Skip to content

Commit

Permalink
[StepSecurity] ci: Harden GitHub Actions (#21)
Browse files Browse the repository at this point in the history
Signed-off-by: StepSecurity Bot <[email protected]>
  • Loading branch information
step-security-bot authored Nov 14, 2024
1 parent 404b392 commit 34a1cba
Show file tree
Hide file tree
Showing 8 changed files with 43 additions and 25 deletions.
12 changes: 6 additions & 6 deletions .github/workflows/check.yml
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,12 @@ jobs:

steps:
- name: Checkout sources
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: src/percona_pg_telemetry

- name: Checkout cppcheck sources
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: "danmar/cppcheck"
ref: "2.13.4"
Expand All @@ -41,13 +41,13 @@ jobs:

steps:
- name: Clone postgres repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: 'postgres/postgres'
ref: 'REL_17_STABLE'

- name: Checkout sources
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: 'contrib/percona_pg_telemetry'

Expand Down Expand Up @@ -82,9 +82,9 @@ jobs:

steps:
- name: Checkout sources
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Check license headers
uses: apache/skywalking-eyes/[email protected]
uses: apache/skywalking-eyes/header@cd7b195c51fd3d6ad52afceb760719ddc6b3ee91 # v0.6.0
with:
token: "" # Prevent comments
9 changes: 6 additions & 3 deletions .github/workflows/postgresql-12-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,16 @@ on:
push:
pull_request:

permissions:
contents: read

jobs:
build:
name: pg-12-build-test
runs-on: ubuntu-22.04
steps:
- name: Clone postgres repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: 'postgres/postgres'
path: postgres
Expand Down Expand Up @@ -44,7 +47,7 @@ jobs:
working-directory: postgres

- name: Clone percona_pg_telemetry repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: 'postgres/contrib/percona_pg_telemetry'

Expand All @@ -61,7 +64,7 @@ jobs:

- name: Upload logs on fail
if: ${{ failure() }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: Regressions diff and postgresql log
path: |
Expand Down
9 changes: 6 additions & 3 deletions .github/workflows/postgresql-13-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,16 @@ on:
push:
pull_request:

permissions:
contents: read

jobs:
build:
name: pg-13-build-test
runs-on: ubuntu-22.04
steps:
- name: Clone postgres repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: 'postgres/postgres'
path: postgres
Expand Down Expand Up @@ -44,7 +47,7 @@ jobs:
working-directory: postgres

- name: Clone percona_pg_telemetry repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: 'postgres/contrib/percona_pg_telemetry'

Expand All @@ -61,7 +64,7 @@ jobs:

- name: Upload logs on fail
if: ${{ failure() }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: Regressions diff and postgresql log
path: |
Expand Down
9 changes: 6 additions & 3 deletions .github/workflows/postgresql-14-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,16 @@ on:
push:
pull_request:

permissions:
contents: read

jobs:
build:
name: pg-14-build-test
runs-on: ubuntu-22.04
steps:
- name: Clone postgres repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: 'postgres/postgres'
path: postgres
Expand Down Expand Up @@ -44,7 +47,7 @@ jobs:
working-directory: postgres

- name: Clone percona_pg_telemetry repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: 'postgres/contrib/percona_pg_telemetry'

Expand All @@ -61,7 +64,7 @@ jobs:

- name: Upload logs on fail
if: ${{ failure() }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: Regressions diff and postgresql log
path: |
Expand Down
9 changes: 6 additions & 3 deletions .github/workflows/postgresql-15-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,16 @@ on:
push:
pull_request:

permissions:
contents: read

jobs:
build:
name: pg-15-build-test
runs-on: ubuntu-22.04
steps:
- name: Clone postgres repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: 'postgres/postgres'
path: postgres
Expand Down Expand Up @@ -44,7 +47,7 @@ jobs:
working-directory: postgres

- name: Clone percona_pg_telemetry repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: 'postgres/contrib/percona_pg_telemetry'

Expand All @@ -61,7 +64,7 @@ jobs:

- name: Upload logs on fail
if: ${{ failure() }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: Regressions diff and postgresql log
path: |
Expand Down
9 changes: 6 additions & 3 deletions .github/workflows/postgresql-16-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,16 @@ on:
push:
pull_request:

permissions:
contents: read

jobs:
build:
name: pg-16-build-test
runs-on: ubuntu-22.04
steps:
- name: Clone postgres repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: 'postgres/postgres'
path: postgres
Expand Down Expand Up @@ -44,7 +47,7 @@ jobs:
working-directory: postgres

- name: Clone percona_pg_telemetry repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: 'postgres/contrib/percona_pg_telemetry'

Expand All @@ -61,7 +64,7 @@ jobs:

- name: Upload logs on fail
if: ${{ failure() }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: Regressions diff and postgresql log
path: |
Expand Down
9 changes: 6 additions & 3 deletions .github/workflows/postgresql-17-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,16 @@ on:
push:
pull_request:

permissions:
contents: read

jobs:
build:
name: pg-17-build-test
runs-on: ubuntu-22.04
steps:
- name: Clone postgres repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: 'postgres/postgres'
path: postgres
Expand Down Expand Up @@ -44,7 +47,7 @@ jobs:
working-directory: postgres

- name: Clone percona_pg_telemetry repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: 'postgres/contrib/percona_pg_telemetry'

Expand All @@ -61,7 +64,7 @@ jobs:

- name: Upload logs on fail
if: ${{ failure() }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: Regressions diff and postgresql log
path: |
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/scorecard.yml
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,6 @@ jobs:

# Upload the results to GitHub's code scanning dashboard (optional).
- name: "Upload to code-scanning"
uses: github/codeql-action/upload-sarif@v3
uses: github/codeql-action/upload-sarif@396bb3e45325a47dd9ef434068033c6d5bb0d11a # v3.27.3
with:
sarif_file: results.sarif

0 comments on commit 34a1cba

Please sign in to comment.