Skip to content

Commit 9ad1637

Browse files
vardhaman22vardhaman22
authored
Merge pull request #797 from vardhaman22/v1.3/sync-changes
[release/v1.3] sync changes from main
2 parents 8cbdf39 + 24526d6 commit 9ad1637

File tree

16 files changed

+302
-228
lines changed

16 files changed

+302
-228
lines changed

‎.github/renovate.json‎

Lines changed: 16 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1,84 +1,31 @@
11
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
23
"extends": [
3-
"github>rancher/renovate-config#release"
4+
"github>rancher/renovate-config//rancher-main#main"
45
],
56
"baseBranches": [
6-
"main",
7-
"release/v1.1",
8-
"release/v1.2",
9-
"release/v1.3"
7+
"main"
108
],
119
"prHourlyLimit": 2,
10+
"ignoreDeps":[
11+
"github.com/rancher/lasso"
12+
],
1213
"packageRules": [
1314
{
14-
"matchBaseBranches": [
15-
"main",
16-
"release/v1.3"
17-
],
18-
"matchDepNames": [
19-
"k8s.io/api",
20-
"k8s.io/apiextensions-apiserver",
21-
"k8s.io/apimachinery",
22-
"k8s.io/client-go"
23-
],
24-
"allowedVersions": "<1.32.0"
25-
},
26-
{
27-
"matchBaseBranches": [
28-
"release/v1.3"
29-
],
30-
"matchDepNames": [
31-
"github.com/rancher/security-scan"
32-
],
33-
"allowedVersions": "<v0.6.0"
15+
"matchBaseBranches": ["release/v1.4"],
16+
"extends": ["github>rancher/renovate-config//rancher-2.11#main"]
3417
},
3518
{
36-
"matchBaseBranches": ["release/v1.2"],
37-
"matchDepNames": [
38-
"github.com/rancher/lasso"
39-
],
40-
"allowedVersions": "<v0.0.0-20240924233157-8f384efc8813"
41-
},
42-
{
43-
"matchBaseBranches": ["release/v1.2"],
44-
"matchDepNames": [
45-
"k8s.io/api",
46-
"k8s.io/apiextensions-apiserver",
47-
"k8s.io/apimachinery",
48-
"k8s.io/client-go"
49-
],
50-
"allowedVersions": "<1.31.0"
19+
"matchBaseBranches": ["release/v1.3"],
20+
"extends": ["github>rancher/renovate-config//rancher-2.10#main"]
5121
},
5222
{
5323
"matchBaseBranches": ["release/v1.2"],
54-
"matchDepNames": [
55-
"github.com/rancher/security-scan"
56-
],
57-
"allowedVersions": "<v0.5.0"
58-
},
59-
{
60-
"matchBaseBranches": ["release/v1.1"],
61-
"matchDepNames": [
62-
"github.com/rancher/lasso"
63-
],
64-
"allowedVersions": "<v0.0.0-20240705194423-b2a060d103c1"
65-
},
66-
{
67-
"matchBaseBranches": ["release/v1.1"],
68-
"matchDepNames": [
69-
"k8s.io/api",
70-
"k8s.io/apiextensions-apiserver",
71-
"k8s.io/apimachinery",
72-
"k8s.io/client-go"
73-
],
74-
"allowedVersions": "<1.29.0"
75-
},
76-
{
77-
"matchBaseBranches": ["release/v1.1"],
78-
"matchDepNames": [
79-
"github.com/rancher/security-scan"
80-
],
81-
"allowedVersions": "<v0.4.0"
24+
"extends": ["github>rancher/renovate-config//rancher-2.9#main"]
8225
}
83-
]
26+
],
27+
"vulnerabilityAlerts": {
28+
"enabled": true
29+
},
30+
"osvVulnerabilityAlerts": true
8431
}

‎.github/workflows/codeql.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: CodeQL
2+
on:
3+
workflow_call:
4+
pull_request:
5+
6+
push:
7+
branches:
8+
- main
9+
10+
schedule:
11+
- cron: '00 9 * * 2'
12+
13+
permissions: {}
14+
15+
jobs:
16+
analyze:
17+
name: Analyze
18+
runs-on: ubuntu-latest
19+
20+
permissions:
21+
actions: read
22+
contents: read
23+
security-events: write
24+
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
language: [ 'go', 'actions' ]
29+
30+
steps:
31+
- name: Checkout code
32+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
33+
34+
- name: Initialize CodeQL
35+
uses: github/codeql-action/init@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
36+
with:
37+
languages: ${{ matrix.language }}
38+
# xref: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
39+
# xref: https://codeql.github.com/codeql-query-help/go/
40+
queries: security-and-quality
41+
42+
- name: Manual Build
43+
run: go build ./...
44+
45+
- name: Perform CodeQL Analysis
46+
uses: github/codeql-action/analyze@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
47+
with:
48+
category: "/language:${{matrix.language}}"

‎.github/workflows/label-all-new-issues.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,13 @@ on:
55
- opened
66
- reopened
77

8-
permissions:
9-
issues: write
8+
permissions: {}
109

1110
jobs:
1211
label_issues:
1312
runs-on: ubuntu-latest
13+
permissions:
14+
issues: write
1415
steps:
1516
- name: Label issue
1617
id: run

‎.github/workflows/release.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ on:
55
tags:
66
- 'v*'
77

8+
permissions: {}
9+
810
jobs:
911

1012
publish:
@@ -32,7 +34,7 @@ jobs:
3234

3335
steps:
3436
- name: Checkout code
35-
uses: actions/checkout@v4
37+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3638

3739
- name: Load Secrets from Vault
3840
uses: rancher-eio/read-vault-secrets@main
@@ -68,7 +70,7 @@ jobs:
6870

6971
steps:
7072
- name: Checkout code
71-
uses: actions/checkout@v4
73+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7274

7375
- run: make upload
7476
env:

‎.github/workflows/renovate-vault.yml‎

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,35 @@ on:
55
logLevel:
66
description: "Override default log level"
77
required: false
8-
default: "info"
9-
type: string
8+
default: info
9+
type: choice
10+
options:
11+
- info
12+
- debug
1013
overrideSchedule:
1114
description: "Override all schedules"
1215
required: false
1316
default: "false"
17+
type: choice
18+
options:
19+
- "false"
20+
- "true"
21+
configMigration:
22+
description: "Toggle PRs for config migration"
23+
required: false
24+
default: "true"
25+
type: choice
26+
options:
27+
- "false"
28+
- "true"
29+
renovateConfig:
30+
description: "Define a custom renovate config file"
31+
required: false
32+
default: ".github/renovate.json"
1433
type: string
15-
# Run twice in the early morning (UTC) for initial and follow up steps (create pull request and merge)
34+
1635
schedule:
17-
- cron: '30 4,6 * * *'
36+
- cron: '30 4,6 * * 2-4'
1837

1938
permissions:
2039
contents: read
@@ -24,6 +43,9 @@ jobs:
2443
call-workflow:
2544
uses: rancher/renovate-config/.github/workflows/renovate-vault.yml@release
2645
with:
46+
configMigration: ${{ inputs.configMigration || 'true' }}
2747
logLevel: ${{ inputs.logLevel || 'info' }}
2848
overrideSchedule: ${{ github.event.inputs.overrideSchedule == 'true' && '{''schedule'':null}' || '' }}
29-
secrets: inherit
49+
renovateConfig: ${{ inputs.renovateConfig || '.github/renovate.json' }}
50+
secrets:
51+
override-token: "${{ secrets.RENOVATE_FORK_GH_TOKEN || '' }}"

‎.github/workflows/scorecard.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: Scorecard supply-chain security
2+
on:
3+
# For Branch-Protection check. Only the default branch is supported. See
4+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
5+
branch_protection_rule:
6+
# To guarantee Maintained check is occasionally updated. See
7+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
8+
schedule:
9+
- cron: '20 5 * * 0'
10+
push:
11+
branches: [ "main" ]
12+
13+
# Declare default permissions as read only.
14+
permissions: read-all
15+
16+
jobs:
17+
analysis:
18+
name: Scorecard analysis
19+
runs-on: ubuntu-latest
20+
permissions:
21+
# Needed to upload the results to code-scanning dashboard.
22+
security-events: write
23+
# Needed to publish results and get a badge (see publish_results below).
24+
id-token: write
25+
26+
steps:
27+
- name: "Checkout code"
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
29+
with:
30+
persist-credentials: false
31+
32+
- name: "Run analysis"
33+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
34+
with:
35+
results_file: results.sarif
36+
results_format: sarif
37+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
38+
# - you want to enable the Branch-Protection check on a *public* repository
39+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
40+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
41+
42+
# Public repositories:
43+
# - Publish results to OpenSSF REST API for easy access by consumers
44+
# - Allows the repository to include the Scorecard badge.
45+
# - See https://github.com/ossf/scorecard-action#publishing-results.
46+
publish_results: true
47+
48+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
49+
# format to the repository Actions tab.
50+
- name: "Upload artifact"
51+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
52+
with:
53+
name: SARIF file
54+
path: results.sarif
55+
retention-days: 5
56+
57+
# Upload the results to GitHub's code scanning dashboard (optional).
58+
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
59+
- name: "Upload to code-scanning"
60+
uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
61+
with:
62+
sarif_file: results.sarif

‎.github/workflows/tests.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
- name: Checkout code
15-
uses: actions/checkout@v4
15+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1616

1717
- name: Install Go
18-
uses: actions/setup-go@v5
18+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
1919
with:
2020
go-version: 'stable'
2121
- run: make validate
@@ -33,10 +33,10 @@ jobs:
3333

3434
steps:
3535
- name: Checkout code
36-
uses: actions/checkout@v4
36+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3737

3838
- name: Install Go
39-
uses: actions/setup-go@v5
39+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
4040
with:
4141
go-version: 'stable'
4242

@@ -60,11 +60,11 @@ jobs:
6060
brew install docker
6161
colima start
6262
- name: Setup QEMU
63-
uses: docker/setup-qemu-action@v3
63+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
6464
- name: Setup Docker Buildx
65-
uses: docker/setup-buildx-action@v3
65+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
6666
- name: Checkout code
67-
uses: actions/checkout@v4
67+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6868

6969
- name: Test building images
7070
run: make test-image

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# cis-operator
1+
# cis-operator [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/rancher/cis-operator/badge)](https://scorecard.dev/viewer/?uri=github.com/rancher/cis-operator)
22

33
The cis-operator enables running CIS benchmark security scans on a Kubernetes cluster and generate compliance reports that can be downloaded.
44
Benchmarks tests and the execution logic lives on [rancher/security-scan].

‎chart/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@ annotations:
1212
catalog.cattle.io/type: cluster-tool
1313
catalog.cattle.io/ui-component: rancher-cis-benchmark
1414
apiVersion: v1
15-
appVersion: v7.4.0
15+
appVersion: v7.5.0-rc.1
1616
description: The cis-operator enables running CIS benchmark security scans on a kubernetes
1717
cluster
1818
icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg
1919
keywords:
2020
- security
2121
name: rancher-cis-benchmark
22-
version: 7.4.0
22+
version: 7.5.0-rc.1

‎chart/values.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
image:
66
cisoperator:
77
repository: rancher/cis-operator
8-
tag: v1.3.7
8+
tag: v1.3.8-rc.1
99
securityScan:
1010
repository: rancher/security-scan
11-
tag: v0.5.5
11+
tag: v0.5.6-rc.1
1212
sonobuoy:
1313
repository: rancher/mirrored-sonobuoy-sonobuoy
1414
tag: v0.57.3
@@ -45,7 +45,7 @@ global:
4545
clusterName: ""
4646
kubectl:
4747
repository: rancher/kubectl
48-
tag: v1.30.10
48+
tag: v1.30.11
4949

5050
alerts:
5151
enabled: false

0 commit comments

Comments
 (0)