Repository navigation
feat(supply-chain): add the scan every repository runs as a reusable workflow - #20
Merged
Merged
Conversation
…workflow The job that runs zizmor over the workflows and gitleaks over the history was copied into every repository, so raising a scanner digest meant a change in each. It is now one reusable workflow with the digests pinned inside, taking only the runner and the paths zizmor audits; this repository calls it as its own fixture. The zizmor path goes through an environment variable, not into the script. tests/supply-chain.test.sh checks that every image stays pinned by digest and that the flags that decide what is scanned stay.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The job that runs zizmor over the workflows and gitleaks over the history is copied in every
repository of the organisation (
contrast3d-platform,contrast3d-bot,gha-local-runnersand thisone), so raising a scanner digest means a change in each. This makes it one reusable workflow.
.github/workflows/supply-chain.yml: the same two steps as today, images pinned by digest inside thefile. Inputs:
runs-on(a JSON label or array, default"ubuntu-latest", as the other workflows) andpaths(what zizmor audits, default.github/). The path goes through an environment variable, notinto the script. The job runs with
contents: readand a ten-minute limit.tests/supply-chain.test.sh(22 checks): every image pinned by digest, the zizmor and gitleaks flagsthat decide what is scanned (
--format github,--redact,--exit-code 1, the history of thiscommit), the read-only mount, the checkout without credentials, and that no input can change an image.
zizmor.yml: theself-repositoryignores follow the new line numbers.Consumers adopt it by repointing their copy of the job at this file with a full SHA and a release
comment: separate pull requests, after a release tag.
Verification
bash tests/supply-chain.test.sh: 22 ok; the test failed first (the workflow did not exist).actionlintandzizmorclean; the Python suite passes.