From d40cd85bbd69deaecb302d6a639db077484fc391 Mon Sep 17 00:00:00 2001 From: Ben Radstone Date: Fri, 9 Oct 2026 11:26:27 +0100 Subject: [PATCH] ci: run workflows on Node 24 and pin actions to commit SHAs Dependabot writes lockfiles with npm 11, which npm 10.9 (Node 22) rejects in npm ci. Also pin every action to a SHA and fix the template-injection, cache-poisoning, and excessive-permissions findings so the bulwark zizmor scan passes. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yaml | 27 ++++++++++++++------------- .github/workflows/test.yaml | 23 +++++++++++++---------- 2 files changed, 27 insertions(+), 23 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 2db5dcc..d897165 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -14,7 +14,7 @@ env: PALETTE_REGISTRY_CLI_VERSION: 4.6.1 K9S_VERSION: 0.32.5 SPECTRO_CLI_VERSION: 4.6.0 - NODE_VERSION: "22" + NODE_VERSION: "24" jobs: docker: @@ -24,12 +24,13 @@ jobs: VERSION: ${{ steps.get-version.outputs.version }} steps: - name: Setup nodeJs - uses: actions/setup-node@v7 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ env.NODE_VERSION }} + package-manager-cache: false - name: Check out code into the Go module directory - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Get dependencies" id: dependencies @@ -42,15 +43,15 @@ jobs: - name: Set up QEMU if: ${{ steps.dependencies.outputs.VERSION != ''}} - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - name: "Set up Docker Buildx" if: ${{ steps.dependencies.outputs.VERSION != ''}} - uses: docker/setup-buildx-action@v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Login to GHCR if: ${{ steps.dependencies.outputs.VERSION != ''}} - uses: docker/login-action@v4.6.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.repository_owner }} @@ -58,7 +59,7 @@ jobs: - name: Build and push if: ${{ steps.dependencies.outputs.VERSION != ''}} - uses: docker/build-push-action@v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 id: build-and-push with: context: . @@ -75,15 +76,15 @@ jobs: push: true tags: ghcr.io/${{ github.repository }}:${{steps.dependencies.outputs.VERSION}} - - uses: sigstore/cosign-installer@v4.1.2 + - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: Image Signing if: ${{ steps.dependencies.outputs.VERSION != ''}} run: | cosign sign --yes \ - -a "repo=${{ github.repository }}" \ - -a "workflow=${{ github.workflow }}" \ - -a "ref=${{ github.sha }}" \ + -a "repo=${GITHUB_REPOSITORY}" \ + -a "workflow=${GITHUB_WORKFLOW}" \ + -a "ref=${GITHUB_SHA}" \ -a "owner=Spectro Cloud" \ --key env://COSIGN_PRIVATE_KEY --recursive "${TAGS}@${DIGEST}" env: @@ -99,10 +100,10 @@ jobs: steps: - id: checkout name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Nodejs - uses: actions/setup-node@v7 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ env.NODE_VERSION }} diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 43355bc..1c37b4f 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -6,7 +6,6 @@ on: permissions: contents: read - packages: write # <-- needed to push to GHCR env: GITHUB_TOKEN: ${{ github.token }} @@ -18,7 +17,7 @@ env: PALETTE_REGISTRY_CLI_VERSION: 4.5.0 K9S_VERSION: 0.32.5 SPECTRO_CLI_VERSION: 4.6.0 - NODE_VERSION: "22" + NODE_VERSION: "24" concurrency: group: docker-${{ github.ref }} @@ -41,35 +40,39 @@ jobs: name: "Docker Dev image" needs: [run-ci] runs-on: ubuntu-latest + permissions: + contents: read + packages: write # needed to push to GHCR if: ${{ !github.event.pull_request.draft }} steps: - id: checkout name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Nodejs - uses: actions/setup-node@v7 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ env.NODE_VERSION }} + package-manager-cache: false - name: Install dependencies run: npm ci - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Login to GHCR - uses: docker/login-action@v4.6.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build and Push Docker Image - uses: docker/build-push-action@v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . platforms: linux/amd64,linux/arm64 @@ -92,12 +95,12 @@ jobs: if: ${{ !github.event.pull_request.draft }} steps: - name: Setup nodeJs - uses: actions/setup-node@v7 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ env.NODE_VERSION }} - name: Check out code into the Go module directory - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install dependencies run: npm ci