mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
2f959e6afb
Security audit of .github/workflows found a script-injection vector in the release workflow, over-broad token grants on non-publishing jobs, and downloaded tooling/manifests executed without integrity checks. - release: pass the tag/dispatch input through env instead of interpolating it into the validation script; default workflow permissions to contents:read - build-main/build-gateway: grant write scopes only to the build job - _build-image/codeql: stop persisting checkout credentials - ci/release: verify actionlint, hadolint and git-cliff against pinned SHA-256s - ci-manifests/e2e: verify upstream CRD manifests against versions.env pins - e2e: redact token material before uploading cluster diagnostics - docs: add workflow-security.md with controls, audit record and residual repository-setting recommendations Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
103 lines
3.8 KiB
YAML
103 lines
3.8 KiB
YAML
# Continuous integration: lint and dependency review. Job names are the required
|
|
# branch-protection checks documented in docs/gitflow.md. The gateway unit tests
|
|
# and the manifest dry-run live in ci-python.yaml / ci-manifests.yaml so each can
|
|
# use native on.pull_request.paths filtering and skip unrelated changes.
|
|
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
lint:
|
|
name: lint
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Set up Python
|
|
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Install Python linters
|
|
run: |
|
|
set -euo pipefail
|
|
python -m pip install --upgrade pip
|
|
pip install "yamllint==1.38.0" "pyyaml==6.0.3"
|
|
- name: Install actionlint
|
|
env:
|
|
ACTIONLINT_VERSION: v1.7.12
|
|
# SHA-256 of actionlint_1.7.12_linux_amd64.tar.gz, published in the
|
|
# release's actionlint_1.7.12_checksums.txt. Update it with the version.
|
|
ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
|
|
run: |
|
|
set -euo pipefail
|
|
version="${ACTIONLINT_VERSION#v}"
|
|
asset="actionlint_${version}_linux_amd64.tar.gz"
|
|
curl -fsSL --proto '=https' -o "/tmp/$asset" \
|
|
"https://github.com/rhysd/actionlint/releases/download/$ACTIONLINT_VERSION/$asset"
|
|
printf '%s %s\n' "$ACTIONLINT_SHA256" "/tmp/$asset" | sha256sum -c -
|
|
tar -xzf "/tmp/$asset" -C /tmp actionlint
|
|
install -m 0755 /tmp/actionlint /usr/local/bin/actionlint
|
|
actionlint -version
|
|
- name: Install hadolint
|
|
env:
|
|
HADOLINT_VERSION: v2.12.0
|
|
# SHA-256 of hadolint-Linux-x86_64, published next to the download.
|
|
HADOLINT_SHA256: 56de6d5e5ec427e17b74fa48d51271c7fc0d61244bf5c90e828aab8362d55010
|
|
run: |
|
|
set -euo pipefail
|
|
curl -fsSL --proto '=https' -o /tmp/hadolint \
|
|
"https://github.com/hadolint/hadolint/releases/download/$HADOLINT_VERSION/hadolint-Linux-x86_64"
|
|
printf '%s %s\n' "$HADOLINT_SHA256" /tmp/hadolint | sha256sum -c -
|
|
install -m 0755 /tmp/hadolint /usr/local/bin/hadolint
|
|
hadolint --version
|
|
- name: Repository checks
|
|
run: |
|
|
set -euo pipefail
|
|
./scripts/check-versions.sh
|
|
./scripts/check-examples.sh
|
|
- name: Shellcheck
|
|
run: shellcheck -x build.sh scripts/*.sh examples/*/scripts/*.sh
|
|
- name: Actionlint
|
|
run: actionlint -color
|
|
- name: Yamllint
|
|
run: yamllint .
|
|
- name: Hadolint
|
|
run: |
|
|
set -euo pipefail
|
|
hadolint Dockerfile
|
|
hadolint examples/dsh-agents-as-a-service/gateway/Dockerfile
|
|
- name: Documentation links
|
|
uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2
|
|
with:
|
|
args: >-
|
|
--offline --no-progress --verbose
|
|
./README.md ./CONTRIBUTING.md ./SECURITY.md ./AGENTS.md ./docs ./examples
|
|
|
|
dependency-review:
|
|
name: dependency-review
|
|
if: github.event_name == 'pull_request'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Dependency review
|
|
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4
|