diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 9b6c10f..0a98861 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -41,7 +41,7 @@ It is not:
- [ ] Should be preserved under [the `code-scanning` directory](https://github.com/actions/starter-workflows/tree/main/code-scanning).
- [ ] Should include a matching `code-scanning/properties/*.properties.json` file (for example, [`code-scanning/properties/codeql.properties.json`](https://github.com/actions/starter-workflows/blob/main/code-scanning/properties/codeql.properties.json)), with properties set as follows:
- [ ] `name`: Name of the Code Scanning integration.
- - [ ] `organization`: Name of the organization producing the Code Scanning integration.
+ - [ ] `creator`: Name of the organization/user producing the Code Scanning integration.
- [ ] `description`: Short description of the Code Scanning integration.
- [ ] `categories`: Array of languages supported by the Code Scanning integration.
- [ ] `iconName`: Name of the SVG logo representing the Code Scanning integration. This SVG logo must be present in [the `icons` directory](https://github.com/actions/starter-workflows/tree/main/icons).
diff --git a/.github/workflows/auto-assign-issues.yml b/.github/workflows/auto-assign-issues.yml
index 0cb9345..adaa8d6 100644
--- a/.github/workflows/auto-assign-issues.yml
+++ b/.github/workflows/auto-assign-issues.yml
@@ -9,7 +9,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: 'Auto-assign issue'
- uses: pozil/auto-assign-issue@v1.10.0
+ uses: pozil/auto-assign-issue@v1.11.0
with:
assignees: phantsure,tiwarishub,anuragc617,vsvipul,bishal-pdmsft
numOfAssignee: 1
diff --git a/.github/workflows/auto-assign.yml b/.github/workflows/auto-assign.yml
index d7161b1..b0789b3 100644
--- a/.github/workflows/auto-assign.yml
+++ b/.github/workflows/auto-assign.yml
@@ -7,4 +7,4 @@ jobs:
add-reviews:
runs-on: ubuntu-latest
steps:
- - uses: kentaro-m/auto-assign-action@v1.2.1
+ - uses: kentaro-m/auto-assign-action@v1.2.2
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index c319ce1..002f30d 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -13,7 +13,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- - uses: actions/stale@v5
+ - uses: actions/stale@v6
with:
stale-issue-message: 'This issue has become stale and will be closed automatically within a period of time. Sorry about that.'
stale-pr-message: 'This pull request has become stale and will be closed automatically within a period of time. Sorry about that.'
diff --git a/.github/workflows/sync-ghes.yaml b/.github/workflows/sync-ghes.yaml
index aba7780..ddd0484 100644
--- a/.github/workflows/sync-ghes.yaml
+++ b/.github/workflows/sync-ghes.yaml
@@ -2,8 +2,7 @@ name: Sync workflows for GHES
on:
push:
- branches:
- - main
+ branches: [ main ]
jobs:
sync:
diff --git a/README.md b/README.md
index f39892f..7ff406f 100644
--- a/README.md
+++ b/README.md
@@ -12,10 +12,11 @@ These are the workflow files for helping people get started with GitHub Actions.
### Directory structure
-* [ci](ci): solutions for Continuous Integration workflows.
-* [deployments](deployments): solutions for Deployment workflows.
-* [automation](automation): solutions for automating workflows.
-* [code-scanning](code-scanning): starter workflows for [Code Scanning](https://github.com/features/security)
+* [ci](ci): solutions for Continuous Integration workflows
+* [deployments](deployments): solutions for Deployment workflows
+* [automation](automation): solutions for automating workflows
+* [code-scanning](code-scanning): solutions for [Code Scanning](https://github.com/features/security)
+* [pages](pages): solutions for Pages workflows
* [icons](icons): svg icons for the relevant template
Each workflow must be written in YAML and have a `.yml` extension. They also need a corresponding `.properties.json` file that contains extra metadata about the workflow (this is displayed in the GitHub.com UI).
@@ -40,6 +41,8 @@ For example: `ci/django.yml` and `ci/properties/django.properties.json`.
* monitoring
* Automation
* utilities
+* Pages
+* Hugo
### Variables
These variables can be placed in the starter workflow and will be substituted as detailed below:
diff --git a/ci/ant.yml b/ci/ant.yml
index 1614664..e9dba01 100644
--- a/ci/ant.yml
+++ b/ci/ant.yml
@@ -1,5 +1,5 @@
# This workflow will build a Java project with Ant
-# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-ant
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-ant
name: Java CI
diff --git a/ci/docker-publish.yml b/ci/docker-publish.yml
index e88539d..11dd662 100644
--- a/ci/docker-publish.yml
+++ b/ci/docker-publish.yml
@@ -41,9 +41,9 @@ jobs:
# https://github.com/sigstore/cosign-installer
- name: Install cosign
if: github.event_name != 'pull_request'
- uses: sigstore/cosign-installer@7e0881f8fe90b25e305bbf0309761e9314607e25
+ uses: sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 #v2.6.0
with:
- cosign-release: 'v1.9.0'
+ cosign-release: 'v1.11.0'
# Workaround: https://github.com/docker/build-push-action/issues/461
@@ -78,6 +78,9 @@ jobs:
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
+ cache-from: type=gha
+ cache-to: type=gha,mode=max
+
# Sign the resulting Docker image digest except on PRs.
# This will only write to the public Rekor transparency log when the Docker
diff --git a/ci/dotnet-desktop.yml b/ci/dotnet-desktop.yml
index bd2cb2e..fd82a39 100644
--- a/ci/dotnet-desktop.yml
+++ b/ci/dotnet-desktop.yml
@@ -69,7 +69,7 @@ jobs:
# Install the .NET Core workload
- name: Install .NET Core
- uses: actions/setup-dotnet@v2
+ uses: actions/setup-dotnet@v3
with:
dotnet-version: 6.0.x
diff --git a/ci/dotnet.yml b/ci/dotnet.yml
index a8eccab..f11f050 100644
--- a/ci/dotnet.yml
+++ b/ci/dotnet.yml
@@ -1,3 +1,6 @@
+# This workflow will build a .NET project
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-net
+
name: .NET
on:
@@ -14,7 +17,7 @@ jobs:
steps:
- uses: actions/checkout@v3
- name: Setup .NET
- uses: actions/setup-dotnet@v2
+ uses: actions/setup-dotnet@v3
with:
dotnet-version: 6.0.x
- name: Restore dependencies
diff --git a/ci/generator-generic-ossf-slsa3-publish.yml b/ci/generator-generic-ossf-slsa3-publish.yml
new file mode 100644
index 0000000..a249449
--- /dev/null
+++ b/ci/generator-generic-ossf-slsa3-publish.yml
@@ -0,0 +1,68 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow lets you generate SLSA provenance file for your project.
+# The generation satisfies level 3 for the provenance requirements - see https://slsa.dev/spec/v0.1/requirements
+# The project is an initiative of the OpenSSF (openssf.org) and is developed at
+# https://github.com/slsa-framework/slsa-github-generator.
+# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
+# For more information about SLSA and how it improves the supply-chain, visit slsa.dev.
+
+name: SLSA generic generator
+on:
+ workflow_dispatch:
+ release:
+ types: [created]
+
+permissions: read-all
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ outputs:
+ digests: ${{ steps.hash.outputs.digests }}
+
+ steps:
+ - uses: actions/checkout@v3
+
+ # ========================================================
+ #
+ # Step 1: Build your artifacts.
+ #
+ # ========================================================
+ - name: Build artifacts
+ run: |
+ # These are some amazing artifacts.
+ echo "artifact1" > artifact1
+ echo "artifact2" > artifact2
+
+ # ========================================================
+ #
+ # Step 2: Add a step to generate the provenance subjects
+ # as shown below. Update the sha256 sum arguments
+ # to include all binaries that you generate
+ # provenance for.
+ #
+ # ========================================================
+ - name: Generate subject
+ id: hash
+ run: |
+ set -euo pipefail
+
+ # List the artifacts the provenance will refer to.
+ files=$(ls artifact*)
+ # Generate the subjects (base64 encoded).
+ echo "::set-output name=digests::$(sha256sum $files | base64 -w0)"
+
+ provenance:
+ needs: [build]
+ permissions:
+ actions: read # To read the workflow path.
+ id-token: write # To sign the provenance.
+ contents: write # To add assets to a release.
+ uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.2.0
+ with:
+ base64-subjects: "${{ needs.build.outputs.digests }}"
+ upload-assets: true # Optional: Upload to a new release
diff --git a/ci/go.yml b/ci/go.yml
index bb3ec96..4d95674 100644
--- a/ci/go.yml
+++ b/ci/go.yml
@@ -1,3 +1,6 @@
+# This workflow will build a golang project
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-go
+
name: Go
on:
diff --git a/ci/gradle.yml b/ci/gradle.yml
index 0c0f12c..2be0b58 100644
--- a/ci/gradle.yml
+++ b/ci/gradle.yml
@@ -3,7 +3,7 @@
# separate terms of service, privacy policy, and support
# documentation.
# This workflow will build a Java project with Gradle and cache/restore any dependencies to improve the workflow execution time
-# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-gradle
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-gradle
name: Java CI with Gradle
diff --git a/ci/jekyll.yml b/ci/jekyll-docker.yml
similarity index 100%
rename from ci/jekyll.yml
rename to ci/jekyll-docker.yml
diff --git a/ci/maven.yml b/ci/maven.yml
index 65e0dff..c553f73 100644
--- a/ci/maven.yml
+++ b/ci/maven.yml
@@ -1,5 +1,10 @@
# This workflow will build a Java project with Maven, and cache/restore any dependencies to improve the workflow execution time
-# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-maven
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
name: Java CI with Maven
@@ -24,3 +29,7 @@ jobs:
cache: maven
- name: Build with Maven
run: mvn -B package --file pom.xml
+
+ # Optional: Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive
+ - name: Update dependency graph
+ uses: advanced-security/maven-dependency-submission-action@571e99aab1055c2e71a1e2309b9691de18d6b7d6
diff --git a/ci/node.js.yml b/ci/node.js.yml
index 87ef0d8..f230593 100644
--- a/ci/node.js.yml
+++ b/ci/node.js.yml
@@ -1,5 +1,5 @@
# This workflow will do a clean installation of node dependencies, cache/restore them, build the source code and run tests across different versions of node
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-nodejs
name: Node.js CI
@@ -16,7 +16,7 @@ jobs:
strategy:
matrix:
- node-version: [12.x, 14.x, 16.x]
+ node-version: [14.x, 16.x, 18.x]
# See supported Node.js release schedule at https://nodejs.org/en/about/releases/
steps:
diff --git a/ci/npm-grunt.yml b/ci/npm-grunt.yml
index eda97e1..e39ddbf 100644
--- a/ci/npm-grunt.yml
+++ b/ci/npm-grunt.yml
@@ -12,7 +12,7 @@ jobs:
strategy:
matrix:
- node-version: [12.x, 14.x, 16.x]
+ node-version: [14.x, 16.x, 18.x]
steps:
- uses: actions/checkout@v3
diff --git a/ci/npm-gulp.yml b/ci/npm-gulp.yml
index 504f22e..7606dea 100644
--- a/ci/npm-gulp.yml
+++ b/ci/npm-gulp.yml
@@ -12,7 +12,7 @@ jobs:
strategy:
matrix:
- node-version: [12.x, 14.x, 16.x]
+ node-version: [14.x, 16.x, 18.x]
steps:
- uses: actions/checkout@v3
diff --git a/ci/npm-publish-github-packages.yml b/ci/npm-publish-github-packages.yml
index 638ccf8..e790f4d 100644
--- a/ci/npm-publish-github-packages.yml
+++ b/ci/npm-publish-github-packages.yml
@@ -1,5 +1,5 @@
# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
+# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
name: Node.js Package
diff --git a/ci/npm-publish.yml b/ci/npm-publish.yml
index c461c85..6cdebaf 100644
--- a/ci/npm-publish.yml
+++ b/ci/npm-publish.yml
@@ -1,5 +1,5 @@
# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
+# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
name: Node.js Package
diff --git a/ci/properties/generator-generic-ossf-slsa3-publish.properties.json b/ci/properties/generator-generic-ossf-slsa3-publish.properties.json
new file mode 100644
index 0000000..32cf63d
--- /dev/null
+++ b/ci/properties/generator-generic-ossf-slsa3-publish.properties.json
@@ -0,0 +1,7 @@
+{
+ "name": "SLSA Generic generator",
+ "creator": "Open Source Security Foundation (OpenSSF)",
+ "description": "Generate SLSA3 provenance for your existing release workflows",
+ "iconName": "generator-generic-ossf-slsa3-publish",
+ "categories": ["Continuous integration", "Go", "Elixir", "Erlang", "PHP", "Haskell", "Rust", "Java", "Scala", "Gradle", "Maven", "Python", "C", "C++", "TypeScript", "JavaScript", "npm", "Ruby", "HTML", "Composer", "Makefile", "Ada"]
+}
diff --git a/ci/properties/jekyll.properties.json b/ci/properties/jekyll-docker.properties.json
similarity index 80%
rename from ci/properties/jekyll.properties.json
rename to ci/properties/jekyll-docker.properties.json
index bbe279c..7c66dba 100644
--- a/ci/properties/jekyll.properties.json
+++ b/ci/properties/jekyll-docker.properties.json
@@ -1,5 +1,5 @@
{
- "name": "Jekyll",
+ "name": "Jekyll using Docker image",
"description": "Package a Jekyll site using the jekyll/builder Docker image.",
"iconName": "jekyll",
"categories": ["Continuous integration", "HTML"]
diff --git a/ci/python-app.yml b/ci/python-app.yml
index 4b7fa5f..9945382 100644
--- a/ci/python-app.yml
+++ b/ci/python-app.yml
@@ -1,5 +1,5 @@
# This workflow will install Python dependencies, run tests and lint with a single version of Python
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python
name: Python application
diff --git a/ci/python-package.yml b/ci/python-package.yml
index 583a366..de579a3 100644
--- a/ci/python-package.yml
+++ b/ci/python-package.yml
@@ -1,5 +1,5 @@
# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python
name: Python package
diff --git a/ci/python-publish.yml b/ci/python-publish.yml
index ec70354..bdaab28 100644
--- a/ci/python-publish.yml
+++ b/ci/python-publish.yml
@@ -1,5 +1,5 @@
# This workflow will upload a Python Package using Twine when a release is created
-# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
diff --git a/ci/ruby.yml b/ci/ruby.yml
index 81ea363..6340760 100644
--- a/ci/ruby.yml
+++ b/ci/ruby.yml
@@ -30,7 +30,7 @@ jobs:
# To automatically get bug fixes and new Ruby versions for ruby/setup-ruby,
# change this to (see https://github.com/ruby/setup-ruby#versioning):
# uses: ruby/setup-ruby@v1
- uses: ruby/setup-ruby@2b019609e2b0f1ea1a2bc8ca11cb82ab46ada124
+ uses: ruby/setup-ruby@0a29871fe2b0200a17a4497bae54fe5df0d973aa # v1.115.3
with:
ruby-version: ${{ matrix.ruby-version }}
bundler-cache: true # runs 'bundle install' and caches installed gems automatically
diff --git a/ci/rubyonrails.yml b/ci/rubyonrails.yml
index 2ad891f..958a104 100644
--- a/ci/rubyonrails.yml
+++ b/ci/rubyonrails.yml
@@ -30,7 +30,7 @@ jobs:
uses: actions/checkout@v3
# Add or replace dependency steps here
- name: Install Ruby and gems
- uses: ruby/setup-ruby@8f312efe1262fb463d906e9bf040319394c18d3e # v1.92
+ uses: ruby/setup-ruby@0a29871fe2b0200a17a4497bae54fe5df0d973aa # v1.115.3
with:
bundler-cache: true
# Add or replace database setup steps here
@@ -46,7 +46,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@v3
- name: Install Ruby and gems
- uses: ruby/setup-ruby@8f312efe1262fb463d906e9bf040319394c18d3e # v1.92
+ uses: ruby/setup-ruby@0a29871fe2b0200a17a4497bae54fe5df0d973aa # v1.115.3
with:
bundler-cache: true
# Add or replace any other lints here
diff --git a/ci/swift.yml b/ci/swift.yml
index 3668fc0..91276e3 100644
--- a/ci/swift.yml
+++ b/ci/swift.yml
@@ -1,3 +1,6 @@
+# This workflow will build a Swift project
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-swift
+
name: Swift
on:
diff --git a/ci/webpack.yml b/ci/webpack.yml
index 6449fe7..0bc6406 100644
--- a/ci/webpack.yml
+++ b/ci/webpack.yml
@@ -12,7 +12,7 @@ jobs:
strategy:
matrix:
- node-version: [12.x, 14.x, 16.x]
+ node-version: [14.x, 16.x, 18.x]
steps:
- uses: actions/checkout@v3
diff --git a/code-scanning/anchore.yml b/code-scanning/anchore.yml
index a3d2eed..818fb70 100644
--- a/code-scanning/anchore.yml
+++ b/code-scanning/anchore.yml
@@ -9,7 +9,7 @@
# and parameters, see https://github.com/anchore/scan-action. For more
# information on Anchore's container image scanning tool Grype, see
# https://github.com/anchore/grype
-name: Anchore Container Scan
+name: Anchore Grype vulnerability scan
on:
push:
@@ -28,20 +28,21 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
- actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
steps:
- - name: Checkout the code
+ - name: Check out the code
uses: actions/checkout@v3
- name: Build the Docker image
run: docker build . --file Dockerfile --tag localbuild/testimage:latest
- - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
- uses: anchore/scan-action@b08527d5ae7f7dc76f9621edb6e49eaf47933ccd
+ - name: Run the Anchore Grype scan action
+ uses: anchore/scan-action@d5aa5b6cb9414b0c7771438046ff5bcfa2854ed7
+ id: scan
with:
image: "localbuild/testimage:latest"
- acs-report-enable: true
- fail-build: false
- - name: Upload Anchore Scan Report
+ fail-build: true
+ severity-cutoff: critical
+ - name: Upload vulnerability report
uses: github/codeql-action/upload-sarif@v2
with:
- sarif_file: results.sarif
+ sarif_file: ${{ steps.scan.outputs.sarif }}
diff --git a/code-scanning/apisec-scan.yml b/code-scanning/apisec-scan.yml
index fc09be3..f44fd96 100644
--- a/code-scanning/apisec-scan.yml
+++ b/code-scanning/apisec-scan.yml
@@ -46,9 +46,11 @@ permissions:
contents: read
jobs:
- Trigger APIsec scan:
+
+ Trigger_APIsec_scan:
permissions:
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
steps:
diff --git a/code-scanning/brakeman.yml b/code-scanning/brakeman.yml
index 155208f..957343c 100644
--- a/code-scanning/brakeman.yml
+++ b/code-scanning/brakeman.yml
@@ -25,6 +25,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
name: Brakeman Scan
runs-on: ubuntu-latest
steps:
@@ -34,7 +35,7 @@ jobs:
# Customize the ruby version depending on your needs
- name: Setup Ruby
- uses: ruby/setup-ruby@f20f1eae726df008313d2e0d78c5e602562a1bcf
+ uses: ruby/setup-ruby@0a29871fe2b0200a17a4497bae54fe5df0d973aa # v1.115.3
with:
ruby-version: '2.7'
diff --git a/code-scanning/checkmarx.yml b/code-scanning/checkmarx.yml
index e060654..9bdb136 100644
--- a/code-scanning/checkmarx.yml
+++ b/code-scanning/checkmarx.yml
@@ -29,6 +29,7 @@ jobs:
issues: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to github issues
pull-requests: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to PR
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
# Steps require - checkout code, run CxFlow Action, Upload SARIF report (optional)
diff --git a/code-scanning/clj-holmes.yml b/code-scanning/clj-holmes.yml
index 3cfde14..4487e23 100644
--- a/code-scanning/clj-holmes.yml
+++ b/code-scanning/clj-holmes.yml
@@ -24,6 +24,7 @@ jobs:
permissions:
contents: read
security-events: write
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
steps:
- name: Checkout code
uses: actions/checkout@v2
diff --git a/code-scanning/clj-watson.yml b/code-scanning/clj-watson.yml
index 2e4ab3c..76903a9 100644
--- a/code-scanning/clj-watson.yml
+++ b/code-scanning/clj-watson.yml
@@ -29,6 +29,7 @@ jobs:
permissions:
contents: read
security-events: write
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
steps:
- name: Checkout code
uses: actions/checkout@v2
diff --git a/code-scanning/codacy.yml b/code-scanning/codacy.yml
index b74e449..7b705bd 100644
--- a/code-scanning/codacy.yml
+++ b/code-scanning/codacy.yml
@@ -30,6 +30,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
name: Codacy Security Scan
runs-on: ubuntu-latest
steps:
diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml
index a113b59..34c5de7 100644
--- a/code-scanning/codeql.yml
+++ b/code-scanning/codeql.yml
@@ -53,7 +53,7 @@ jobs:
# queries: security-extended,security-and-quality
- # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
+ # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
uses: github/codeql-action/autobuild@v2
@@ -70,3 +70,5 @@ jobs:
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
+ with:
+ category: "/language:${{matrix.language}}"
diff --git a/code-scanning/codescan.yml b/code-scanning/codescan.yml
index 92707b1..a9f1053 100644
--- a/code-scanning/codescan.yml
+++ b/code-scanning/codescan.yml
@@ -25,6 +25,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
steps:
- name: Checkout repository
diff --git a/code-scanning/contrast-scan.yml b/code-scanning/contrast-scan.yml
index 61ffd7a..4e4deb7 100644
--- a/code-scanning/contrast-scan.yml
+++ b/code-scanning/contrast-scan.yml
@@ -30,6 +30,7 @@ jobs:
permissions:
contents: read # for actions/checkout
security-events: write # for github/codeql-action/upload-sarif
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
# check out project
steps:
diff --git a/code-scanning/eslint.yml b/code-scanning/eslint.yml
index 9067a7d..54b01c8 100644
--- a/code-scanning/eslint.yml
+++ b/code-scanning/eslint.yml
@@ -25,6 +25,7 @@ jobs:
permissions:
contents: read
security-events: write
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
steps:
- name: Checkout code
uses: actions/checkout@v3
diff --git a/code-scanning/ethicalcheck.yml b/code-scanning/ethicalcheck.yml
new file mode 100644
index 0000000..2818bc6
--- /dev/null
+++ b/code-scanning/ethicalcheck.yml
@@ -0,0 +1,69 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# EthicalCheck addresses the critical need to continuously security test APIs in development and in production.
+
+# EthicalCheck provides the industry’s only free & automated API security testing service that uncovers security vulnerabilities using OWASP API list.
+# Developers relies on EthicalCheck to evaluate every update and release, ensuring that no APIs go to production with exploitable vulnerabilities.
+
+# You develop the application and API, we bring complete and continuous security testing to you, accelerating development.
+
+# Know your API and Applications are secure with EthicalCheck – our free & automated API security testing service.
+
+# How EthicalCheck works?
+# EthicalCheck functions in the following simple steps.
+# 1. Security Testing.
+# Provide your OpenAPI specification or start with a public Postman collection URL.
+# EthicalCheck instantly instrospects your API and creates a map of API endpoints for security testing.
+# It then automatically creates hundreds of security tests that are non-intrusive to comprehensively and completely test for authentication, authorizations, and OWASP bugs your API. The tests addresses the OWASP API Security categories including OAuth 2.0, JWT, Rate Limit etc.
+
+# 2. Reporting.
+# EthicalCheck generates security test report that includes all the tested endpoints, coverage graph, exceptions, and vulnerabilities.
+# Vulnerabilities are fully triaged, it contains CVSS score, severity, endpoint information, and OWASP tagging.
+
+
+# This is a starter workflow to help you get started with EthicalCheck Actions
+
+name: EthicalCheck-Workflow
+
+# Controls when the workflow will run
+on:
+ # Triggers the workflow on push or pull request events but only for the $default-branch branch
+ # Customize trigger events based on your DevSecOps processes.
+ push:
+ branches: [ $default-branch, $protected-branches ]
+ pull_request:
+ branches: [ $default-branch ]
+ schedule:
+ - cron: $cron-weekly
+
+ # Allows you to run this workflow manually from the Actions tab
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+jobs:
+ Trigger_EthicalCheck:
+ permissions:
+ security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+ runs-on: ubuntu-latest
+
+ steps:
+ - name: EthicalCheck Free & Automated API Security Testing Service
+ uses: apisec-inc/ethicalcheck-action@005fac321dd843682b1af6b72f30caaf9952c641
+ with:
+ # The OpenAPI Specification URL or Swagger Path or Public Postman collection URL.
+ oas-url: "http://netbanking.apisec.ai:8080/v2/api-docs"
+ # The email address to which the penetration test report will be sent.
+ email: "xxx@apisec.ai"
+ sarif-result-file: "ethicalcheck-results.sarif"
+
+ - name: Upload sarif file to repository
+ uses: github/codeql-action/upload-sarif@v2
+ with:
+ sarif_file: ./ethicalcheck-results.sarif
+
diff --git a/code-scanning/frogbot-scan-and-fix.yml b/code-scanning/frogbot-scan-and-fix.yml
index 56725f5..0089f10 100644
--- a/code-scanning/frogbot-scan-and-fix.yml
+++ b/code-scanning/frogbot-scan-and-fix.yml
@@ -10,14 +10,11 @@
name: "Frogbot Scan and Fix"
on:
push:
- branches:
- # The scanning and creation of pull requests with fixes are triggered by pushing code to one of the these branches.
- # You can edit the list of branches you wish to open fix pull requests on.
- - "main"
- - "master"
+ branches: [ $default-branch ]
permissions:
contents: write
pull-requests: write
+ security-events: write
jobs:
create-fix-pull-requests:
runs-on: ubuntu-latest
@@ -40,7 +37,7 @@ jobs:
# node-version: "16.x"
- - uses: jfrog/frogbot@de3d42bf3a454ddf156632ae520a5ead49048416
+ - uses: jfrog/frogbot@9304d3b1d8e05a1b5fc0ba9ebf9ffbd495386250
env:
# [Mandatory]
# JFrog platform URL (This functionality requires version 3.29.0 or above of Xray)
diff --git a/code-scanning/frogbot-scan-pr.yml b/code-scanning/frogbot-scan-pr.yml
index bdc71b4..bd1a9c2 100644
--- a/code-scanning/frogbot-scan-pr.yml
+++ b/code-scanning/frogbot-scan-pr.yml
@@ -42,7 +42,7 @@ jobs:
# The full template list with the required GitHub Actions can be found at https://github.com/jfrog/frogbot/tree/master/templates/github-actions/scan-pull-request
- - uses: jfrog/frogbot@de3d42bf3a454ddf156632ae520a5ead49048416
+ - uses: jfrog/frogbot@9304d3b1d8e05a1b5fc0ba9ebf9ffbd495386250
env:
# [Mandatory]
# JFrog platform URL (This functionality requires version 3.29.0 or above of Xray)
diff --git a/code-scanning/hadolint.yml b/code-scanning/hadolint.yml
index 2f554e4..3153652 100644
--- a/code-scanning/hadolint.yml
+++ b/code-scanning/hadolint.yml
@@ -27,7 +27,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
-
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
steps:
- name: Checkout code
uses: actions/checkout@v3
diff --git a/code-scanning/lintr.yml b/code-scanning/lintr.yml
new file mode 100644
index 0000000..350df19
--- /dev/null
+++ b/code-scanning/lintr.yml
@@ -0,0 +1,55 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+# lintr provides static code analysis for R.
+# It checks for adherence to a given style,
+# identifying syntax errors and possible semantic issues,
+# then reports them to you so you can take action.
+# More details at https://lintr.r-lib.org/
+
+name: lintr
+
+on:
+ push:
+ branches: [ $default-branch, $protected-branches ]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [ $default-branch ]
+ schedule:
+ - cron: $cron-weekly
+
+permissions:
+ contents: read
+
+jobs:
+ lintr:
+ name: Run lintr scanning
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read # for checkout to fetch code
+ security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v3
+
+ - name: Setup R
+ uses: r-lib/actions/setup-r@4e1feaf90520ec1215d1882fdddfe3411c08e492
+
+ - name: Setup lintr
+ uses: r-lib/actions/setup-r-dependencies@4e1feaf90520ec1215d1882fdddfe3411c08e492
+ with:
+ extra-packages: lintr
+
+ - name: Run lintr
+ run: lintr::sarif_output(lintr::lint_dir("."), "lintr-results.sarif")
+ shell: Rscript {0}
+ continue-on-error: true
+
+ - name: Upload analysis results to GitHub
+ uses: github/codeql-action/upload-sarif@v2
+ with:
+ sarif_file: lintr-results.sarif
+ wait-for-processing: true
diff --git a/code-scanning/mobsf.yml b/code-scanning/mobsf.yml
index 6d2bfb8..1013749 100644
--- a/code-scanning/mobsf.yml
+++ b/code-scanning/mobsf.yml
@@ -21,6 +21,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
steps:
diff --git a/code-scanning/msvc.yml b/code-scanning/msvc.yml
index 863fbcb..e8dac88 100644
--- a/code-scanning/msvc.yml
+++ b/code-scanning/msvc.yml
@@ -28,6 +28,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
name: Analyze
runs-on: windows-latest
diff --git a/code-scanning/njsscan.yml b/code-scanning/njsscan.yml
index 8c359b8..d766a6f 100644
--- a/code-scanning/njsscan.yml
+++ b/code-scanning/njsscan.yml
@@ -25,6 +25,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
name: njsscan code scanning
steps:
diff --git a/code-scanning/nowsecure-mobile-sbom.yml b/code-scanning/nowsecure-mobile-sbom.yml
new file mode 100644
index 0000000..b9cf039
--- /dev/null
+++ b/code-scanning/nowsecure-mobile-sbom.yml
@@ -0,0 +1,55 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+#
+# NowSecure: The Mobile Security Experts .
+#
+# To use this workflow, you must have a token for NowSecure Platform. If you are a NowSecure customer,
+# you can find it in NowSecure Platform.
+#
+# If you *are not* a NowSecure customer, click here to sign up for a free trial to get access:
+# .
+#
+# Instructions:
+#
+# 1. In the settings for your repository, click "Secrets" then "New repository secret". Name the secret "NS_TOKEN" and
+# paste in your Platform token. If you do not have a Platform token, or wish to create a new one for GitHub, visit
+# NowSecure Platform and go to "Profile & Preferences" then create a token labelled "GitHub".
+#
+# 2. Follow the annotated workflow below and make any necessary modifications then save the workflow to your repository
+# and review the "Dependency graph" tab in the "Insights" pane once the action has run.
+
+name: "NowSecure Mobile SBOM"
+
+on:
+ push:
+ branches: [ $default-branch, $protected-branches ]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [ $default-branch ]
+ schedule:
+ - cron: $cron-weekly
+
+permissions:
+ contents: read
+
+jobs:
+ nowsecure:
+ name: NowSecure Mobile SBOM
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v3
+
+ - name: Build your application
+ run: ./gradlew assembleDebug # Update this to build your Android or iOS application
+
+ - name: NowSecure upload app
+ uses: nowsecure/nowsecure-sbom-action@ecb731b6f17a83fa53f756f9dae2ec7034c5ed7c
+ with:
+ token: ${{ secrets.NS_TOKEN }}
+ app_file: app-debug.apk # Update this to a path to your .ipa or .apk
+ group_id: {{ groupId }} # Update this to your desired Platform group ID
diff --git a/code-scanning/ossar.yml b/code-scanning/ossar.yml
index cbef5a2..2bd91dd 100644
--- a/code-scanning/ossar.yml
+++ b/code-scanning/ossar.yml
@@ -27,6 +27,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: windows-latest
steps:
diff --git a/code-scanning/phpmd.yml b/code-scanning/phpmd.yml
index 91f4b2d..d10ace1 100644
--- a/code-scanning/phpmd.yml
+++ b/code-scanning/phpmd.yml
@@ -34,6 +34,7 @@ jobs:
permissions:
contents: read # for checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
steps:
- name: Checkout code
diff --git a/code-scanning/pmd.yml b/code-scanning/pmd.yml
index a1e32c4..8115116 100644
--- a/code-scanning/pmd.yml
+++ b/code-scanning/pmd.yml
@@ -21,6 +21,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
diff --git a/code-scanning/powershell.yml b/code-scanning/powershell.yml
index 1d72a9b..02e5de7 100644
--- a/code-scanning/powershell.yml
+++ b/code-scanning/powershell.yml
@@ -25,13 +25,14 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
name: PSScriptAnalyzer
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Run PSScriptAnalyzer
- uses: microsoft/psscriptanalyzer-action@2044ae068e37d0161fa2127de04c19633882f061
+ uses: microsoft/psscriptanalyzer-action@6b2948b1944407914a58661c49941824d149734f
with:
# Check https://github.com/microsoft/action-psscriptanalyzer for more info about the options.
# The below set up runs PSScriptAnalyzer to your entire repository and runs some basic security rules.
diff --git a/code-scanning/prisma.yml b/code-scanning/prisma.yml
index 6f2031b..1a12b86 100644
--- a/code-scanning/prisma.yml
+++ b/code-scanning/prisma.yml
@@ -29,6 +29,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
name: Run Prisma Cloud IaC Scan to check
steps:
diff --git a/code-scanning/properties/anchore-syft.properties.json b/code-scanning/properties/anchore-syft.properties.json
index 815f8b2..aa4cb1e 100644
--- a/code-scanning/properties/anchore-syft.properties.json
+++ b/code-scanning/properties/anchore-syft.properties.json
@@ -1,6 +1,6 @@
{
"name": "Anchore Syft SBOM Scan",
- "organization": "Anchore",
+ "creator": "Anchore",
"description": "Produce Software Bills of Materials based on Anchore's open source Syft tool.",
"iconName": "anchore",
"categories": ["Code Scanning", "dockerfile", "dependency-management"]
diff --git a/code-scanning/properties/anchore.properties.json b/code-scanning/properties/anchore.properties.json
index d997da4..94634dd 100644
--- a/code-scanning/properties/anchore.properties.json
+++ b/code-scanning/properties/anchore.properties.json
@@ -1,7 +1,7 @@
{
- "name": "Anchore Container Scan",
- "creator": "Indeni Cloudrail",
- "description": "Produce container image vulnerability and compliance reports based on the open-source Anchore container image scanner.",
+ "name": "Anchore Grype Vulnerability Scan",
+ "creator": "Anchore",
+ "description": "Produce source and container vulnerability reports based on Anchore's open source Grype tool.",
"iconName": "anchore",
"categories": ["Code Scanning", "dockerfile"]
-}
\ No newline at end of file
+}
diff --git a/code-scanning/properties/codeql.properties.json b/code-scanning/properties/codeql.properties.json
index ddb4627..8ee80b4 100644
--- a/code-scanning/properties/codeql.properties.json
+++ b/code-scanning/properties/codeql.properties.json
@@ -1,6 +1,7 @@
{
"name": "CodeQL Analysis",
"creator": "GitHub",
+ "enterprise": true,
"description": "Security analysis from GitHub for C, C++, C#, Go, Java, JavaScript, TypeScript, Python, and Ruby developers.",
"iconName": "octicon mark-github",
"categories": ["Code Scanning", "C", "C++", "C#", "Go", "Java", "JavaScript", "TypeScript", "Python", "Ruby"]
diff --git a/code-scanning/properties/eslint.properties.json b/code-scanning/properties/eslint.properties.json
index a84646a..2a1271f 100644
--- a/code-scanning/properties/eslint.properties.json
+++ b/code-scanning/properties/eslint.properties.json
@@ -2,10 +2,11 @@
"name": "ESLint",
"description": "A tool for identifying and reporting the problems found in ECMAScript/JavaScript code.",
"iconName": "eslint",
+ "enterprise": false,
"categories": [
"Code Scanning",
"JavaScript",
"EcmaScript",
"TypeScript"
]
-}
\ No newline at end of file
+}
diff --git a/code-scanning/properties/ethicalcheck.properties.json b/code-scanning/properties/ethicalcheck.properties.json
new file mode 100644
index 0000000..8728ca7
--- /dev/null
+++ b/code-scanning/properties/ethicalcheck.properties.json
@@ -0,0 +1,24 @@
+{
+ "name": "EthicalCheck",
+ "creator": "APIsec",
+ "description": "EthicalCheck provides the industry’s only free & automated API security testing service that uncovers security vulnerabilities using OWASP API list.",
+ "iconName": "apisec",
+ "categories": [
+ "Code Scanning",
+ "C",
+ "C#",
+ "C++",
+ "Go",
+ "Java",
+ "JavaScript",
+ "Kotlin",
+ "Objective C",
+ "PHP",
+ "Python",
+ "Ruby",
+ "Rust",
+ "Scala",
+ "Swift",
+ "TypeScript"
+ ]
+}
diff --git a/code-scanning/properties/lintr.properties.json b/code-scanning/properties/lintr.properties.json
new file mode 100644
index 0000000..07e9741
--- /dev/null
+++ b/code-scanning/properties/lintr.properties.json
@@ -0,0 +1,6 @@
+{
+ "name": "lintr",
+ "description": "lintr provides static code analysis for R.",
+ "iconName": "lintr",
+ "categories": [ "Code Scanning", "R" ]
+}
\ No newline at end of file
diff --git a/code-scanning/properties/nowsecure-mobile-sbom.properties.json b/code-scanning/properties/nowsecure-mobile-sbom.properties.json
new file mode 100644
index 0000000..32a7964
--- /dev/null
+++ b/code-scanning/properties/nowsecure-mobile-sbom.properties.json
@@ -0,0 +1,21 @@
+{
+ "name": "NowSecure Mobile SBOM",
+ "creator": "NowSecure",
+ "description": "Generate a Mobile SBOM for an application and submit to Dependency Graph",
+ "iconName": "nowsecure",
+ "categories": [
+ "Code Scanning",
+ "Java",
+ "Kotlin",
+ "Scala",
+ "Swift",
+ "Objective C",
+ "C",
+ "C++",
+ "C#",
+ "Rust",
+ "JavaScript",
+ "TypeScript",
+ "Node"
+ ]
+}
diff --git a/code-scanning/properties/zscaler-iac-scan.properties.json b/code-scanning/properties/zscaler-iac-scan.properties.json
new file mode 100644
index 0000000..274d17a
--- /dev/null
+++ b/code-scanning/properties/zscaler-iac-scan.properties.json
@@ -0,0 +1,7 @@
+{
+ "name": "Zscaler IaC Scan",
+ "creator": "Zscaler CWP",
+ "description": "Scan your Infrastructure as Code files using Zscaler Infrastructure as Code (IaC) Scan app",
+ "iconName": "zscaler",
+ "categories": ["Code Scanning"]
+}
\ No newline at end of file
diff --git a/code-scanning/properties/zscan.properties.json b/code-scanning/properties/zscan.properties.json
new file mode 100644
index 0000000..6b55756
--- /dev/null
+++ b/code-scanning/properties/zscan.properties.json
@@ -0,0 +1,14 @@
+{
+ "name": "zScan",
+ "creator": "Zimperium",
+ "description": "The zimperium-zscan GitHub action scans your mobile app binary (iOS or Android) and identifies security, privacy, and compliance-related vulnerabilities. ",
+ "iconName": "zscan",
+ "categories": [
+ "Code Scanning",
+ "Java",
+ "Kotlin",
+ "Scala",
+ "Swift",
+ "Objective C"
+ ]
+}
diff --git a/code-scanning/puppet-lint.yml b/code-scanning/puppet-lint.yml
index 801b90b..50b86db 100644
--- a/code-scanning/puppet-lint.yml
+++ b/code-scanning/puppet-lint.yml
@@ -29,13 +29,14 @@ jobs:
permissions:
contents: read # for checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Setup Ruby
- uses: ruby/setup-ruby@f20f1eae726df008313d2e0d78c5e602562a1bcf
+ uses: ruby/setup-ruby@0a29871fe2b0200a17a4497bae54fe5df0d973aa # v1.115.3
with:
ruby-version: 2.7
bundler-cache: true
diff --git a/code-scanning/rubocop.yml b/code-scanning/rubocop.yml
index ed458b2..8018ca1 100644
--- a/code-scanning/rubocop.yml
+++ b/code-scanning/rubocop.yml
@@ -28,7 +28,7 @@ jobs:
# If running on a self-hosted runner, check it meets the requirements
# listed at https://github.com/ruby/setup-ruby#using-self-hosted-runners
- name: Set up Ruby
- uses: ruby/setup-ruby@f20f1eae726df008313d2e0d78c5e602562a1bcf
+ uses: ruby/setup-ruby@0a29871fe2b0200a17a4497bae54fe5df0d973aa # v1.115.3
with:
ruby-version: 2.6
diff --git a/code-scanning/rust-clippy.yml b/code-scanning/rust-clippy.yml
index e9c426a..c5f10ee 100644
--- a/code-scanning/rust-clippy.yml
+++ b/code-scanning/rust-clippy.yml
@@ -25,6 +25,7 @@ jobs:
permissions:
contents: read
security-events: write
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
steps:
- name: Checkout code
uses: actions/checkout@v2
diff --git a/code-scanning/scorecards.yml b/code-scanning/scorecards.yml
index 539794d..31a4fa1 100644
--- a/code-scanning/scorecards.yml
+++ b/code-scanning/scorecards.yml
@@ -17,20 +17,20 @@ jobs:
permissions:
# Needed to upload the results to code-scanning dashboard.
security-events: write
- # Used to receive a badge. (Upcoming feature)
+ # Used to receive a badge.
id-token: write
# Needs for private repositories.
contents: read
actions: read
-
+
steps:
- name: "Checkout code"
- uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # v3.0.0
+ uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0
with:
persist-credentials: false
- name: "Run analysis"
- uses: ossf/scorecard-action@3e15ea8318eee9b333819ec77a36aca8d39df13e # v1.1.1
+ uses: ossf/scorecard-action@865b4092859256271290c77adbd10a43f4779972 # tag=v2.0.3
with:
results_file: results.sarif
results_format: sarif
@@ -41,22 +41,22 @@ jobs:
# repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
# Publish the results for public repositories to enable scorecard badges. For more details, see
- # https://github.com/ossf/scorecard-action#publishing-results.
- # For private repositories, `publish_results` will automatically be set to `false`, regardless
+ # https://github.com/ossf/scorecard-action#publishing-results.
+ # For private repositories, `publish_results` will automatically be set to `false`, regardless
# of the value entered here.
publish_results: true
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
# format to the repository Actions tab.
- name: "Upload artifact"
- uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v3.0.0
+ uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0
with:
name: SARIF file
path: results.sarif
retention-days: 5
-
+
# Upload the results to GitHub's code scanning dashboard.
- name: "Upload to code-scanning"
- uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # v1.0.26
+ uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26
with:
sarif_file: results.sarif
diff --git a/code-scanning/semgrep.yml b/code-scanning/semgrep.yml
index fae9885..b10a930 100644
--- a/code-scanning/semgrep.yml
+++ b/code-scanning/semgrep.yml
@@ -27,6 +27,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
name: Scan
runs-on: ubuntu-latest
steps:
diff --git a/code-scanning/snyk-container.yml b/code-scanning/snyk-container.yml
index 0fbbf87..a232c53 100644
--- a/code-scanning/snyk-container.yml
+++ b/code-scanning/snyk-container.yml
@@ -30,6 +30,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
diff --git a/code-scanning/snyk-infrastructure.yml b/code-scanning/snyk-infrastructure.yml
index a685323..3ca1035 100644
--- a/code-scanning/snyk-infrastructure.yml
+++ b/code-scanning/snyk-infrastructure.yml
@@ -29,6 +29,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
diff --git a/code-scanning/sobelow.yml b/code-scanning/sobelow.yml
index 21cb6e7..7d38c77 100644
--- a/code-scanning/sobelow.yml
+++ b/code-scanning/sobelow.yml
@@ -28,6 +28,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
steps:
diff --git a/code-scanning/soos-dast-scan.yml b/code-scanning/soos-dast-scan.yml
index cf3b1b7..95dfd67 100644
--- a/code-scanning/soos-dast-scan.yml
+++ b/code-scanning/soos-dast-scan.yml
@@ -3,13 +3,18 @@
# separate terms of service, privacy policy, and support
# documentation.
#
-# SOOS is the easy-to-integrate software security solution for your whole team, learn more at https://soos.io/
+# SOOS is the easy-to-integrate and affordable software security solution for your whole team.
+# Learn more at https://soos.io/
#
-# To use this action you need to fill the following requirements:
+# To use this action, perform the following steps:
#
-# 1. Create an account on https://app.soos.io to obtain a Client ID and API Key (Free 30 days trials for both our SCA/DAST product).
+# 1. Create an account on https://app.soos.io. SOOS offers a free 30 day trial for our SCA and DAST products.
#
-# 2. Set up your API KEY/Client ID as Github Secrets named SOOS_CLIENT_ID & SOOS_API_KEY. (Also set SOOS_GITHUB_PAT with your Github Personal Access Token if you're going to use sarif upload)
+# 2. Navigate to the "Integrate" page in the SOOS app (https://app.soos.io/integrate). Note the "API Credentials" section of this page; the keys you will need for the next step are here.
+#
+# 3. Set up your SOOS API Key and SOOS Client Id as Github Secrets named SOOS_API_KEY and SOOS_CLIENT_ID.
+#
+# 4. (Optional) If you'd like to upload SARIF results of DAST scans to GitHub, set SOOS_GITHUB_PAT with your Github Personal Access Token.
#
name: "SOOS DAST Scan"
@@ -29,7 +34,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Run SOOS DAST Scan
- uses: soos-io/soos-dast-github-action@b524e2cfbc4f4a5733153a7e624f569913f6c6e9
+ uses: soos-io/soos-dast-github-action@093de8c09530d4b96f12322adeb74444def866db # Use latest version from https://github.com/marketplace/actions/soos-dast
with:
client_id: ${{ secrets.SOOS_CLIENT_ID }}
api_key: ${{ secrets.SOOS_API_KEY }}
diff --git a/code-scanning/sysdig-scan.yml b/code-scanning/sysdig-scan.yml
index f075a80..f9b61b9 100644
--- a/code-scanning/sysdig-scan.yml
+++ b/code-scanning/sysdig-scan.yml
@@ -24,6 +24,7 @@ jobs:
checks: write # for sysdiglabs/scan-action to publish the checks
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
steps:
diff --git a/code-scanning/trivy.yml b/code-scanning/trivy.yml
index 63be947..f56d9e5 100644
--- a/code-scanning/trivy.yml
+++ b/code-scanning/trivy.yml
@@ -22,6 +22,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
name: Build
runs-on: "ubuntu-18.04"
steps:
diff --git a/code-scanning/veracode.yml b/code-scanning/veracode.yml
index b8a5b37..89d35df 100644
--- a/code-scanning/veracode.yml
+++ b/code-scanning/veracode.yml
@@ -27,6 +27,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
steps:
diff --git a/code-scanning/xanitizer.yml b/code-scanning/xanitizer.yml
index 3462eaa..5724a97 100644
--- a/code-scanning/xanitizer.yml
+++ b/code-scanning/xanitizer.yml
@@ -51,6 +51,7 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
steps:
diff --git a/code-scanning/zscaler-iac-scan.yml b/code-scanning/zscaler-iac-scan.yml
new file mode 100644
index 0000000..e880bdf
--- /dev/null
+++ b/code-scanning/zscaler-iac-scan.yml
@@ -0,0 +1,56 @@
+#This workflow uses actions that are not certified by GitHub.
+#They are provided by a third party and are governed by
+#separate terms of service, privacy policy, and support
+#documentation.
+
+#This workflow runs the Zscaler Infrastructure as Code (IaC) Scan app,
+#which detects security misconfigurations in IaC templates and publishes the findings
+#under the code scanning alerts section within the repository.
+
+#Log into the Zscaler Posture Control(ZPC) Portal to begin the onboarding process.
+#Copy the client ID and client secret key generated during the onboarding process and configure.
+#GitHub secrets (ZSCANNER_CLIENT_ID, ZSCANNER_CLIENT_SECRET).
+
+#Refer https://github.com/marketplace/actions/zscaler-iac-scan for additional details on setting up this workflow.
+#Any issues with this workflow, please raise it on https://github.com/ZscalerCWP/Zscaler-IaC-Action/issues for further investigation.
+
+name: Zscaler IaC Scan
+on:
+ push:
+ branches: [ $default-branch, $protected-branches ]
+ pull_request:
+ branches: [ $default-branch ]
+ schedule:
+ - cron: $cron-weekly
+
+permissions:
+ contents: read
+
+jobs:
+ zscaler-iac-scan:
+ permissions:
+ contents: read # for actions/checkout to fetch code
+ security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ runs-on: ubuntu-latest
+ steps:
+ - name : Code Checkout
+ uses: actions/checkout@v3
+ - name : Zscaler IAC Scan
+ uses : ZscalerCWP/Zscaler-IaC-Action@8d2afb33b10b4bd50e2dc2c932b37c6e70ac1087
+ id : zscaler-iac-scan
+ with:
+ client_id : ${{ secrets.ZSCANNER_CLIENT_ID }}
+ client_secret : ${{ secrets.ZSCANNER_CLIENT_SECRET }}
+ #This is the user region specified during the onboarding process within the ZPC Admin Portal.
+ region : 'US'
+ iac_dir : #Enter the IaC directory path from root.
+ iac_file : #Enter the IaC file path from root.
+ output_format : #(Optional) By default, the output is provided in a human readable format. However, if you require a different format, you can specify it here.
+ #To fail the build based on policy violations identified in the IaC templates, set the input value (fail_build) to true.
+ fail_build : #Enter true/false
+ #Ensure that the following step is included in order to post the scan results under the code scanning alerts section within the repository.
+ - name: Upload SARIF file
+ if: ${{ success() || failure() && (steps.zscaler-iac-scan.outputs.sarif_file_path != '') }}
+ uses: github/codeql-action/upload-sarif@v2
+ with:
+ sarif_file: ${{ steps.zscaler-iac-scan.sarif_file_path }}
diff --git a/code-scanning/zscan.yml b/code-scanning/zscan.yml
new file mode 100644
index 0000000..1ac6bbd
--- /dev/null
+++ b/code-scanning/zscan.yml
@@ -0,0 +1,61 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+#
+# The zimperium-zscan GitHub action scans your mobile app binary (iOS or Android)
+# and identifies security, privacy, and compliance-related vulnerabilities.
+#
+# Prerequisites:
+# * An active Zimperium zScan account is required. If you are not an existing Zimperium
+# zScan customer, please request a zSCAN demo by visiting https://www.zimperium.com/contact-us.
+# * Either GitHub Advanced Security (GHAS) or a public repository is required to display
+# issues and view the remediation information inside of GitHub code scanning alerts.
+#
+# For additional information and setup instructions
+# please visit: https://github.com/Zimperium/zScanMarketplace#readme
+
+name: "Zimperium zScan"
+
+on:
+ push:
+ branches: [ $default-branch, $protected-branches ]
+ pull_request:
+ branches: [ $default-branch ]
+
+permissions:
+ contents: read
+
+jobs:
+ zscan:
+ name: zScan
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read # for actions/checkout to fetch code
+ security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v3
+
+ - name: Execute gradle build
+ run: ./gradlew build # Change this to build your mobile application
+
+ - name: Run Zimperium zScan
+ uses: zimperium/zscanmarketplace@bfc6670f6648d796098c251ccefcfdb98983174d
+ timeout-minutes: 60
+ with:
+ # REPLACE: Zimperium Client Environment Name
+ client_env: env_string
+ # REPLACE: Zimperium Client ID
+ client_id: id_string
+ # REPLACE: Zimperium Client Secret
+ client_secret: ${{ secrets.ZSCAN_CLIENT_SECRET }}
+ # REPLACE: The path to an .ipa or .apk
+ app_file: app-release-unsigned.apk
+
+ - name: Upload SARIF file
+ uses: github/codeql-action/upload-sarif@v2
+ with:
+ sarif_file: Zimperium.sarif
+
\ No newline at end of file
diff --git a/deployments/alibabacloud.yml b/deployments/alibabacloud.yml
index d7c27d9..9853b75 100644
--- a/deployments/alibabacloud.yml
+++ b/deployments/alibabacloud.yml
@@ -21,8 +21,7 @@ name: Build and Deploy to ACK
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
# Environment variables available to all jobs and steps in this workflow.
env:
diff --git a/deployments/aws.yml b/deployments/aws.yml
index 47253bf..9585844 100644
--- a/deployments/aws.yml
+++ b/deployments/aws.yml
@@ -28,8 +28,7 @@ name: Deploy to Amazon ECS
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
env:
AWS_REGION: MY_AWS_REGION # set this to your preferred AWS region, e.g. us-west-1
diff --git a/deployments/azure-container-webapp.yml b/deployments/azure-container-webapp.yml
index 8b69065..cc2e1dd 100644
--- a/deployments/azure-container-webapp.yml
+++ b/deployments/azure-container-webapp.yml
@@ -31,8 +31,7 @@ env:
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
workflow_dispatch:
permissions:
diff --git a/deployments/azure-kubernetes-service-helm.yml b/deployments/azure-kubernetes-service-helm.yml
index a6a2f4e..86582e7 100644
--- a/deployments/azure-kubernetes-service-helm.yml
+++ b/deployments/azure-kubernetes-service-helm.yml
@@ -1,14 +1,16 @@
# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code
#
# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR)
+# The ACR should be attached to the AKS cluster
# For instructions see:
# - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal
# - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal
+# - https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli#configure-acr-integration-for-existing-aks-clusters
# - https://github.com/Azure/aks-create-action
#
# To configure this workflow:
#
-# 1. Set the following secrets in your repository (instructions for getting these
+# 1. Set the following secrets in your repository (instructions for getting these
# https://docs.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Clinux)):
# - AZURE_CLIENT_ID
# - AZURE_TENANT_ID
@@ -34,8 +36,7 @@ name: Build and deploy an app to AKS with Helm
on:
push:
- branches:
- - $default-branch
+ branches: [$default-branch]
workflow_dispatch:
env:
@@ -43,7 +44,6 @@ env:
CONTAINER_NAME: "your-container-name"
RESOURCE_GROUP: "your-resource-group"
CLUSTER_NAME: "your-cluster-name"
- IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name"
CHART_PATH: "your-chart-path"
CHART_OVERRIDE_PATH: "your-chart-override-path"
@@ -54,63 +54,21 @@ jobs:
id-token: write
runs-on: ubuntu-latest
steps:
- # Checks out the repository this file is in
- - uses: actions/checkout@v3
-
- # Logs in with your Azure credentials
- - name: Azure login
- uses: azure/login@v1.4.3
- with:
- client-id: ${{ secrets.AZURE_CLIENT_ID }}
- tenant-id: ${{ secrets.AZURE_TENANT_ID }}
- subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
- # Builds and pushes an image up to your Azure Container Registry
- - name: Build and push image to ACR
- run: |
- az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} .
+ # Checks out the repository this file is in
+ - uses: actions/checkout@v3
- createSecret:
- permissions:
- contents: read
- id-token: write
- runs-on: ubuntu-latest
- steps:
- # Logs in with your Azure credentials
- - name: Azure login
- uses: azure/login@v1.4.3
- with:
- client-id: ${{ secrets.AZURE_CLIENT_ID }}
- tenant-id: ${{ secrets.AZURE_TENANT_ID }}
- subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+ # Logs in with your Azure credentials
+ - name: Azure login
+ uses: azure/login@v1.4.6
+ with:
+ client-id: ${{ secrets.AZURE_CLIENT_ID }}
+ tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+ subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
- - name: Get K8s context
- uses: azure/aks-set-context@v2.0
- with:
- resource-group: ${{ env.RESOURCE_GROUP }}
- cluster-name: ${{ env.CLUSTER_NAME }}
-
- # Retrieves the credentials for pulling images from your Azure Container Registry
- - name: Get ACR credentials
- run: |
- az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true
- ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv)
- ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv)
- echo "::add-mask::${ACR_USERNAME}"
- echo "::set-output name=username::${ACR_USERNAME}"
- echo "::add-mask::${ACR_PASSWORD}"
- echo "::set-output name=password::${ACR_PASSWORD}"
- id: get-acr-creds
-
- # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step
- - name: Create K8s secret for pulling image from ACR
- uses: Azure/k8s-create-secret@v1.1
- with:
- container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io
- container-registry-username: ${{ steps.get-acr-creds.outputs.username }}
- container-registry-password: ${{ steps.get-acr-creds.outputs.password }}
- secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }}
+ # Builds and pushes an image up to your Azure Container Registry
+ - name: Build and push image to ACR
+ run: |
+ az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} .
deploy:
permissions:
@@ -118,45 +76,43 @@ jobs:
contents: read
id-token: write
runs-on: ubuntu-latest
- needs: [buildImage, createSecret]
+ needs: [buildImage]
steps:
- # Checks out the repository this file is in
- - uses: actions/checkout@v3
-
- # Logs in with your Azure credentials
- - name: Azure login
- uses: azure/login@v1.4.3
- with:
- client-id: ${{ secrets.AZURE_CLIENT_ID }}
- tenant-id: ${{ secrets.AZURE_TENANT_ID }}
- subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
- # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
- - name: Get K8s context
- uses: azure/aks-set-context@v2.0
- with:
- resource-group: ${{ env.RESOURCE_GROUP }}
- cluster-name: ${{ env.CLUSTER_NAME }}
+ # Checks out the repository this file is in
+ - uses: actions/checkout@v3
- # Runs Helm to create manifest files
- - name: Bake deployment
- uses: azure/k8s-bake@v2.1
- with:
- renderEngine: 'helm'
- helmChart: ${{ env.CHART_PATH }}
- overrideFiles: ${{ env.CHART_OVERRIDE_PATH }}
- overrides: |
- replicas:2
- helm-version: 'latest'
- id: bake
+ # Logs in with your Azure credentials
+ - name: Azure login
+ uses: azure/login@v1.4.6
+ with:
+ client-id: ${{ secrets.AZURE_CLIENT_ID }}
+ tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+ subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- # Deploys application based on manifest files from previous step
- - name: Deploy application
- uses: Azure/k8s-deploy@v3.1
- with:
- action: deploy
- manifests: ${{ steps.bake.outputs.manifestsBundle }}
- images: |
- ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}
- imagepullsecrets: |
- ${{ env.IMAGE_PULL_SECRET_NAME }}
\ No newline at end of file
+ # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
+ - name: Get K8s context
+ uses: azure/aks-set-context@v3
+ with:
+ resource-group: ${{ env.RESOURCE_GROUP }}
+ cluster-name: ${{ env.CLUSTER_NAME }}
+
+ # Runs Helm to create manifest files
+ - name: Bake deployment
+ uses: azure/k8s-bake@v2
+ with:
+ renderEngine: "helm"
+ helmChart: ${{ env.CHART_PATH }}
+ overrideFiles: ${{ env.CHART_OVERRIDE_PATH }}
+ overrides: |
+ replicas:2
+ helm-version: "latest"
+ id: bake
+
+ # Deploys application based on manifest files from previous step
+ - name: Deploy application
+ uses: Azure/k8s-deploy@v4
+ with:
+ action: deploy
+ manifests: ${{ steps.bake.outputs.manifestsBundle }}
+ images: |
+ ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}
diff --git a/deployments/azure-kubernetes-service-kompose.yml b/deployments/azure-kubernetes-service-kompose.yml
index 60fe536..a0e6bdd 100644
--- a/deployments/azure-kubernetes-service-kompose.yml
+++ b/deployments/azure-kubernetes-service-kompose.yml
@@ -1,14 +1,16 @@
# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code
#
# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR)
+# The ACR should be attached to the AKS cluster
# For instructions see:
# - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal
# - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal
+# - https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli#configure-acr-integration-for-existing-aks-clusters
# - https://github.com/Azure/aks-create-action
#
# To configure this workflow:
#
-# 1. Set the following secrets in your repository (instructions for getting these
+# 1. Set the following secrets in your repository (instructions for getting these
# https://docs.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Clinux):
# - AZURE_CLIENT_ID
# - AZURE_TENANT_ID
@@ -33,8 +35,7 @@ name: Build and deploy an app to AKS with Kompose
on:
push:
- branches:
- - $default-branch
+ branches: [$default-branch]
workflow_dispatch:
env:
@@ -42,7 +43,6 @@ env:
CONTAINER_NAME: "your-container-name"
RESOURCE_GROUP: "your-resource-group"
CLUSTER_NAME: "your-cluster-name"
- IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name"
DOCKER_COMPOSE_FILE_PATH: "your-docker-compose-file-path"
jobs:
@@ -52,106 +52,62 @@ jobs:
id-token: write
runs-on: ubuntu-latest
steps:
- # Checks out the repository this file is in
- - uses: actions/checkout@v3
-
- # Logs in with your Azure credentials
- - name: Azure login
- uses: azure/login@v1.4.3
- with:
- client-id: ${{ secrets.AZURE_CLIENT_ID }}
- tenant-id: ${{ secrets.AZURE_TENANT_ID }}
- subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
- # Builds and pushes an image up to your Azure Container Registry
- - name: Build and push image to ACR
- run: |
- az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} .
-
- createSecret:
- permissions:
- contents: read
- id-token: write
- runs-on: ubuntu-latest
- steps:
- # Logs in with your Azure credentials
- - name: Azure login
- uses: azure/login@v1.4.3
- with:
- client-id: ${{ secrets.AZURE_CLIENT_ID }}
- tenant-id: ${{ secrets.AZURE_TENANT_ID }}
- subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
- # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
- - name: Get K8s context
- uses: azure/aks-set-context@v2.0
- with:
- resource-group: ${{ env.RESOURCE_GROUP }}
- cluster-name: ${{ env.CLUSTER_NAME }}
+ # Checks out the repository this file is in
+ - uses: actions/checkout@v3
- # Retrieves the credentials for pulling images from your Azure Container Registry
- - name: Get ACR credentials
- run: |
- az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true
- ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv)
- ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv)
- echo "::add-mask::${ACR_USERNAME}"
- echo "::set-output name=username::${ACR_USERNAME}"
- echo "::add-mask::${ACR_PASSWORD}"
- echo "::set-output name=password::${ACR_PASSWORD}"
- id: get-acr-creds
+ # Logs in with your Azure credentials
+ - name: Azure login
+ uses: azure/login@v1.4.6
+ with:
+ client-id: ${{ secrets.AZURE_CLIENT_ID }}
+ tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+ subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+ # Builds and pushes an image up to your Azure Container Registry
+ - name: Build and push image to ACR
+ run: |
+ az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} .
- # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step
- - name: Create K8s secret for pulling image from ACR
- uses: Azure/k8s-create-secret@v1.1
- with:
- container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io
- container-registry-username: ${{ steps.get-acr-creds.outputs.username }}
- container-registry-password: ${{ steps.get-acr-creds.outputs.password }}
- secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }}
-
deploy:
permissions:
actions: read
contents: read
id-token: write
runs-on: ubuntu-latest
- needs: [buildImage, createSecret]
+ needs: [buildImage]
steps:
- # Checks out the repository this file is in
- - uses: actions/checkout@v3
-
- # Logs in with your Azure credentials
- - name: Azure login
- uses: azure/login@v1.4.3
- with:
- client-id: ${{ secrets.AZURE_CLIENT_ID }}
- tenant-id: ${{ secrets.AZURE_TENANT_ID }}
- subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+ # Checks out the repository this file is in
+ - uses: actions/checkout@v3
- # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
- - name: Get K8s context
- uses: azure/aks-set-context@v2.0
- with:
- resource-group: ${{ env.RESOURCE_GROUP }}
- cluster-name: ${{ env.CLUSTER_NAME }}
+ # Logs in with your Azure credentials
+ - name: Azure login
+ uses: azure/login@v1.4.6
+ with:
+ client-id: ${{ secrets.AZURE_CLIENT_ID }}
+ tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+ subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- # Runs Kompose to create manifest files
- - name: Bake deployment
- uses: azure/k8s-bake@v2.1
- with:
- renderEngine: 'kompose'
- dockerComposeFile: ${{ env.DOCKER_COMPOSE_FILE_PATH }}
- kompose-version: 'latest'
- id: bake
+ # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
+ - name: Get K8s context
+ uses: azure/aks-set-context@v3
+ with:
+ resource-group: ${{ env.RESOURCE_GROUP }}
+ cluster-name: ${{ env.CLUSTER_NAME }}
- # Deploys application based on manifest files from previous step
- - name: Deploy application
- uses: Azure/k8s-deploy@v3.1
- with:
- action: deploy
- manifests: ${{ steps.bake.outputs.manifestsBundle }}
- images: |
- ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}
- imagepullsecrets: |
- ${{ env.IMAGE_PULL_SECRET_NAME }}
+ # Runs Kompose to create manifest files
+ - name: Bake deployment
+ uses: azure/k8s-bake@v2
+ with:
+ renderEngine: "kompose"
+ dockerComposeFile: ${{ env.DOCKER_COMPOSE_FILE_PATH }}
+ kompose-version: "latest"
+ id: bake
+
+ # Deploys application based on manifest files from previous step
+ - name: Deploy application
+ uses: Azure/k8s-deploy@v4
+ with:
+ action: deploy
+ manifests: ${{ steps.bake.outputs.manifestsBundle }}
+ images: |
+ ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}
diff --git a/deployments/azure-kubernetes-service-kustomize.yml b/deployments/azure-kubernetes-service-kustomize.yml
index d46cadb..6c87057 100644
--- a/deployments/azure-kubernetes-service-kustomize.yml
+++ b/deployments/azure-kubernetes-service-kustomize.yml
@@ -1,14 +1,16 @@
# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code
#
# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR)
+# The ACR should be attached to the AKS cluster
# For instructions see:
# - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal
# - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal
+# - https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli#configure-acr-integration-for-existing-aks-clusters
# - https://github.com/Azure/aks-create-action
#
# To configure this workflow:
#
-# 1. Set the following secrets in your repository (instructions for getting these
+# 1. Set the following secrets in your repository (instructions for getting these
# https://docs.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Clinux):
# - AZURE_CLIENT_ID
# - AZURE_TENANT_ID
@@ -33,8 +35,7 @@ name: Build and deploy an app to AKS with Kustomize
on:
push:
- branches:
- - $default-branch
+ branches: [$default-branch]
workflow_dispatch:
env:
@@ -42,7 +43,6 @@ env:
CONTAINER_NAME: "your-container-name"
RESOURCE_GROUP: "your-resource-group"
CLUSTER_NAME: "your-cluster-name"
- IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name"
KUSTOMIZE_PATH: "your-kustomize-path"
jobs:
@@ -52,106 +52,62 @@ jobs:
id-token: write
runs-on: ubuntu-latest
steps:
- # Checks out the repository this file is in
- - uses: actions/checkout@v3
+ # Checks out the repository this file is in
+ - uses: actions/checkout@v3
- # Logs in with your Azure credentials
- - name: Azure login
- uses: azure/login@v1.4.3
- with:
- client-id: ${{ secrets.AZURE_CLIENT_ID }}
- tenant-id: ${{ secrets.AZURE_TENANT_ID }}
- subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
- # Builds and pushes an image up to your Azure Container Registry
- - name: Build and push image to ACR
- run: |
- az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} .
-
- createSecret:
- permissions:
- contents: read
- id-token: write
- runs-on: ubuntu-latest
- steps:
- # Logs in with your Azure credentials
- - name: Azure login
- uses: azure/login@v1.4.3
- with:
- client-id: ${{ secrets.AZURE_CLIENT_ID }}
- tenant-id: ${{ secrets.AZURE_TENANT_ID }}
- subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+ # Logs in with your Azure credentials
+ - name: Azure login
+ uses: azure/login@v1.4.6
+ with:
+ client-id: ${{ secrets.AZURE_CLIENT_ID }}
+ tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+ subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
- - name: Get K8s context
- uses: azure/aks-set-context@v2.0
- with:
- resource-group: ${{ env.RESOURCE_GROUP }}
- cluster-name: ${{ env.CLUSTER_NAME }}
+ # Builds and pushes an image up to your Azure Container Registry
+ - name: Build and push image to ACR
+ run: |
+ az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} .
- # Retrieves the credentials for pulling images from your Azure Container Registry
- - name: Get ACR credentials
- run: |
- az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true
- ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv)
- ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv)
- echo "::add-mask::${ACR_USERNAME}"
- echo "::set-output name=username::${ACR_USERNAME}"
- echo "::add-mask::${ACR_PASSWORD}"
- echo "::set-output name=password::${ACR_PASSWORD}"
- id: get-acr-creds
-
- # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step
- - name: Create K8s secret for pulling image from ACR
- uses: Azure/k8s-create-secret@v1.1
- with:
- container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io
- container-registry-username: ${{ steps.get-acr-creds.outputs.username }}
- container-registry-password: ${{ steps.get-acr-creds.outputs.password }}
- secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }}
-
deploy:
permissions:
actions: read
contents: read
id-token: write
runs-on: ubuntu-latest
- needs: [buildImage, createSecret]
+ needs: [buildImage]
steps:
- # Checks out the repository this file is in
- - uses: actions/checkout@v3
+ # Checks out the repository this file is in
+ - uses: actions/checkout@v3
- # Logs in with your Azure credentials
- - name: Azure login
- uses: azure/login@v1.4.3
- with:
- client-id: ${{ secrets.AZURE_CLIENT_ID }}
- tenant-id: ${{ secrets.AZURE_TENANT_ID }}
- subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+ # Logs in with your Azure credentials
+ - name: Azure login
+ uses: azure/login@v1.4.6
+ with:
+ client-id: ${{ secrets.AZURE_CLIENT_ID }}
+ tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+ subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
- - name: Get K8s context
- uses: azure/aks-set-context@v2.0
- with:
- resource-group: ${{ env.RESOURCE_GROUP }}
- cluster-name: ${{ env.CLUSTER_NAME }}
+ # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
+ - name: Get K8s context
+ uses: azure/aks-set-context@v3
+ with:
+ resource-group: ${{ env.RESOURCE_GROUP }}
+ cluster-name: ${{ env.CLUSTER_NAME }}
- # Runs Kustomize to create manifest files
- - name: Bake deployment
- uses: azure/k8s-bake@v2.1
- with:
- renderEngine: 'kustomize'
- kustomizationPath: ${{ env.KUSTOMIZE_PATH }}
- kubectl-version: latest
- id: bake
+ # Runs Kustomize to create manifest files
+ - name: Bake deployment
+ uses: azure/k8s-bake@v2
+ with:
+ renderEngine: "kustomize"
+ kustomizationPath: ${{ env.KUSTOMIZE_PATH }}
+ kubectl-version: latest
+ id: bake
- # Deploys application based on manifest files from previous step
- - name: Deploy application
- uses: Azure/k8s-deploy@v3.1
- with:
- action: deploy
- manifests: ${{ steps.bake.outputs.manifestsBundle }}
- images: |
- ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}
- imagepullsecrets: |
- ${{ env.IMAGE_PULL_SECRET_NAME }}
\ No newline at end of file
+ # Deploys application based on manifest files from previous step
+ - name: Deploy application
+ uses: Azure/k8s-deploy@v4
+ with:
+ action: deploy
+ manifests: ${{ steps.bake.outputs.manifestsBundle }}
+ images: |
+ ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}
diff --git a/deployments/azure-kubernetes-service.yml b/deployments/azure-kubernetes-service.yml
index d04a2ac..f0b2b38 100644
--- a/deployments/azure-kubernetes-service.yml
+++ b/deployments/azure-kubernetes-service.yml
@@ -1,9 +1,11 @@
# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code
#
# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR)
+# The ACR should be attached to the AKS cluster
# For instructions see:
# - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal
# - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal
+# - https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli#configure-acr-integration-for-existing-aks-clusters
# - https://github.com/Azure/aks-create-action
#
# To configure this workflow:
@@ -29,8 +31,7 @@ name: Build and deploy an app to AKS
on:
push:
- branches:
- - $default-branch
+ branches: [$default-branch]
workflow_dispatch:
env:
@@ -38,8 +39,7 @@ env:
CONTAINER_NAME: "your-container-name"
RESOURCE_GROUP: "your-resource-group"
CLUSTER_NAME: "your-cluster-name"
- IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name"
- DEPLOYMENT_MANIFEST_PATH: 'your-deployment-manifest-path'
+ DEPLOYMENT_MANIFEST_PATH: "your-deployment-manifest-path"
jobs:
buildImage:
@@ -48,63 +48,21 @@ jobs:
id-token: write
runs-on: ubuntu-latest
steps:
- # Checks out the repository this file is in
- - uses: actions/checkout@v3
-
- # Logs in with your Azure credentials
- - name: Azure login
- uses: azure/login@v1.4.3
- with:
- client-id: ${{ secrets.AZURE_CLIENT_ID }}
- tenant-id: ${{ secrets.AZURE_TENANT_ID }}
- subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
- # Builds and pushes an image up to your Azure Container Registry
- - name: Build and push image to ACR
- run: |
- az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} .
+ # Checks out the repository this file is in
+ - uses: actions/checkout@v3
- createSecret:
- permissions:
- contents: read
- id-token: write
- runs-on: ubuntu-latest
- steps:
- # Logs in with your Azure credentials
- - name: Azure login
- uses: azure/login@v1.4.3
- with:
- client-id: ${{ secrets.AZURE_CLIENT_ID }}
- tenant-id: ${{ secrets.AZURE_TENANT_ID }}
- subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
- # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
- - name: Get K8s context
- uses: azure/aks-set-context@v2.0
- with:
- resource-group: ${{ env.RESOURCE_GROUP }}
- cluster-name: ${{ env.CLUSTER_NAME }}
+ # Logs in with your Azure credentials
+ - name: Azure login
+ uses: azure/login@v1.4.6
+ with:
+ client-id: ${{ secrets.AZURE_CLIENT_ID }}
+ tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+ subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- # Retrieves the credentials for pulling images from your Azure Container Registry
- - name: Get ACR credentials
- run: |
- az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true
- ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv)
- ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv)
- echo "::add-mask::${ACR_USERNAME}"
- echo "::set-output name=username::${ACR_USERNAME}"
- echo "::add-mask::${ACR_PASSWORD}"
- echo "::set-output name=password::${ACR_PASSWORD}"
- id: get-acr-creds
-
- # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step
- - name: Create K8s secret for pulling image from ACR
- uses: Azure/k8s-create-secret@v1.1
- with:
- container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io
- container-registry-username: ${{ steps.get-acr-creds.outputs.username }}
- container-registry-password: ${{ steps.get-acr-creds.outputs.password }}
- secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }}
+ # Builds and pushes an image up to your Azure Container Registry
+ - name: Build and push image to ACR
+ run: |
+ az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} .
deploy:
permissions:
@@ -112,33 +70,31 @@ jobs:
contents: read
id-token: write
runs-on: ubuntu-latest
- needs: [buildImage, createSecret]
+ needs: [buildImage]
steps:
- # Checks out the repository this file is in
- - uses: actions/checkout@v3
-
- # Logs in with your Azure credentials
- - name: Azure login
- uses: azure/login@v1.4.3
- with:
- client-id: ${{ secrets.AZURE_CLIENT_ID }}
- tenant-id: ${{ secrets.AZURE_TENANT_ID }}
- subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
- # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
- - name: Get K8s context
- uses: azure/aks-set-context@v2.0
- with:
- resource-group: ${{ env.RESOURCE_GROUP }}
- cluster-name: ${{ env.CLUSTER_NAME }}
+ # Checks out the repository this file is in
+ - uses: actions/checkout@v3
- # Deploys application based on given manifest file
- - name: Deploys application
- uses: Azure/k8s-deploy@v3.1
- with:
- action: deploy
- manifests: ${{ env.DEPLOYMENT_MANIFEST_PATH }}
- images: |
- ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}
- imagepullsecrets: |
- ${{ env.IMAGE_PULL_SECRET_NAME }}
\ No newline at end of file
+ # Logs in with your Azure credentials
+ - name: Azure login
+ uses: azure/login@v1.4.6
+ with:
+ client-id: ${{ secrets.AZURE_CLIENT_ID }}
+ tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+ subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+ # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
+ - name: Get K8s context
+ uses: azure/aks-set-context@v3
+ with:
+ resource-group: ${{ env.RESOURCE_GROUP }}
+ cluster-name: ${{ env.CLUSTER_NAME }}
+
+ # Deploys application based on given manifest file
+ - name: Deploys application
+ uses: Azure/k8s-deploy@v4
+ with:
+ action: deploy
+ manifests: ${{ env.DEPLOYMENT_MANIFEST_PATH }}
+ images: |
+ ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}
diff --git a/deployments/azure-staticwebapp.yml b/deployments/azure-staticwebapp.yml
index a40ecc2..8fe07ce 100644
--- a/deployments/azure-staticwebapp.yml
+++ b/deployments/azure-staticwebapp.yml
@@ -14,12 +14,10 @@ name: Deploy web app to Azure Static Web Apps
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
pull_request:
types: [opened, synchronize, reopened, closed]
- branches:
- - $default-branch
+ branches: [ $default-branch ]
# Environment variables available to all jobs and steps in this workflow
env:
diff --git a/deployments/azure-webapps-dotnet-core.yml b/deployments/azure-webapps-dotnet-core.yml
index 0b59686..9b21895 100644
--- a/deployments/azure-webapps-dotnet-core.yml
+++ b/deployments/azure-webapps-dotnet-core.yml
@@ -26,8 +26,7 @@ env:
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
workflow_dispatch:
permissions:
diff --git a/deployments/azure-webapps-java-jar.yml b/deployments/azure-webapps-java-jar.yml
index 6e3df8d..60fa68c 100644
--- a/deployments/azure-webapps-java-jar.yml
+++ b/deployments/azure-webapps-java-jar.yml
@@ -26,8 +26,7 @@ env:
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
workflow_dispatch:
permissions:
diff --git a/deployments/azure-webapps-node.yml b/deployments/azure-webapps-node.yml
index 1480c92..98e72c2 100644
--- a/deployments/azure-webapps-node.yml
+++ b/deployments/azure-webapps-node.yml
@@ -19,8 +19,7 @@
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
workflow_dispatch:
env:
diff --git a/deployments/azure-webapps-php.yml b/deployments/azure-webapps-php.yml
index 98e8dc7..4d08dbd 100644
--- a/deployments/azure-webapps-php.yml
+++ b/deployments/azure-webapps-php.yml
@@ -21,8 +21,7 @@ name: Build and deploy PHP app to Azure Web App
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
workflow_dispatch:
env:
diff --git a/deployments/azure-webapps-python.yml b/deployments/azure-webapps-python.yml
index 50f4823..d7aa802 100644
--- a/deployments/azure-webapps-python.yml
+++ b/deployments/azure-webapps-python.yml
@@ -25,8 +25,7 @@ env:
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
workflow_dispatch:
permissions:
diff --git a/deployments/google-cloudrun-docker.yml b/deployments/google-cloudrun-docker.yml
index b8d0511..bd748f8 100644
--- a/deployments/google-cloudrun-docker.yml
+++ b/deployments/google-cloudrun-docker.yml
@@ -46,8 +46,7 @@ name: Build and Deploy to Cloud Run
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
env:
PROJECT_ID: YOUR_PROJECT_ID # TODO: update Google Cloud project id
diff --git a/deployments/google-cloudrun-source.yml b/deployments/google-cloudrun-source.yml
index 2916b45..e6fcb52 100644
--- a/deployments/google-cloudrun-source.yml
+++ b/deployments/google-cloudrun-source.yml
@@ -48,8 +48,7 @@ name: Deploy to Cloud Run from Source
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
env:
PROJECT_ID: YOUR_PROJECT_ID # TODO: update Google Cloud project id
diff --git a/deployments/google.yml b/deployments/google.yml
index 6150672..846452a 100644
--- a/deployments/google.yml
+++ b/deployments/google.yml
@@ -14,8 +14,7 @@ name: Build and Deploy to GKE
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
env:
PROJECT_ID: ${{ secrets.GKE_PROJECT }}
diff --git a/deployments/ibm.yml b/deployments/ibm.yml
index cb3080f..53a58c5 100644
--- a/deployments/ibm.yml
+++ b/deployments/ibm.yml
@@ -10,8 +10,7 @@ name: Build and Deploy to IKS
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
# Environment variables available to all jobs and steps in this workflow
env:
diff --git a/deployments/tencent.yml b/deployments/tencent.yml
index 4e9e9f6..ba65fe5 100644
--- a/deployments/tencent.yml
+++ b/deployments/tencent.yml
@@ -17,8 +17,7 @@ name: Tencent Kubernetes Engine
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
# Environment variables available to all jobs and steps in this workflow
env:
diff --git a/deployments/terraform.yml b/deployments/terraform.yml
index 53efe48..c06f685 100644
--- a/deployments/terraform.yml
+++ b/deployments/terraform.yml
@@ -46,8 +46,7 @@ name: 'Terraform'
on:
push:
- branches:
- - $default-branch
+ branches: [ $default-branch ]
pull_request:
permissions:
diff --git a/icons/astro.svg b/icons/astro.svg
new file mode 100644
index 0000000..ff9dd54
--- /dev/null
+++ b/icons/astro.svg
@@ -0,0 +1,20 @@
+
diff --git a/icons/generator-generic-ossf-slsa3-publish.svg b/icons/generator-generic-ossf-slsa3-publish.svg
new file mode 100644
index 0000000..ea77468
--- /dev/null
+++ b/icons/generator-generic-ossf-slsa3-publish.svg
@@ -0,0 +1,11 @@
+
+
diff --git a/icons/lintr.svg b/icons/lintr.svg
new file mode 100644
index 0000000..cdc40d8
--- /dev/null
+++ b/icons/lintr.svg
@@ -0,0 +1,679 @@
+
+
+
+
diff --git a/icons/zscaler.svg b/icons/zscaler.svg
new file mode 100644
index 0000000..3897442
--- /dev/null
+++ b/icons/zscaler.svg
@@ -0,0 +1,3 @@
+
diff --git a/icons/zscan.svg b/icons/zscan.svg
new file mode 100644
index 0000000..1dff416
--- /dev/null
+++ b/icons/zscan.svg
@@ -0,0 +1,11 @@
+
+
+
diff --git a/pages/astro.yml b/pages/astro.yml
new file mode 100644
index 0000000..1d4ec5f
--- /dev/null
+++ b/pages/astro.yml
@@ -0,0 +1,76 @@
+# Sample workflow for building and deploying an Astro site to GitHub Pages
+#
+# To get started with Astro see: https://docs.astro.build/en/getting-started/
+#
+name: Deploy Astro site to Pages
+
+on:
+ # Runs on pushes targeting the default branch
+ push:
+ branches: [$default-branch]
+
+ # Allows you to run this workflow manually from the Actions tab
+ workflow_dispatch:
+
+# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
+permissions:
+ contents: read
+ pages: write
+ id-token: write
+
+# Allow one concurrent deployment
+concurrency:
+ group: "pages"
+ cancel-in-progress: true
+
+env:
+ BUILD_PATH: "." # default value when not using subfolders
+ # BUILD_PATH: subfolder
+
+jobs:
+ build:
+ name: Build
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v3
+ - name: Detect package manager
+ id: detect-package-manager
+ run: |
+ if [ -f "${{ github.workspace }}/yarn.lock" ]; then
+ echo "::set-output name=manager::yarn"
+ echo "::set-output name=command::install"
+ echo "::set-output name=runner::yarn"
+ exit 0
+ elif [ -f "${{ github.workspace }}/package.json" ]; then
+ echo "::set-output name=manager::npm"
+ echo "::set-output name=command::ci"
+ echo "::set-output name=runner::npx --no-install"
+ exit 0
+ else
+ echo "Unable to determine packager manager"
+ exit 1
+ fi
+ - name: Setup Node
+ uses: actions/setup-node@v3
+ with:
+ node-version: "16"
+ cache: ${{ steps.detect-package-manager.outputs.manager }}
+ cache-dependency-path: ${{ env.BUILD_PATH }}/package-lock.json
+ - run: npm install && npm run build
+ working-directory: ${{ env.BUILD_PATH }}
+ - uses: actions/upload-pages-artifact@v1
+ with:
+ path: ${{ env.BUILD_PATH }}/dist
+
+ deploy:
+ environment:
+ name: github-pages
+ url: ${{ steps.deployment.outputs.page_url }}
+ needs: build
+ runs-on: ubuntu-latest
+ name: Deploy
+ steps:
+ - name: Deploy to GitHub Pages
+ id: deployment
+ uses: actions/deploy-pages@v1
diff --git a/pages/hugo.yml b/pages/hugo.yml
index fb8c924..f273fb2 100644
--- a/pages/hugo.yml
+++ b/pages/hugo.yml
@@ -30,7 +30,7 @@ jobs:
build:
runs-on: ubuntu-latest
env:
- HUGO_VERSION: 0.99.0
+ HUGO_VERSION: 0.102.3
steps:
- name: Install Hugo CLI
run: |
diff --git a/pages/jekyll.yml b/pages/jekyll.yml
index 37ee818..d039d12 100644
--- a/pages/jekyll.yml
+++ b/pages/jekyll.yml
@@ -33,7 +33,7 @@ jobs:
- name: Checkout
uses: actions/checkout@v3
- name: Setup Ruby
- uses: ruby/setup-ruby@0a29871fe2b0200a17a4497bae54fe5df0d973aa
+ uses: ruby/setup-ruby@0a29871fe2b0200a17a4497bae54fe5df0d973aa # v1.115.3
with:
ruby-version: '3.0' # Not needed with a .ruby-version file
bundler-cache: true # runs 'bundle install' and caches installed gems automatically
diff --git a/pages/properties/astro.properties.json b/pages/properties/astro.properties.json
new file mode 100644
index 0000000..bc7db05
--- /dev/null
+++ b/pages/properties/astro.properties.json
@@ -0,0 +1,6 @@
+{
+ "name": "Astro",
+ "description": "Deploy an Astro site.",
+ "iconName": "astro",
+ "categories": ["Pages", "Astro"]
+}
diff --git a/script/sync-ghes/index.ts b/script/sync-ghes/index.ts
index 608e73d..a320d36 100755
--- a/script/sync-ghes/index.ts
+++ b/script/sync-ghes/index.ts
@@ -61,7 +61,7 @@ async function checkWorkflows(
const enabled =
!isPartnerWorkflow &&
- workflowProperties.enterprise !== false &&
+ (workflowProperties.enterprise === true || folder !== 'code-scanning') &&
(await checkWorkflow(workflowFilePath, enabledActions));
const workflowDesc: WorkflowDesc = {
diff --git a/script/sync-ghes/settings.json b/script/sync-ghes/settings.json
index 9648ab4..41d6bcd 100644
--- a/script/sync-ghes/settings.json
+++ b/script/sync-ghes/settings.json
@@ -2,20 +2,27 @@
"folders": [
"../../ci",
"../../automation",
- "../../code-scanning"
+ "../../code-scanning",
+ "../../pages"
],
"enabledActions": [
+ "actions/cache",
"actions/checkout",
+ "actions/configure-pages",
"actions/create-release",
"actions/delete-package-versions",
+ "actions/deploy-pages",
"actions/download-artifact",
+ "actions/jekyll-build-pages",
"actions/setup-dotnet",
"actions/setup-go",
"actions/setup-java",
"actions/setup-node",
+ "actions/setup-python",
"actions/stale",
"actions/starter-workflows",
"actions/upload-artifact",
+ "actions/upload-pages-artifact",
"actions/upload-release-asset",
"github/codeql-action"
],
diff --git a/script/validate-data/package-lock.json b/script/validate-data/package-lock.json
index e660b6a..358c661 100644
--- a/script/validate-data/package-lock.json
+++ b/script/validate-data/package-lock.json
@@ -9,7 +9,7 @@
"version": "1.0.0",
"license": "MIT",
"dependencies": {
- "@actions/core": "^1.2.6",
+ "@actions/core": "^1.9.1",
"js-yaml": "^3.13.1",
"jsonschema": "^1.2.6"
},
@@ -21,9 +21,21 @@
}
},
"node_modules/@actions/core": {
- "version": "1.2.6",
- "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.6.tgz",
- "integrity": "sha512-ZQYitnqiyBc3D+k7LsgSBmMDVkOVidaagDG7j3fOym77jNunWRuYx7VSHa9GNfFZh+zh61xsCjRj4JxMZlDqTA=="
+ "version": "1.9.1",
+ "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.9.1.tgz",
+ "integrity": "sha512-5ad+U2YGrmmiw6du20AQW5XuWo7UKN2052FjSV7MX+Wfjf8sCqcsZe62NfgHys4QI4/Y+vQvLKYL8jWtA1ZBTA==",
+ "dependencies": {
+ "@actions/http-client": "^2.0.1",
+ "uuid": "^8.3.2"
+ }
+ },
+ "node_modules/@actions/http-client": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.0.1.tgz",
+ "integrity": "sha512-PIXiMVtz6VvyaRsGY268qvj57hXQEpsYogYOu2nrQhlf+XCGmZstmuZBbAybUl1nQGnvS1k1eEsQ69ZoD7xlSw==",
+ "dependencies": {
+ "tunnel": "^0.0.6"
+ }
},
"node_modules/@types/js-yaml": {
"version": "3.12.4",
@@ -153,6 +165,14 @@
"typescript": ">=2.7"
}
},
+ "node_modules/tunnel": {
+ "version": "0.0.6",
+ "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
+ "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==",
+ "engines": {
+ "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
+ }
+ },
"node_modules/typescript": {
"version": "3.9.2",
"resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.2.tgz",
@@ -166,6 +186,14 @@
"node": ">=4.2.0"
}
},
+ "node_modules/uuid": {
+ "version": "8.3.2",
+ "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+ "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+ "bin": {
+ "uuid": "dist/bin/uuid"
+ }
+ },
"node_modules/yn": {
"version": "3.1.1",
"resolved": "https://registry.npmjs.org/yn/-/yn-3.1.1.tgz",
@@ -178,9 +206,21 @@
},
"dependencies": {
"@actions/core": {
- "version": "1.2.6",
- "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.6.tgz",
- "integrity": "sha512-ZQYitnqiyBc3D+k7LsgSBmMDVkOVidaagDG7j3fOym77jNunWRuYx7VSHa9GNfFZh+zh61xsCjRj4JxMZlDqTA=="
+ "version": "1.9.1",
+ "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.9.1.tgz",
+ "integrity": "sha512-5ad+U2YGrmmiw6du20AQW5XuWo7UKN2052FjSV7MX+Wfjf8sCqcsZe62NfgHys4QI4/Y+vQvLKYL8jWtA1ZBTA==",
+ "requires": {
+ "@actions/http-client": "^2.0.1",
+ "uuid": "^8.3.2"
+ }
+ },
+ "@actions/http-client": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.0.1.tgz",
+ "integrity": "sha512-PIXiMVtz6VvyaRsGY268qvj57hXQEpsYogYOu2nrQhlf+XCGmZstmuZBbAybUl1nQGnvS1k1eEsQ69ZoD7xlSw==",
+ "requires": {
+ "tunnel": "^0.0.6"
+ }
},
"@types/js-yaml": {
"version": "3.12.4",
@@ -279,12 +319,22 @@
"yn": "3.1.1"
}
},
+ "tunnel": {
+ "version": "0.0.6",
+ "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
+ "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="
+ },
"typescript": {
"version": "3.9.2",
"resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.2.tgz",
"integrity": "sha512-q2ktq4n/uLuNNShyayit+DTobV2ApPEo/6so68JaD5ojvc/6GClBipedB9zNWYxRSAlZXAe405Rlijzl6qDiSw==",
"dev": true
},
+ "uuid": {
+ "version": "8.3.2",
+ "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+ "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="
+ },
"yn": {
"version": "3.1.1",
"resolved": "https://registry.npmjs.org/yn/-/yn-3.1.1.tgz",
diff --git a/script/validate-data/package.json b/script/validate-data/package.json
index e6403ee..6811f19 100644
--- a/script/validate-data/package.json
+++ b/script/validate-data/package.json
@@ -14,7 +14,7 @@
"typescript": "^3.9.2"
},
"dependencies": {
- "@actions/core": "^1.2.6",
+ "@actions/core": "^1.9.1",
"js-yaml": "^3.13.1",
"jsonschema": "^1.2.6"
}
diff --git a/script/validate-data/settings.json b/script/validate-data/settings.json
index 852f575..23c4790 100644
--- a/script/validate-data/settings.json
+++ b/script/validate-data/settings.json
@@ -3,7 +3,8 @@
"../../ci",
"../../automation",
"../../deployments",
- "../../code-scanning"
+ "../../code-scanning",
+ "../../pages"
],
"allowed_categories": [
{
@@ -21,6 +22,10 @@
{
"path": "../../code-scanning",
"categories": ["Code Scanning", "Dependency review"]
+ },
+ {
+ "path": "../../pages",
+ "categories": ["Pages"]
}
]
}