Skip to content

Commit 76a7b06

Browse files
mandreko-bitwardenmandreko-bitwarden
authored
Clean up workflow files from Zizmor output (#113)
1 parent b83f362 commit 76a7b06

File tree

2 files changed

+250
-9
lines changed

2 files changed

+250
-9
lines changed

‎.github/workflows/build.yml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -109,24 +109,26 @@ jobs:
109109
DIGEST: ${{ steps.build-docker.outputs.digest }}
110110
TAGS: ${{ steps.image-tags.outputs.tags }}
111111
run: |
112-
IFS="," read -a tags <<< "${TAGS}"
113-
images=""
114-
for tag in "${tags[@]}"; do
115-
images+="${tag}@${DIGEST} "
112+
IFS=',' read -r -a tags_array <<< "${TAGS}"
113+
images=()
114+
for tag in "${tags_array[@]}"; do
115+
images+=("${tag}@${DIGEST}")
116116
done
117-
cosign sign --yes ${images}
118-
echo "images=${images}" >> "$GITHUB_OUTPUT"
117+
cosign sign --yes "${images[@]}"
118+
echo "images=${images[*]}" >> "$GITHUB_OUTPUT"
119119
120120
- name: Verify the signed image with Cosign
121121
if: ${{ env._PUSH_IMAGE == 'true' }}
122122
env:
123123
GITHUB_SERVER_URL: "${{ github.server_url }}"
124124
REF: "${{ github.workflow_ref }}"
125125
IMAGES: "${{ steps.cosign.outputs.images }}"
126-
run: |
126+
run: |
127+
read -r -a images_array <<< "${COSIGN_IMAGES}"
127128
cosign verify \
128-
--certificate-identity "$GITHUB_SERVER_URL/$REF" \
129-
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" $IMAGES
129+
--certificate-identity "${GITHUB_SERVER_URL}/${GITHUB_WORKFLOW_REF}" \
130+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
131+
"${images_array[@]}"
130132
131133
- name: Create kind cluster
132134
uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0

‎andreko.patch‎

Lines changed: 239 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,239 @@
1+
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
2+
index c115ab5..18e993a 100644
3+
--- a/.github/workflows/build.yml
4+
+++ b/.github/workflows/build.yml
5+
@@ -31,15 +31,17 @@ jobs:
6+
steps:
7+
- name: Check out repo
8+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
9+
+ with:
10+
+ persist-credentials: false
11+
12+
- name: Set up QEMU
13+
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
14+
+ uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
15+
16+
- name: Set up Docker Buildx
17+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
18+
19+
- name: Log in to GitHub Container Registry
20+
- uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
21+
+ uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
22+
with:
23+
registry: ghcr.io
24+
username: ${{ github.actor }}
25+
@@ -53,7 +55,7 @@ jobs:
26+
make test
27+
28+
- name: Upload to codecov.io
29+
- uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
30+
+ uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
31+
32+
- name: Generate Docker image tag
33+
id: tag
34+
@@ -63,12 +65,14 @@ jobs:
35+
if [[ "$EVENT_TYPE" == "pull_request" ]]; then
36+
IMAGE_TAG="pr-${{ github.event.pull_request.number }}"
37+
else
38+
- IMAGE_TAG=$(echo "${GITHUB_REF:11}" | sed "s#/#-#g") # slash safe branch name
39+
- if [[ "$IMAGE_TAG" == "main" ]]; then
40+
- IMAGE_TAG=dev
41+
+ ref="${GITHUB_REF:11}"
42+
+ IMAGE_TAG="${ref//\//-}"
43+
+
44+
+ if [[ "${IMAGE_TAG}" == "main" ]]; then
45+
+ IMAGE_TAG="dev"
46+
fi
47+
fi
48+
- echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
49+
+ echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
50+
51+
- name: Generate image tag(s)
52+
id: image-tags
53+
@@ -76,13 +80,13 @@ jobs:
54+
IMAGE_TAG: ${{ steps.tag.outputs.image_tag }}
55+
SHA: ${{ github.sha }}
56+
run: |
57+
- TAGS="${{ env._IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
58+
- echo "primary_tag=$TAGS" >> $GITHUB_OUTPUT
59+
+ TAGS="$_IMAGE_NAME:$IMAGE_TAG"
60+
+ echo "primary_tag=$TAGS" >> "$GITHUB_OUTPUT"
61+
if [[ "$IMAGE_TAG" == "dev" ]]; then
62+
- SHORT_SHA="$(git rev-parse --short ${SHA})"
63+
- TAGS="$TAGS,${{ env._IMAGE_NAME }}:${{ env.IMAGE_TAG }}-${SHORT_SHA}"
64+
+ SHORT_SHA="$(git rev-parse --short "${SHA}")"
65+
+ TAGS="$TAGS,$TAGS-${SHORT_SHA}"
66+
fi
67+
- echo "tags=$TAGS" >> $GITHUB_OUTPUT
68+
+ echo "tags=$TAGS" >> "$GITHUB_OUTPUT"
69+
70+
- name: Build Docker image
71+
id: build-docker
72+
@@ -96,7 +100,7 @@ jobs:
73+
74+
- name: Install Cosign
75+
if: ${{ env._PUSH_IMAGE == 'true' }}
76+
- uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
77+
+ uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
78+
79+
- name: Sign image with Cosign
80+
if: ${{ env._PUSH_IMAGE == 'true' }}
81+
@@ -105,24 +109,31 @@ jobs:
82+
DIGEST: ${{ steps.build-docker.outputs.digest }}
83+
TAGS: ${{ steps.image-tags.outputs.tags }}
84+
run: |
85+
- IFS="," read -a tags <<< "${TAGS}"
86+
- images=""
87+
- for tag in "${tags[@]}"; do
88+
- images+="${tag}@${DIGEST} "
89+
+ IFS="," read -r -a combined_tags <<< "${TAGS}"
90+
+ images=()
91+
+ for tag in "${combined_tags[@]}"; do
92+
+ images+=("${tag}@${DIGEST}")
93+
done
94+
- cosign sign --yes ${images}
95+
- echo "images=${images}" >> $GITHUB_OUTPUT
96+
+ cosign sign --yes "${images[@]}"
97+
+ {
98+
+ printf 'images='
99+
+ printf '%s ' "${images[@]}"
100+
+ echo
101+
+ } >> "$GITHUB_OUTPUT"
102+
103+
- name: Verify the signed image with Cosign
104+
if: ${{ env._PUSH_IMAGE == 'true' }}
105+
+ env:
106+
+ REF: ${{ github.workflow_ref }}
107+
+ IMAGES: ${{ steps.cosign.outputs.images }}
108+
run: |
109+
cosign verify \
110+
- --certificate-identity "${{ github.server_url }}/${{ github.workflow_ref }}" \
111+
+ --certificate-identity "${{ github.server_url }}/$REF" \
112+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
113+
- ${{ steps.cosign.outputs.images }}
114+
+ "$IMAGES"
115+
116+
- name: Create kind cluster
117+
- uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
118+
+ uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
119+
120+
- name: Load image into kind
121+
if: ${{ env._PUSH_IMAGE != 'true' }}
122+
@@ -136,7 +147,7 @@ jobs:
123+
env:
124+
IMAGE: ${{ steps.image-tags.outputs.primary_tag }}
125+
run: |
126+
- make deploy IMG=$IMAGE
127+
+ make deploy IMG="$IMAGE"
128+
129+
count=0
130+
while [[ $(kubectl get pods -n sm-operator-system -l control-plane=controller-manager -o jsonpath="{.items[*].status.containerStatuses[*].ready}") != "true" ]]; do
131+
@@ -153,7 +164,7 @@ jobs:
132+
133+
echo "*****PODS*****"
134+
pods=$(kubectl get pods -n sm-operator-system -l control-plane=controller-manager | grep 2/2)
135+
- echo $pods
136+
+ echo "$pods"
137+
138+
if [[ -z "$pods" ]]; then
139+
echo "::error::No pods found."
140+
diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
141+
index 8f8bbb6..5926b49 100644
142+
--- a/.github/workflows/bump-version.yml
143+
+++ b/.github/workflows/bump-version.yml
144+
@@ -26,10 +26,12 @@ jobs:
145+
echo "Error: Version number ($_VERSION_NUMBER) is not in semantic version format (X.Y.Z)"
146+
exit 1
147+
fi
148+
- echo "branch_name=version_bump_$_VERSION_NUMBER" >> $GITHUB_OUTPUT
149+
+ echo "branch_name=version_bump_$_VERSION_NUMBER" >> "$GITHUB_OUTPUT"
150+
151+
- name: Check out repo
152+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
153+
+ with:
154+
+ persist-credentials: true
155+
156+
- name: Log in to Azure
157+
uses: bitwarden/gh-actions/azure-login@main
158+
@@ -49,7 +51,7 @@ jobs:
159+
uses: bitwarden/gh-actions/azure-logout@main
160+
161+
- name: Import GPG key
162+
- uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
163+
+ uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
164+
with:
165+
gpg_private_key: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key }}
166+
passphrase: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key-passphrase }}
167+
@@ -57,7 +59,9 @@ jobs:
168+
git_commit_gpgsign: true
169+
170+
- name: Create branch
171+
- run: git switch -c "${{ steps.setup.outputs.branch_name }}"
172+
+ env:
173+
+ BRANCH_NAME: "${{ steps.setup.outputs.branch_name }}"
174+
+ run: git switch -c "$BRANCH_NAME"
175+
176+
- name: Bump version
177+
run: |
178+
@@ -72,10 +76,10 @@ jobs:
179+
id: version-changed
180+
run: |
181+
if [ -n "$(git status --porcelain)" ]; then
182+
- echo "changes_to_commit=TRUE" >> $GITHUB_OUTPUT
183+
+ echo "changes_to_commit=TRUE" >> "$GITHUB_OUTPUT"
184+
git diff
185+
else
186+
- echo "changes_to_commit=FALSE" >> $GITHUB_OUTPUT
187+
+ echo "changes_to_commit=FALSE" >> "$GITHUB_OUTPUT"
188+
echo "No changes to commit!";
189+
fi
190+
191+
@@ -85,7 +89,9 @@ jobs:
192+
193+
- name: Push changes
194+
if: ${{ steps.version-changed.outputs.changes_to_commit == 'TRUE' }}
195+
- run: git push -u origin "${{ steps.setup.outputs.branch_name }}"
196+
+ env:
197+
+ BRANCH_NAME: "${{ steps.setup.outputs.branch_name }}"
198+
+ run: git push -u origin "$BRANCH_NAME"
199+
200+
- name: Create version PR
201+
if: ${{ steps.version-changed.outputs.changes_to_commit == 'TRUE' }}
202+
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
203+
index 160d999..59b665b 100644
204+
--- a/.github/workflows/release.yml
205+
+++ b/.github/workflows/release.yml
206+
@@ -33,12 +33,14 @@ jobs:
207+
208+
- name: Check out repo
209+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
210+
+ with:
211+
+ persist-credentials: false
212+
213+
- name: Get version
214+
id: version
215+
run: |
216+
VERSION=$(sed -nE 's/^VERSION\s+\?=\s+([^\s]+)/\1/p' Makefile)
217+
- echo "version=$VERSION" >> $GITHUB_OUTPUT
218+
+ echo "version=$VERSION" >> "$GITHUB_OUTPUT"
219+
220+
release:
221+
name: Release
222+
@@ -52,7 +54,7 @@ jobs:
223+
steps:
224+
- name: Create release
225+
if: ${{ inputs.release_type != 'Dry Run' }}
226+
- uses: ncipollo/release-action@bcfe5470707e8832e12347755757cec0eb3c22af # v1.18.0
227+
+ uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
228+
with:
229+
commit: ${{ github.sha }}
230+
tag: v${{ env._PKG_VERSION }}
231+
@@ -76,7 +78,7 @@ jobs:
232+
233+
steps:
234+
- name: Log in to GitHub Container Registry
235+
- uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
236+
+ uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
237+
with:
238+
registry: ghcr.io
239+
username: ${{ github.actor }}

0 commit comments

Comments
 (0)