @@ jobs:
401401
with:
402402
go-version-file: 'go.mod'
403403
cache: false
404-
- uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
404+
- uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
405405
with:
406406
path: |
407407
~/.cache/go-build
408408
~/go/pkg/mod
409409
key: ${{ runner.os }}-go-
410410
- name: Download Packages
411-
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
411+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
412412
with:
413413
name: nginx-agent-unsigned-snapshots
414414
path: build
@@ -473,14 +473,14 @@ jobs:
473473
with:
474474
go-version-file: 'go.mod'
475475
cache: false
476-
- uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
476+
- uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
477477
with:
478478
path: |
479479
~/.cache/go-build
480480
~/go/pkg/mod
481481
key: ${{ runner.os }}-go-
482482
- name: Download Packages
483-
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
483+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
484484
with:
485485
name: nginx-agent-unsigned-snapshots
486486
path: build
@@ -546,14 +546,14 @@ jobs:
546546
with:
547547
go-version-file: 'go.mod'
548548
cache: false
549-
- uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
549+
- uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
550550
with:
551551
path: |
552552
~/.cache/go-build
553553
~/go/pkg/mod
554554
key: ${{ runner.os }}-go-
555555
- name: Download Packages
556-
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
556+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
557557
with:
558558
name: nginx-agent-unsigned-snapshots
559559
path: build
@@ -591,7 +591,7 @@ jobs:
591591
runs-on: ubuntu-22.04
592592
needs: build-unsigned-snapshot
593593
permissions:
594-
contents: write
594+
contents: write # Needed for pushing benchmark results to github branch
595595
steps:
596596
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
597597
- name: Configure Go Proxy
@@ -604,7 +604,7 @@ jobs:
604604
with:
605605
go-version-file: 'go.mod'
606606
cache: false
607-
- uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
607+
- uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
608608
with:
609609
path: |
610610
~/.cache/go-build
@@ -633,7 +633,7 @@ jobs:
633633
name: Load Tests
634634
if: ${{ !github.event.pull_request.head.repo.fork && !startsWith(github.head_ref, 'dependabot-') }}
635635
permissions:
636-
contents: write
636+
contents: write # Needed for pushing benchmark results to github branch
637637
runs-on: ubuntu-22.04
638638
needs: build-unsigned-snapshot
639639
steps:
@@ -643,21 +643,21 @@ jobs:
643643
go-version-file: 'go.mod'
644644
cache: false
645645

646-
- uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
646+
- uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
647647
with:
648648
path: |
649649
~/.cache/go-build
650650
~/go/pkg/mod
651651
key: ${{ runner.os }}-go-
652652

653653
- name: Download Packages
654-
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
654+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
655655
with:
656656
name: nginx-agent-unsigned-snapshots
657657
path: build
658658

659659
- name: Set up Docker Build
660-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
660+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
661661

662662
- name: Set env
663663
run: echo "GO_VERSION=$(cat go.mod | grep toolchain | sed 's/toolchain //; s/go//')" >> $GITHUB_ENV
@@ -687,7 +687,7 @@ jobs:
687687
echo "$results"
688688
689689
- name: Upload Load Test Results
690-
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
690+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
691691
with:
692692
name: load-test-results
693693
path: benchmarks.json

‎.github/workflows/dependency-review.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,4 @@ jobs:
2727
- name: "Dependency Review"
2828
uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
2929
with:
30-
config-file: "nginxinc/k8s-common/dependency-review-config.yml@main"
30+
config-file: "nginx/k8s-common/dependency-review-config.yml@main"

‎.github/workflows/nightly-scans.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,24 @@ on:
44
- cron: '0 2 * * *' # Runs daily at 2:00 AM UTC
55
workflow_dispatch:
66

7+
permissions:
8+
contents: read
9+
710
jobs:
811
scan-main:
912
name: Vulnerability Scan - Main
1013
uses: ./.github/workflows/vulncheck.yml
14+
permissions:
15+
contents: read
16+
security-events: write # for reporting vulnerabilities via code-scanning API
1117
with:
1218
target-branch: 'main'
1319

1420
scan-v2:
1521
name: Vulnerability Scan - dev-v2
1622
uses: ./.github/workflows/vulncheck.yml
23+
permissions:
24+
contents: read
25+
security-events: write # for reporting vulnerabilities via code-scanning API
1726
with:
1827
target-branch: 'dev-v2'

‎.github/workflows/release-branch.yml‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ jobs:
185185
runs-on: ubuntu-22.04
186186
needs: [vars,release-draft]
187187
permissions:
188-
contents: write
188+
contents: write # Needed to tag a release
189189
steps:
190190
- name: Checkout Repository
191191
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
@@ -206,8 +206,7 @@ jobs:
206206
runs-on: ubuntu-22.04-amd64
207207
needs: [vars,release-draft,tag-release]
208208
permissions:
209-
id-token: write
210-
contents: write # Needed to update a release
209+
id-token: write # Needed to get a token to upload packages to NGINX repo
211210
steps:
212211
- name: Checkout Repository
213212
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
@@ -246,7 +245,7 @@ jobs:
246245
find build/ -type f -name "nginx-agent*"
247246
248247
- name: Archive AMD64 Binaries
249-
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
248+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
250249
with:
251250
name: nginx-agent-binaries-${{ inputs.packageVersion }}-amd64
252251
path: |
@@ -256,7 +255,7 @@ jobs:
256255
build/amd64/nginx-agent.buildend
257256
258257
- name: Archive ARM64 Binaries
259-
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
258+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
260259
with:
261260
name: nginx-agent-binaries-${{ inputs.packageVersion }}-arm64
262261
path: |
@@ -314,7 +313,7 @@ jobs:
314313
runs-on: ubuntu-22.04
315314
needs: [vars,tag-release]
316315
permissions:
317-
pull-requests: write
316+
pull-requests: write # Needed to create pull request back into main branch
318317
steps:
319318
- name: Checkout Repository
320319
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

‎.github/workflows/scorecards.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,14 +47,14 @@ jobs:
4747
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
4848
# format to the repository Actions tab.
4949
- name: "Upload artifact"
50-
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
50+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
5151
with:
5252
name: SARIF file
5353
path: results.sarif
5454
retention-days: 5
5555

5656
# Upload the results to GitHub's code scanning dashboard.
5757
- name: "Upload to code-scanning"
58-
uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
58+
uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
5959
with:
6060
sarif_file: results.sarif

‎.github/workflows/upload-release-assets.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ defaults:
2525
shell: bash
2626

2727
permissions:
28-
contents: write
28+
contents: read
2929

3030
jobs:
3131
vars:
@@ -51,6 +51,8 @@ jobs:
5151
name: Upload assets
5252
runs-on: ubuntu-22.04
5353
needs: [vars]
54+
permissions:
55+
contents: write # Needed for uploading release assets to GitHub
5456
steps:
5557
- name: Checkout Repository
5658
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

‎.github/workflows/vulncheck.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ on:
1414
required: false
1515
default: 'main'
1616

17+
permissions:
18+
contents: read
19+
1720
jobs:
1821
vulncheck:
1922
name: Vulnerability Check
@@ -25,7 +28,7 @@ jobs:
2528
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
2629
with:
2730
fetch-depth: 0
28-
ref: ${{ inputs.targetBranch || 'main' }}
31+
ref: ${{ inputs.target-branch || 'main' }}
2932

3033
- name: Check Go version
3134
id: get-go-version

0 commit comments

Comments
 (0)