t.behrendt/sec-actions
0
0
Fork 0
Code Issues 2 Pull Requests Actions Activity

ci: pin various actions to a proper semver version (#38)
CD / Release (push) Successful in 15s
Details

Browse Source 
Pinning to the full semver where it is missing. Some digests updated as well.
Also fixed some formatting, there were extra spaces.

Reviewed-on: t.behrendt/trivy-actions#38
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
This commit was merged in pull request #38.
This commit is contained in:
Timo Behrendt
2026-02-14 19:32:40 +01:00
committed by t.behrendt
parent 19e39080e2
commit 067d321f7a
3 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/cd.yaml
+1 -1
View File
@@ -10,7 +10,7 @@ jobs:
name: Release name: Release
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
fetch-depth: 0 fetch-depth: 0
- name: Increment tag - name: Increment tag
.gitea/workflows/ci.yaml
+10 -10
View File
@@ -7,13 +7,13 @@ jobs:
test-setup-trivy: test-setup-trivy:
strategy: strategy:
matrix: matrix:
arch: [amd64, arm64] arch: [ amd64, arm64 ]
name: Test Setup Trivy ${{ matrix.arch }} name: Test Setup Trivy ${{ matrix.arch }}
runs-on: runs-on:
- ubuntu-latest - ubuntu-latest
- linux_${{ matrix.arch }} - linux_${{ matrix.arch }}
steps: steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup Trivy - name: Setup Trivy
uses: ./setup-trivy uses: ./setup-trivy
- name: Run Trivy - name: Run Trivy
@@ -24,7 +24,7 @@ jobs:
runs-on: runs-on:
- ubuntu-latest - ubuntu-latest
steps: steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./setup-trivy - uses: ./setup-trivy
- name: Setup DB - name: Setup DB
id: setup-db id: setup-db
@@ -37,7 +37,7 @@ jobs:
runs-on: runs-on:
- ubuntu-latest - ubuntu-latest
steps: steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- id: giff - id: giff
uses: ./get-images-from-files uses: ./get-images-from-files
with: with:
@@ -53,24 +53,24 @@ jobs:
echo "$images" | jq . echo "$images" | jq .
echo "" echo ""
check() { echo -n " $1: "; echo "$images" | jq -e --arg ref "$2" 'index($ref) != null' >/dev/null && echo "OK" || { echo "FAIL (not found)"; exit 1; }; } check() { echo -n " $1: "; echo "$images" | jq -e --arg ref "$2" 'index($ref) != null' >/dev/null && echo "OK" || { echo "FAIL (not found)"; exit 1; }; }
# Dockerfile-only refs # Dockerfile-only refs
check "Dockerfile registry+tag (nginx:v1)" "example.com/library/nginx:v1" check "Dockerfile registry+tag (nginx:v1)" "example.com/library/nginx:v1"
check "Dockerfile registry+digest (base@sha256:...)" "example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" check "Dockerfile registry+digest (base@sha256:...)" "example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
# K8s-only refs # K8s-only refs
check "K8s registry+tag (app:v2)" "example.com/library/app:v2" check "K8s registry+tag (app:v2)" "example.com/library/app:v2"
check "K8s registry+digest (helper@sha256:...)" "example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" check "K8s registry+digest (helper@sha256:...)" "example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
# Compose-only refs # Compose-only refs
check "Compose registry+tag (web:v3)" "example.com/compose/web:v3" check "Compose registry+tag (web:v3)" "example.com/compose/web:v3"
check "Compose registry+tag (worker:v3)" "example.com/compose/worker:v3" check "Compose registry+tag (worker:v3)" "example.com/compose/worker:v3"
# Helmfile values (repository + tag, optional registry) # Helmfile values (repository + tag, optional registry)
check "Helmfile image (repository+tag)" "example.com/helmfile/app:v4" check "Helmfile image (repository+tag)" "example.com/helmfile/app:v4"
check "Helmfile images.worker (repository+tag)" "example.com/helmfile/worker:v5" check "Helmfile images.worker (repository+tag)" "example.com/helmfile/worker:v5"
check "Helmfile images.helper (repository+tag with digest)" "example.com/myproject/helper:2.0@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" check "Helmfile images.helper (repository+tag with digest)" "example.com/myproject/helper:2.0@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
# Shared ref (in both files) — must appear exactly once # Shared ref (in both files) — must appear exactly once
check "Shared ref present (distroless/static:nonroot)" "example.com/distroless/static:nonroot" check "Shared ref present (distroless/static:nonroot)" "example.com/distroless/static:nonroot"
count=$(echo "$images" | jq '[.[] | select(. == "example.com/distroless/static:nonroot")] | length') count=$(echo "$images" | jq '[.[] | select(. == "example.com/distroless/static:nonroot")] | length')
@@ -79,6 +79,6 @@ jobs:
total=$(echo "$images" | jq 'length') total=$(echo "$images" | jq 'length')
echo -n " Total unique refs: " echo -n " Total unique refs: "
[ "$total" -eq 10 ] && echo "OK ($total)" || { echo "FAIL (got $total, expected 10)"; exit 1; } [ "$total" -eq 10 ] && echo "OK ($total)" || { echo "FAIL (got $total, expected 10)"; exit 1; }
echo "" echo ""
echo "All checks passed." echo "All checks passed."
.gitea/workflows/prerelease.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ jobs:
name: Prerelease name: Prerelease
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
fetch-depth: 0 fetch-depth: 0
- name: Increment tag - name: Increment tag