Skip to content

Commit 7f1907d

Browse files
dflookdflook
authored
Merge pull request #357 from dflook/workflows
Update workflows
2 parents 4c44848 + 778cb93 commit 7f1907d

32 files changed

+1744
-873
lines changed

‎.github/workflows/base-image.yaml

+6-1
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,20 @@ on:
1010
schedule:
1111
- cron: 0 1 * * 1
1212

13+
permissions:
14+
contents: read
15+
1316
jobs:
1417
push_image:
15-
runs-on: ubuntu-latest
18+
runs-on: ubuntu-24.04
1619
name: Docker Images
1720
env:
1821
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
1922
steps:
2023
- name: Checkout
2124
uses: actions/checkout@v4
25+
with:
26+
persist-credentials: false
2227

2328
- name: Registry login
2429
run: |

‎.github/workflows/labels.yaml

-20
This file was deleted.

‎.github/workflows/pull_request_review.yaml

+10-3
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,22 @@
1-
name: pull_request_review test
1+
name: Test pull_request_review event
22

33
on:
44
- pull_request_review
55

66
jobs:
77
apply:
8-
runs-on: ubuntu-latest
8+
runs-on: ubuntu-24.04
99
name: Apply approved changes on pull_request_review
10+
permissions:
11+
contents: read
12+
pull-requests: write
1013
env:
1114
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1215
steps:
1316
- name: Checkout
1417
uses: actions/checkout@v4
18+
with:
19+
persist-credentials: false
1520

1621
- name: Plan
1722
uses: ./terraform-plan
@@ -27,8 +32,10 @@ jobs:
2732
path: tests/workflows/pull_request_review
2833

2934
- name: Verify outputs
35+
env:
36+
OUTPUT_STRING: ${{ steps.output.outputs.output_string }}
3037
run: |
31-
if [[ "${{ steps.output.outputs.output_string }}" != "the_string" ]]; then
38+
if [[ "$OUTPUT_STRING" != "the_string" ]]; then
3239
echo "::error:: output s not set correctly"
3340
exit 1
3441
fi

‎.github/workflows/pull_request_review_trigger.yaml

-27
This file was deleted.

‎.github/workflows/pull_request_target.yaml

+14-4
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,25 @@
1-
name: pull_request_target test
1+
name: Test pull_request_target event
22

33
on:
4-
- pull_request_target
4+
- pull_request_target # zizmor: ignore[dangerous-triggers]
5+
6+
permissions:
7+
contents: read
58

69
jobs:
710
apply:
8-
runs-on: ubuntu-latest
11+
runs-on: ubuntu-24.04
912
name: Apply approved changes on pull_request_target
13+
permissions:
14+
contents: read
15+
pull-requests: write
1016
env:
1117
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1218
steps:
1319
- name: Checkout
1420
uses: actions/checkout@v4
21+
with:
22+
persist-credentials: false
1523

1624
- name: Plan
1725
uses: ./terraform-plan
@@ -27,8 +35,10 @@ jobs:
2735
path: tests/workflows/pull_request_target
2836

2937
- name: Verify outputs
38+
env:
39+
OUTPUT_STRING: ${{ steps.output.outputs.output_string }}
3040
run: |
31-
if [[ "${{ steps.output.outputs.output_string }}" != "the_string" ]]; then
41+
if [[ "$OUTPUT_STRING" != "the_string" ]]; then
3242
echo "::error:: output s not set correctly"
3343
exit 1
3444
fi

‎.github/workflows/release-test.yaml

-105
This file was deleted.

‎.github/workflows/release.yaml

+28-18
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,23 @@ on:
1010
description: "Tag to release"
1111
required: true
1212

13+
permissions:
14+
contents: read
15+
1316
jobs:
1417
image:
15-
runs-on: ubuntu-latest
18+
runs-on: ubuntu-24.04
1619
name: Release Actions
20+
permissions:
21+
contents: read
22+
packages: write
1723
env:
1824
GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
1925
steps:
2026
- name: Checkout
2127
uses: actions/checkout@v4
28+
with:
29+
persist-credentials: true
2230

2331
- name: Check tofu actions are up to date
2432
run: |
@@ -38,14 +46,14 @@ jobs:
3846

3947
- name: Build action image
4048
id: image_build
49+
env:
50+
RELEASE_TAG: "${{ github.event.release.tag_name }}${{ github.event.inputs.tag_name }}"
4151
run: |
42-
RELEASE_TAG="${{ github.event.release.tag_name }}${{ github.event.inputs.tag_name }}"
43-
4452
docker buildx build \
4553
--build-arg FETCH_CHECKSUMS=yes \
4654
--build-arg VERSION="${RELEASE_TAG:1}" \
47-
--tag danielflook/terraform-github-actions:$RELEASE_TAG \
48-
--tag ghcr.io/dflook/terraform-github-actions:$RELEASE_TAG \
55+
--tag "danielflook/terraform-github-actions:$RELEASE_TAG" \
56+
--tag "ghcr.io/dflook/terraform-github-actions:$RELEASE_TAG" \
4957
--platform linux/amd64,linux/arm64 \
5058
--attest type=provenance,mode=max,builder-id=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID \
5159
--push \
@@ -55,29 +63,31 @@ jobs:
5563
echo "digest=$(<manifest-list-digest.txt)" >> "$GITHUB_OUTPUT"
5664
5765
- name: Release actions
66+
env:
67+
RELEASE_TAG: "${{ github.event.release.tag_name }}${{ github.event.inputs.tag_name }}"
68+
IMAGE_DIGEST: ${{ steps.image_build.outputs.digest }}
5869
run: |
59-
export RELEASE_TAG="${{ github.event.release.tag_name }}${{ github.event.inputs.tag_name }}"
60-
export major=$(echo $RELEASE_TAG | cut -d. -f1)
61-
export minor=$(echo $RELEASE_TAG | cut -d. -f2)
70+
export major=$(echo "$RELEASE_TAG" | cut -d. -f1)
71+
export minor=$(echo "$RELEASE_TAG" | cut -d. -f2)
6272
6373
git config --global user.name "Daniel Flook"
6474
git config --global user.email "[email protected]"
6575
6676
function prepare_release() {
67-
rsync -r $GITHUB_WORKSPACE/$action/ $HOME/$action
68-
rm -rf $HOME/$action/.github
69-
mkdir $HOME/$action/.github
70-
cp $GITHUB_WORKSPACE/.github/FUNDING.yml $HOME/$action/.github/FUNDING.yml
77+
rsync -r "$GITHUB_WORKSPACE/$action/" "$HOME/$action"
78+
rm -rf "$HOME/$action/.github"
79+
mkdir "$HOME/$action/.github"
80+
cp "$GITHUB_WORKSPACE/.github/FUNDING.yml" "$HOME/$action/.github/FUNDING.yml"
7181
}
7282
73-
for action in $(cd $GITHUB_WORKSPACE && find . -name action.yaml -printf "%h\n" | sed 's/^.\///'); do
83+
for action in $(cd "$GITHUB_WORKSPACE" && find . -name action.yaml -printf "%h\n" | sed 's/^.\///'); do
7484
75-
if git clone https://dflook:[email protected]/dflook/$action.git "$HOME/$action"; then
85+
if git clone "https://dflook:[email protected]/dflook/$action.git" "$HOME/$action"; then
7686
echo "Releasing dflook/$action@$RELEASE_TAG"
7787
7888
# git tags that use DockerHub for the image
7989
prepare_release
80-
sed -i 's| image:.*| image: docker://danielflook/terraform-github-actions@${{ steps.image_build.outputs.digest }}|' $HOME/$action/action.yaml
90+
sed -i "s| image:.*| image: docker://danielflook/terraform-github-actions@$IMAGE_DIGEST|" "$HOME/$action/action.yaml"
8191
8292
git -C "$HOME/$action" add -A
8393
git -C "$HOME/$action" commit -m "$RELEASE_TAG"
@@ -90,7 +100,7 @@ jobs:
90100
# git tags that use GitHub Container Registry for the image
91101
git -C "$HOME/$action" checkout ghcr || git -C "$HOME/$action" checkout -b ghcr
92102
prepare_release
93-
sed -i 's| image:.*| image: docker://ghcr.io/dflook/terraform-github-actions@${{ steps.image_build.outputs.digest }}|' $HOME/$action/action.yaml
103+
sed -i "s| image:.*| image: docker://ghcr.io/dflook/terraform-github-actions@$IMAGE_DIGEST|" "$HOME/$action/action.yaml"
94104
95105
git -C "$HOME/$action" add -A
96106
git -C "$HOME/$action" commit -m "$RELEASE_TAG-ghcr"
@@ -101,11 +111,11 @@ jobs:
101111
git -C "$HOME/$action" push --force --tags
102112
103113
# Create the github release
104-
cat $GITHUB_WORKSPACE/.github/release_template.md \
114+
cat "$GITHUB_WORKSPACE/.github/release_template.md" \
105115
| envsubst \
106116
| jq --slurp --raw-input --arg RELEASE_TAG "$RELEASE_TAG" '{"tag_name": $RELEASE_TAG, "name": $RELEASE_TAG, "body": . }' \
107117
| curl -X POST \
108-
--user dflook:$GITHUB_TOKEN \
118+
--user "dflook:$GITHUB_TOKEN" \
109119
--header "Content-Type: application/json" \
110120
--data-binary @- \
111121
"https://api.github.com/repos/dflook/$action/releases"

‎.github/workflows/repository_dispatch.yaml

+11-3
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,25 @@
1-
name: Respository Dispatch
1+
name: Repository Dispatch
22

33
on: [repository_dispatch]
44

55
env:
66
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
plan:
10-
runs-on: ubuntu-latest
13+
runs-on: ubuntu-24.04
1114
name: Create terraform plan
15+
permissions:
16+
contents: read
17+
pull-requests: write
1218
steps:
1319
- name: Checkout
14-
uses: actions/checkout@v2
20+
uses: actions/checkout@v4
21+
with:
22+
persist-credentials: false
1523

1624
- name: terraform plan
1725
uses: ./terraform-plan

0 commit comments

Comments
 (0)