build: pin GHA to commit SHAs, add workflow permissions and dependabot#4601
Conversation
Pin all GitHub Actions references to immutable commit SHAs with inline version comments. Upgrade fossas/fossa-action from @main to v1.9.0. Add top-level permissions: {} to all workflow files and a missing contents: read block to fossa.yml (fixes code scanning alert agones-dev#23). Add .github/dependabot.yml to enable weekly version update PRs for GitHub Actions. This was done (a) because it's a good idea, and (b) because we kept getting malicious PRs trying to get us to point GitHub Actions to invalid SHA targets. Signed-off-by: Mark Mandel <mark@compoundtheory.com>
markmandel
added
the
area/build-tools
github-actions
Bot
added
kind/cleanup
|
@lacroixthomas particularly want your eyes on this, since you've been doing more with GitHub actions, and you did the fossa bot. |
|
Build Failed 😭 Build Id: 4475fbb5-5970-4311-a550-adc5e13cba2a Status: FAILURE To get permission to view the Cloud Build view, join the agones-discuss Google Group. |
lacroixthomas
left a comment
lacroixthomas
left a comment
There was a problem hiding this comment.
Checked the SHA commits one by one, LGTM !
Also, thanks for putting the actual version it points to as a comment next to it 👌🏼
|
Build Failed 😭 Build Id: cadc7cd8-d51f-4571-b14e-52d60dbba4d6 Status: FAILURE To get permission to view the Cloud Build view, join the agones-discuss Google Group. |
|
Hoisted on my own linter! |
Signed-off-by: Mark Mandel <mark@compoundtheory.com>
|
Build Succeeded 🥳 Build Id: f687649c-12ea-4155-88a9-641a2df406a3 The following development artifacts have been built, and will exist for the next 30 days:
A preview of the website (the last 30 builds are retained): To install this version: |
3 participants
What type of PR is this?
/kind cleanup
What this PR does / Why we need it:
Pin all GitHub Actions references to immutable commit SHAs with inline version comments. Upgrade fossas/fossa-action from @main to v1.9.0. Add top-level permissions: {} to all workflow files and a missing contents: read block to fossa.yml (fixes code scanning alert #23). Add .github/dependabot.yml to enable weekly version update PRs for GitHub Actions.
This was done (a) because it's a good idea, and (b) because we kept getting malicious PRs trying to get us to point GitHub Actions to invalid SHA targets.
Which issue(s) this PR fixes:
N/A
Special notes for your reviewer:
https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions recommends this.