diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cad2c51..4fb3546 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,10 +37,10 @@ jobs: working-directory: ${{ env.APP_DIR }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: ${{ env.NODE_VERSION }} cache: npm @@ -56,7 +56,7 @@ jobs: run: npm run test:ci - name: Upload coverage report - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: coverage path: ${{ env.APP_DIR }}/coverage/lcov.info @@ -72,18 +72,18 @@ jobs: if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository steps: - name: Checkout (full history for blame/new-code detection) - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 - name: Download coverage report - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: coverage path: ${{ env.APP_DIR }}/coverage - name: SonarCloud scan - uses: SonarSource/sonarqube-scan-action@v4 + uses: SonarSource/sonarqube-scan-action@v8 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_HOST_URL: https://sonarcloud.io @@ -104,11 +104,11 @@ jobs: security-events: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 # Pass 1: produce SARIF for code scanning regardless of findings. - name: Trivy fs scan (SARIF report) - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: fs scan-ref: . @@ -119,14 +119,14 @@ jobs: - name: Upload Trivy fs SARIF if: always() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: trivy-fs.sarif category: trivy-fs # Pass 2: enforce the policy. Uses the DB cached by pass 1. - name: Trivy fs scan (policy gate) - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: fs scan-ref: . @@ -146,10 +146,10 @@ jobs: security-events: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: hadolint - uses: hadolint/hadolint-action@v3.1.0 + uses: hadolint/hadolint-action@v3.5.0 with: dockerfile: ${{ env.APP_DIR }}/Dockerfile config: .hadolint.yaml @@ -159,7 +159,7 @@ jobs: - name: Upload hadolint SARIF if: always() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: hadolint.sarif category: hadolint @@ -174,13 +174,13 @@ jobs: security-events: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Build image (load locally, no push) - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: ${{ env.APP_DIR }} file: ${{ env.APP_DIR }}/Dockerfile @@ -214,7 +214,7 @@ jobs: echo "container smoke test passed" - name: Trivy image scan (SARIF report) - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: image image-ref: ${{ env.IMAGE_LOCAL }} @@ -225,13 +225,13 @@ jobs: - name: Upload Trivy image SARIF if: always() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: trivy-image.sarif category: trivy-image - name: Trivy image scan (policy gate) - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: image image-ref: ${{ env.IMAGE_LOCAL }} diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml index 48c0e88..271bc09 100644 --- a/.github/workflows/pr-validation.yml +++ b/.github/workflows/pr-validation.yml @@ -26,7 +26,7 @@ jobs: pull-requests: read steps: - name: Validate PR title - uses: amannn/action-semantic-pull-request@v5 + uses: amannn/action-semantic-pull-request@v6 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -52,7 +52,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: actionlint uses: raven-actions/actionlint@v2 @@ -69,7 +69,7 @@ jobs: overlay: [uat, prod] steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up kubectl uses: azure/setup-kubectl@v4 @@ -101,10 +101,10 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Trivy Kubernetes misconfiguration scan - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: config scan-ref: k8s diff --git a/.github/workflows/reusable-deploy-gke.yml b/.github/workflows/reusable-deploy-gke.yml index 26c15d7..46bf7f1 100644 --- a/.github/workflows/reusable-deploy-gke.yml +++ b/.github/workflows/reusable-deploy-gke.yml @@ -92,7 +92,7 @@ jobs: new_revision: ${{ steps.post.outputs.revision }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Validate digest format run: | @@ -101,13 +101,13 @@ jobs: || { echo "refusing to deploy: '${{ inputs.digest }}' is not an immutable digest"; exit 1; } - name: Authenticate to Google Cloud (OIDC / WIF) - uses: google-github-actions/auth@v2 + uses: google-github-actions/auth@v3 with: workload_identity_provider: ${{ secrets.WIF_PROVIDER }} service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }} - name: Get GKE credentials - uses: google-github-actions/get-gke-credentials@v2 + uses: google-github-actions/get-gke-credentials@v3 with: cluster_name: ${{ inputs.cluster }} location: ${{ inputs.location }} @@ -116,7 +116,7 @@ jobs: # use_connect_gateway: true - name: Set up kustomize - uses: imranismail/setup-kustomize@v2 + uses: imranismail/setup-kustomize@v3 with: kustomize-version: "5.4.3" diff --git a/.github/workflows/reusable-docker-build-push.yml b/.github/workflows/reusable-docker-build-push.yml index 721ca75..119fa04 100644 --- a/.github/workflows/reusable-docker-build-push.yml +++ b/.github/workflows/reusable-docker-build-push.yml @@ -82,7 +82,7 @@ jobs: image_ref: ${{ steps.names.outputs.image }}@${{ steps.build.outputs.digest }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Compute image names id: names @@ -106,7 +106,7 @@ jobs: - name: Authenticate to Google Cloud (OIDC / WIF) id: auth - uses: google-github-actions/auth@v2 + uses: google-github-actions/auth@v3 with: workload_identity_provider: ${{ secrets.WIF_PROVIDER }} service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }} @@ -114,7 +114,7 @@ jobs: access_token_lifetime: 1200s - name: Log in to Artifact Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ${{ inputs.registry }} username: oauth2accesstoken @@ -122,14 +122,14 @@ jobs: - name: Set up QEMU if: inputs.platforms != 'linux/amd64' - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Docker metadata (tags and OCI labels) id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ${{ steps.names.outputs.image }} # Tagging strategy (see docs/image-tagging-strategy.md): @@ -154,7 +154,7 @@ jobs: - name: Build and push id: build - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: ${{ inputs.context }} file: ${{ inputs.dockerfile }} @@ -174,7 +174,7 @@ jobs: - name: Trivy scan of pushed image (SARIF report) if: inputs.scan_pushed_image - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: image image-ref: ${{ steps.names.outputs.image }}@${{ steps.build.outputs.digest }} @@ -189,14 +189,14 @@ jobs: - name: Upload Trivy SARIF if: inputs.scan_pushed_image && always() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: trivy-pushed-image.sarif category: trivy-pushed-image - name: Trivy scan of pushed image (policy gate) if: inputs.scan_pushed_image - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: image image-ref: ${{ steps.names.outputs.image }}@${{ steps.build.outputs.digest }} diff --git a/.github/workflows/rollback.yml b/.github/workflows/rollback.yml index ef192a5..ded1f54 100644 --- a/.github/workflows/rollback.yml +++ b/.github/workflows/rollback.yml @@ -50,7 +50,7 @@ jobs: IMAGE_NAME: sample-service steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Resolve environment settings id: env @@ -70,16 +70,16 @@ jobs: echo "image=${{ vars.ARTIFACT_REGISTRY_HOST || 'asia-south1-docker.pkg.dev' }}/${{ secrets.GCP_PROJECT_ID }}/${{ vars.ARTIFACT_REGISTRY_REPO || 'apps' }}/${IMAGE_NAME}" >> "$GITHUB_OUTPUT" - name: Authenticate to Google Cloud (OIDC / WIF) - uses: google-github-actions/auth@v2 + uses: google-github-actions/auth@v3 with: workload_identity_provider: ${{ secrets.WIF_PROVIDER }} service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }} - name: Set up gcloud - uses: google-github-actions/setup-gcloud@v2 + uses: google-github-actions/setup-gcloud@v3 - name: Get GKE credentials - uses: google-github-actions/get-gke-credentials@v2 + uses: google-github-actions/get-gke-credentials@v3 with: cluster_name: ${{ steps.env.outputs.cluster }} location: ${{ vars.GKE_LOCATION }}