diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..1fdbf09b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,36 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: daily + + - package-ecosystem: docker + directory: /cmd/builder + schedule: + interval: daily + + - package-ecosystem: docker + directory: /cmd/fetcher + schedule: + interval: daily + + - package-ecosystem: docker + directory: /cmd/fission-bundle + schedule: + interval: daily + + - package-ecosystem: docker + directory: /cmd/preupgradechecks + schedule: + interval: daily + + - package-ecosystem: docker + directory: /cmd/reporter + schedule: + interval: daily + + - package-ecosystem: gomod + directory: / + schedule: + interval: daily diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index 59fd5d95..ba01a8df 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -11,11 +11,23 @@ on: - cron: "0 0 * * 0" workflow_dispatch: +permissions: + contents: read + jobs: CodeQL-Build: + permissions: + actions: read # for github/codeql-action/init to get workflow details + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/analyze to upload SARIF results runs-on: ubuntu-latest if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }} steps: + - name: Harden Runner + uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + with: + egress-policy: audit + - name: Check out code uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 00000000..21a469b1 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,27 @@ +# Dependency Review Action +# +# This Action will scan dependency manifest files that change as part of a Pull Request, +# surfacing known-vulnerable versions of the packages declared or updated in the PR. +# Once installed, if the workflow run is marked as required, +# PRs introducing known-vulnerable packages will be blocked from merging. +# +# Source repository: https://github.com/actions/dependency-review-action +name: 'Dependency Review' +on: [pull_request] + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Harden Runner + uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + with: + egress-policy: audit + + - name: 'Checkout Repository' + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - name: 'Dependency Review' + uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0 diff --git a/.github/workflows/lint-dashboards.yaml b/.github/workflows/lint-dashboards.yaml index 47ab0e82..dbc04572 100644 --- a/.github/workflows/lint-dashboards.yaml +++ b/.github/workflows/lint-dashboards.yaml @@ -13,11 +13,19 @@ on: - 'charts/fission-all/dashboards/**.json' workflow_dispatch: +permissions: + contents: read + jobs: lint-dashboards: runs-on: ubuntu-latest if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }} steps: + - name: Harden Runner + uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + with: + egress-policy: audit + - name: Check out code uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index f3a6a77e..95617d8d 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -21,11 +21,22 @@ env: GOLANGCI_LINT_VERSION: v1.61.0 GOLANGCI_LINT_TIMEOUT: 5m +permissions: + contents: read + jobs: lint: + permissions: + contents: read # for actions/checkout to fetch code + pull-requests: read # for golangci/golangci-lint-action to fetch pull requests runs-on: ubuntu-latest # if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }} steps: + - name: Harden Runner + uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + with: + egress-policy: audit + - name: Check out code uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 diff --git a/.github/workflows/push_pr.yaml b/.github/workflows/push_pr.yaml index e47afa3f..13148052 100644 --- a/.github/workflows/push_pr.yaml +++ b/.github/workflows/push_pr.yaml @@ -26,6 +26,9 @@ env: KIND_VERSION: v0.23.0 KIND_CLUSTER_NAME: kind +permissions: + contents: read + jobs: # Job to run change detection integration-test: @@ -37,6 +40,11 @@ jobs: kindversion: ["v1.25.16", "v1.27.13", "v1.30.0"] os: [ubuntu-latest] steps: + - name: Harden Runner + uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + with: + egress-policy: audit + - name: Checkout sources uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 @@ -180,6 +188,11 @@ jobs: kindversion: ["v1.19.16"] os: [ubuntu-latest] steps: + - name: Harden Runner + uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + with: + egress-policy: audit + - name: Checkout sources uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 58505176..639e7175 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -10,10 +10,20 @@ env: KIND_NODE_IMAGE_TAG: v1.25.16 KIND_CLUSTER_NAME: kind +permissions: + contents: read + jobs: create-draft-release: + permissions: + contents: write # for goreleaser/goreleaser-action to create a GitHub release runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + with: + egress-policy: audit + - name: Check out code uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 with: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 04b08cd6..285f7c61 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -31,6 +31,11 @@ jobs: # actions: read steps: + - name: Harden Runner + uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + with: + egress-policy: audit + - name: "Checkout code" uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 with: @@ -68,6 +73,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard (optional). # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6 with: sarif_file: results.sarif diff --git a/.github/workflows/upgrade_test.yaml b/.github/workflows/upgrade_test.yaml index 335e5fb7..bc9f7e52 100644 --- a/.github/workflows/upgrade_test.yaml +++ b/.github/workflows/upgrade_test.yaml @@ -26,6 +26,9 @@ env: KIND_VERSION: v0.23.0 KIND_CLUSTER_NAME: kind +permissions: + contents: read + jobs: upgrade-test: runs-on: ${{ matrix.os }} @@ -36,6 +39,11 @@ jobs: kindversion: ["v1.25.16"] os: [ubuntu-latest] steps: + - name: Harden Runner + uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + with: + egress-policy: audit + - name: Checkout action sources uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 00000000..e8e93873 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,18 @@ +repos: +- repo: https://github.com/gitleaks/gitleaks + rev: v8.16.3 + hooks: + - id: gitleaks +- repo: https://github.com/golangci/golangci-lint + rev: v1.52.2 + hooks: + - id: golangci-lint +- repo: https://github.com/jumanjihouse/pre-commit-hooks + rev: 3.0.0 + hooks: + - id: shellcheck +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.4.0 + hooks: + - id: end-of-file-fixer + - id: trailing-whitespace diff --git a/cmd/builder/Dockerfile b/cmd/builder/Dockerfile index 130886d3..c7f99853 100644 --- a/cmd/builder/Dockerfile +++ b/cmd/builder/Dockerfile @@ -1,3 +1,3 @@ -FROM cgr.dev/chainguard/static:latest +FROM cgr.dev/chainguard/static:latest@sha256:5ff428f8a48241b93a4174dbbc135a4ffb2381a9e10bdbbc5b9db145645886d5 COPY builder /builder ENTRYPOINT ["/builder"] diff --git a/cmd/fetcher/Dockerfile b/cmd/fetcher/Dockerfile index 3282693d..01bc455e 100644 --- a/cmd/fetcher/Dockerfile +++ b/cmd/fetcher/Dockerfile @@ -1,3 +1,3 @@ -FROM cgr.dev/chainguard/static:latest +FROM cgr.dev/chainguard/static:latest@sha256:5ff428f8a48241b93a4174dbbc135a4ffb2381a9e10bdbbc5b9db145645886d5 COPY fetcher / ENTRYPOINT ["/fetcher"] diff --git a/cmd/fission-bundle/Dockerfile b/cmd/fission-bundle/Dockerfile index 82ffbc40..9d45a6a3 100644 --- a/cmd/fission-bundle/Dockerfile +++ b/cmd/fission-bundle/Dockerfile @@ -1,3 +1,3 @@ -FROM cgr.dev/chainguard/static:latest +FROM cgr.dev/chainguard/static:latest@sha256:5ff428f8a48241b93a4174dbbc135a4ffb2381a9e10bdbbc5b9db145645886d5 COPY fission-bundle / ENTRYPOINT ["/fission-bundle"] diff --git a/cmd/fission-bundle/main.go b/cmd/fission-bundle/main.go index 60faea0c..1608cd8e 100644 --- a/cmd/fission-bundle/main.go +++ b/cmd/fission-bundle/main.go @@ -161,7 +161,6 @@ func main() { Use it to start one or more of the fission servers: - Pool manager maintains a pool of generalized function containers, and specializes them on-demand. Executor must be run from a pod in a Kubernetes cluster. diff --git a/cmd/preupgradechecks/Dockerfile b/cmd/preupgradechecks/Dockerfile index bef71ae4..d1f4ac24 100644 --- a/cmd/preupgradechecks/Dockerfile +++ b/cmd/preupgradechecks/Dockerfile @@ -1,3 +1,3 @@ -FROM cgr.dev/chainguard/static:latest +FROM cgr.dev/chainguard/static:latest@sha256:5ff428f8a48241b93a4174dbbc135a4ffb2381a9e10bdbbc5b9db145645886d5 COPY pre-upgrade-checks / ENTRYPOINT ["/pre-upgrade-checks"] diff --git a/cmd/reporter/Dockerfile b/cmd/reporter/Dockerfile index 87816208..1c9aed70 100644 --- a/cmd/reporter/Dockerfile +++ b/cmd/reporter/Dockerfile @@ -1,3 +1,3 @@ -FROM cgr.dev/chainguard/static:latest +FROM cgr.dev/chainguard/static:latest@sha256:5ff428f8a48241b93a4174dbbc135a4ffb2381a9e10bdbbc5b9db145645886d5 COPY reporter / ENTRYPOINT ["/reporter"]