diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index aba33af..27adeef 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,23 +31,23 @@ jobs: build-mode: autobuild steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis id: analyze - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@v4 with: category: "/language:${{ matrix.language }}" output: "../results-${{ matrix.language }}" - name: Upload CodeQL results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: CodeQL-${{ matrix.language }}.sarif path: ${{ steps.analyze.outputs.sarif-output }} diff --git a/.github/workflows/helm-publish.yaml b/.github/workflows/helm-publish.yaml index 2b48a0a..c0e93d4 100644 --- a/.github/workflows/helm-publish.yaml +++ b/.github/workflows/helm-publish.yaml @@ -19,13 +19,13 @@ jobs: steps: - name: Git checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-tags: true - - uses: azure/setup-helm@v4.3.0 + - uses: azure/setup-helm@v5.0.1 - name: Log in to the Container registry - uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1 + uses: docker/login-action@d3b9cdfa580156c018ca5e745c1bf653d8ea46b5 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 66843cf..6f3415a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -25,25 +25,25 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1 + uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif publish_results: true - name: "Upload artifact" - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: SARIF file path: results.sarif retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: results.sarif diff --git a/.github/workflows/validate-common.yaml b/.github/workflows/validate-common.yaml index 0b26093..b0193b0 100644 --- a/.github/workflows/validate-common.yaml +++ b/.github/workflows/validate-common.yaml @@ -18,10 +18,10 @@ jobs: name: Run lint runs-on: ${{ inputs.runner }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: clean: true - - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v5 with: go-version-file: go.mod check-latest: true @@ -35,10 +35,10 @@ jobs: name: Build all runs-on: ${{ inputs.runner }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: clean: true - - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v5 with: go-version-file: go.mod check-latest: true @@ -51,7 +51,7 @@ jobs: - run: make discover-image - name: Run Trivy for operator image if: always() - uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2 + uses: aquasecurity/trivy-action@6abccf398f78b4c337599c0656f933d91efb91a0 # 0.34.2 with: scan-type: image scan-ref: intel/intel-network-operator:latest @@ -60,7 +60,7 @@ jobs: output: operator-image-vulnerabilities.json - name: Run Trivy for discover image if: always() - uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2 + uses: aquasecurity/trivy-action@6abccf398f78b4c337599c0656f933d91efb91a0 # 0.34.2 with: scan-type: image scan-ref: intel/intel-network-linkdiscovery:latest @@ -68,7 +68,7 @@ jobs: trivy-config: trivy.yaml output: discover-image-vulnerabilities.json - name: Store image reports as artifacts - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: trivy-image-vulnerabilities-json @@ -80,10 +80,10 @@ jobs: name: Run tests runs-on: ${{ inputs.runner }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: clean: true - - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v5 with: go-version-file: go.mod check-latest: true @@ -99,11 +99,11 @@ jobs: name: Run trivy dockerfiles runs-on: ${{ inputs.runner }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: clean: true - name: Run Trivy for dockerfiles - uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2 + uses: aquasecurity/trivy-action@6abccf398f78b4c337599c0656f933d91efb91a0 # 0.34.2 with: scan-type: config scan-ref: build/ @@ -113,7 +113,7 @@ jobs: severity: CRITICAL,HIGH,MEDIUM - name: Run Trivy for dockerfiles (json) - uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2 + uses: aquasecurity/trivy-action@6abccf398f78b4c337599c0656f933d91efb91a0 # 0.34.2 if: always() with: scan-type: config @@ -126,7 +126,7 @@ jobs: - run: | cp .trivyignore.yaml trivyignore.yaml - name: Store dockerfiles analysis report as artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: trivy-dockerfiles-json @@ -139,11 +139,11 @@ jobs: name: Run trivy vulnerabilities runs-on: ${{ inputs.runner }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: clean: true - name: Run Trivy for vulnerabilities - uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2 + uses: aquasecurity/trivy-action@6abccf398f78b4c337599c0656f933d91efb91a0 # 0.34.2 with: scan-type: fs scan-ref: go.mod @@ -153,7 +153,7 @@ jobs: severity: CRITICAL,HIGH,MEDIUM - name: Run Trivy for vulnerabilities (json) - uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2 + uses: aquasecurity/trivy-action@6abccf398f78b4c337599c0656f933d91efb91a0 # 0.34.2 if: always() with: scan-type: fs @@ -167,7 +167,7 @@ jobs: - run: | cp .trivyignore.yaml trivyignore.yaml - name: Store vulnerability report as artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: trivy-vulnerabilities-json @@ -180,10 +180,10 @@ jobs: name: Run trivy deployments runs-on: ${{ inputs.runner }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: clean: true - - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v5 with: go-version-file: go.mod check-latest: true @@ -192,7 +192,7 @@ jobs: run: | DEPL_YAML_DIR=trivy-depl make trivy-deployments - name: Run Trivy for deployments - uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2 + uses: aquasecurity/trivy-action@6abccf398f78b4c337599c0656f933d91efb91a0 # 0.34.2 with: scan-type: config scan-ref: trivy-depl @@ -201,7 +201,7 @@ jobs: exit-code: 1 severity: CRITICAL,HIGH,MEDIUM - name: Run Trivy for deployments (json) - uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2 + uses: aquasecurity/trivy-action@6abccf398f78b4c337599c0656f933d91efb91a0 # 0.34.2 if: always() with: scan-type: config @@ -214,7 +214,7 @@ jobs: - run: | cp .trivyignore.yaml trivyignore.yaml - name: Store vulnerability report as artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: trivy-deployments-json