From c6df345b91283444e57fdb8042b1af835dcd4157 Mon Sep 17 00:00:00 2001 From: Steve Kluck <3161125+skluck@users.noreply.github.com> Date: Fri, 17 Oct 2025 13:23:11 -0400 Subject: [PATCH 1/7] Add digger workflow --- .github/workflows/digger.yml | 38 ++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .github/workflows/digger.yml diff --git a/.github/workflows/digger.yml b/.github/workflows/digger.yml new file mode 100644 index 0000000..f4dd85d --- /dev/null +++ b/.github/workflows/digger.yml @@ -0,0 +1,38 @@ +name: Digger Workflow + +on: + pull_request: + types: [ closed, opened, synchronize, reopened ] + + # Only used with a backend github app + workflow_dispatch: + inputs: + spec: + required: true + run_name: + required: false + +jobs: + digger-job: + runs-on: ubuntu-latest + permissions: + contents: write # required to merge PRs + actions: write # required for plan persistence + id-token: write # required for workload-identity-federation + pull-requests: write # required to post PR comments + issues: read # required to check if PR number is an issue or not + statuses: write # required to validate combined PR status + + steps: + - uses: actions/checkout@v4 + + - uses: diggerhq/digger@bd1a54120e1fe0e410e84b6d9a5e9bbcce7f3897 + with: + digger-spec: ${{ inputs.spec }} + digger-version: v0.6.128 + setup-terraform: true + no-backend: true + terraform-version: 1.13.3 + env: + GITHUB_CONTEXT: ${{ toJson(github) }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file From 45a580196d64f02aa1e373b1938831481dcc7e61 Mon Sep 17 00:00:00 2001 From: Steve Kluck <3161125+skluck@users.noreply.github.com> Date: Fri, 17 Oct 2025 13:31:29 -0400 Subject: [PATCH 2/7] Add allow-list --- README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index c8288de..e003049 100644 --- a/README.md +++ b/README.md @@ -1 +1,5 @@ -# test-allowed-gha \ No newline at end of file +# test-allowed-gha + +``` +diggerhq/digger@bd1a54120e1fe0e410e84b6d9a5e9bbcce7f3897,actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830, actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830, actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955, actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b, actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5, autero1/action-terragrunt@aefb0a43c4f5503a91fefb307745c4d51c26ed0e, hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd, opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716, pulumi/actions@a3f382e1242b69ab33854c253c3b580f1226348e, rhythmictech/actions-setup-tfenv@ef1296cdbec243306d3a3d31909582ca1eeb4627 +``` From 8dd585889eee5db52cfef7aa1159dd8cc9fc6719 Mon Sep 17 00:00:00 2001 From: Steve Kluck <3161125+skluck@users.noreply.github.com> Date: Fri, 17 Oct 2025 13:36:05 -0400 Subject: [PATCH 3/7] Test commit --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index e003049..0af45f1 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# test-allowed-gha +# Allowed GHA Testing ``` diggerhq/digger@bd1a54120e1fe0e410e84b6d9a5e9bbcce7f3897,actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830, actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830, actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955, actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b, actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5, autero1/action-terragrunt@aefb0a43c4f5503a91fefb307745c4d51c26ed0e, hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd, opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716, pulumi/actions@a3f382e1242b69ab33854c253c3b580f1226348e, rhythmictech/actions-setup-tfenv@ef1296cdbec243306d3a3d31909582ca1eeb4627 From d3a3b9644842f05cb145038cfed25157fa1793f3 Mon Sep 17 00:00:00 2001 From: Steve Kluck <3161125+skluck@users.noreply.github.com> Date: Fri, 17 Oct 2025 14:11:03 -0400 Subject: [PATCH 4/7] update list --- README.md | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 0af45f1..24f7705 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,21 @@ # Allowed GHA Testing + +``` +diggerhq/digger@bd1a54120e1fe0e410e84b6d9a5e9bbcce7f3897, +autero1/action-terragrunt@aefb0a43c4f5503a91fefb307745c4d51c26ed0e, +opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716, +rhythmictech/actions-setup-tfenv@ef1296cdbec243306d3a3d31909582ca1eeb4627, ``` -diggerhq/digger@bd1a54120e1fe0e410e84b6d9a5e9bbcce7f3897,actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830, actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830, actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955, actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b, actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5, autero1/action-terragrunt@aefb0a43c4f5503a91fefb307745c4d51c26ed0e, hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd, opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716, pulumi/actions@a3f382e1242b69ab33854c253c3b580f1226348e, rhythmictech/actions-setup-tfenv@ef1296cdbec243306d3a3d31909582ca1eeb4627 + +The following are allowed by enabling verified creators and official actions + ``` +hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd +pulumi/actions@a3f382e1242b69ab33854c253c3b580f1226348e +actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830, +actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830, +actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955, +actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b, +actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5, +``` \ No newline at end of file From aacc3def47d6df3f7e38892159055ef968253aa0 Mon Sep 17 00:00:00 2001 From: Steve Kluck <3161125+skluck@users.noreply.github.com> Date: Fri, 17 Oct 2025 14:35:36 -0400 Subject: [PATCH 5/7] Add test list --- README.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 24f7705..5f86cde 100644 --- a/README.md +++ b/README.md @@ -18,4 +18,12 @@ actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830, actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955, actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b, actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5, -``` \ No newline at end of file +``` + +## + +Test + +``` +docker/build-push-action@v3, docker/build-push-action@v5, docker/login-action@v2, docker/login-action@v3, docker/metadata-action@v3, docker/metadata-action@v5, docker/setup-buildx-action@v2, docker/setup-buildx-action@v3, dtolnay/rust-toolchain@stable, hashicorp/setup-terraform@v2, int128/docker-build-cache-config-action@v1, jdx/mise-action@v2, jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566, jwalton/gh-docker-logs@v2, ludeeus/action-shellcheck@master, meteorengineer/setup-meteor@v1, naveenk1223/action-pr-title@master, peter-evans/create-or-update-comment@v4, pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd, psf/black@23.9.1, psf/black@24.1.1, psf/black@stable, reproducible-containers/buildkit-cache-dance@v3, softprops/action-gh-release@v1, svenstaro/upload-release-action@v2, terraform-linters/setup-tflint@v4, terraform-linters/setup-tflint@ae78205cfffec9e8d93fd2b3115c7e9d3166d4b6, theappnest/terraform-monorepo-action@master, tibdex/github-app-token@v2, tj-actions/changed-files@b1ba699b304f2083b602164e06a89b868c84f076, toshimaru/auto-author-assign@v1.6.0, vemonet/setup-spark@v1, autero1/action-terragrunt@aefb0a43c4f5503a91fefb307745c4d51c26ed0e, opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716, rhythmictech/actions-setup-tfenv@ef1296cdbec243306d3a3d31909582ca1eeb4627 +``` From ac4ac57007e9fcb20d82f015972145b7dbd455bb Mon Sep 17 00:00:00 2001 From: Steve Kluck <3161125+skluck@users.noreply.github.com> Date: Fri, 17 Oct 2025 14:37:29 -0400 Subject: [PATCH 6/7] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5f86cde..943c177 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5, ## -Test +Test allowed list ``` docker/build-push-action@v3, docker/build-push-action@v5, docker/login-action@v2, docker/login-action@v3, docker/metadata-action@v3, docker/metadata-action@v5, docker/setup-buildx-action@v2, docker/setup-buildx-action@v3, dtolnay/rust-toolchain@stable, hashicorp/setup-terraform@v2, int128/docker-build-cache-config-action@v1, jdx/mise-action@v2, jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566, jwalton/gh-docker-logs@v2, ludeeus/action-shellcheck@master, meteorengineer/setup-meteor@v1, naveenk1223/action-pr-title@master, peter-evans/create-or-update-comment@v4, pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd, psf/black@23.9.1, psf/black@24.1.1, psf/black@stable, reproducible-containers/buildkit-cache-dance@v3, softprops/action-gh-release@v1, svenstaro/upload-release-action@v2, terraform-linters/setup-tflint@v4, terraform-linters/setup-tflint@ae78205cfffec9e8d93fd2b3115c7e9d3166d4b6, theappnest/terraform-monorepo-action@master, tibdex/github-app-token@v2, tj-actions/changed-files@b1ba699b304f2083b602164e06a89b868c84f076, toshimaru/auto-author-assign@v1.6.0, vemonet/setup-spark@v1, autero1/action-terragrunt@aefb0a43c4f5503a91fefb307745c4d51c26ed0e, opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716, rhythmictech/actions-setup-tfenv@ef1296cdbec243306d3a3d31909582ca1eeb4627 From bfbeec8ca6030864e39b6ded4adf757080f41185 Mon Sep 17 00:00:00 2001 From: Steve Kluck <3161125+skluck@users.noreply.github.com> Date: Fri, 17 Oct 2025 14:38:32 -0400 Subject: [PATCH 7/7] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 943c177..9239c45 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5, ## -Test allowed list +Test allowed list: ``` docker/build-push-action@v3, docker/build-push-action@v5, docker/login-action@v2, docker/login-action@v3, docker/metadata-action@v3, docker/metadata-action@v5, docker/setup-buildx-action@v2, docker/setup-buildx-action@v3, dtolnay/rust-toolchain@stable, hashicorp/setup-terraform@v2, int128/docker-build-cache-config-action@v1, jdx/mise-action@v2, jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566, jwalton/gh-docker-logs@v2, ludeeus/action-shellcheck@master, meteorengineer/setup-meteor@v1, naveenk1223/action-pr-title@master, peter-evans/create-or-update-comment@v4, pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd, psf/black@23.9.1, psf/black@24.1.1, psf/black@stable, reproducible-containers/buildkit-cache-dance@v3, softprops/action-gh-release@v1, svenstaro/upload-release-action@v2, terraform-linters/setup-tflint@v4, terraform-linters/setup-tflint@ae78205cfffec9e8d93fd2b3115c7e9d3166d4b6, theappnest/terraform-monorepo-action@master, tibdex/github-app-token@v2, tj-actions/changed-files@b1ba699b304f2083b602164e06a89b868c84f076, toshimaru/auto-author-assign@v1.6.0, vemonet/setup-spark@v1, autero1/action-terragrunt@aefb0a43c4f5503a91fefb307745c4d51c26ed0e, opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716, rhythmictech/actions-setup-tfenv@ef1296cdbec243306d3a3d31909582ca1eeb4627