Skip to content

ci: bump the actions group across 1 directory with 18 updates #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

ci: bump the actions group across 1 directory with 18 updates #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 19 additions & 19 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,10 +37,10 @@
working-directory: ${{ env.APP_DIR }}
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Set up Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v7
with:
node-version: ${{ env.NODE_VERSION }}
cache: npm
Expand All @@ -56,7 +56,7 @@
run: npm run test:ci

- name: Upload coverage report
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: coverage
path: ${{ env.APP_DIR }}/coverage/lcov.info
Expand All @@ -72,18 +72,18 @@
if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
steps:
- name: Checkout (full history for blame/new-code detection)
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
fetch-depth: 0

- name: Download coverage report
uses: actions/download-artifact@v4
uses: actions/download-artifact@v8
with:
name: coverage
path: ${{ env.APP_DIR }}/coverage

- name: SonarCloud scan
uses: SonarSource/sonarqube-scan-action@v4
uses: SonarSource/sonarqube-scan-action@v8
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_HOST_URL: https://sonarcloud.io
Expand All @@ -104,11 +104,11 @@
security-events: write
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7

# Pass 1: produce SARIF for code scanning regardless of findings.
- name: Trivy fs scan (SARIF report)
uses: aquasecurity/trivy-action@0.28.0
uses: aquasecurity/trivy-action@v0.36.0
with:
scan-type: fs
scan-ref: .
Expand All @@ -119,14 +119,14 @@

- name: Upload Trivy fs SARIF
if: always()
uses: github/codeql-action/upload-sarif@v3
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: trivy-fs.sarif
category: trivy-fs

# Pass 2: enforce the policy. Uses the DB cached by pass 1.
- name: Trivy fs scan (policy gate)
uses: aquasecurity/trivy-action@0.28.0
uses: aquasecurity/trivy-action@v0.36.0
with:
scan-type: fs
scan-ref: .
Expand All @@ -146,10 +146,10 @@
security-events: write
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: hadolint
uses: hadolint/hadolint-action@v3.1.0
uses: hadolint/hadolint-action@v3.5.0
with:
dockerfile: ${{ env.APP_DIR }}/Dockerfile
config: .hadolint.yaml
Expand All @@ -159,7 +159,7 @@

- name: Upload hadolint SARIF
if: always()
uses: github/codeql-action/upload-sarif@v3
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: hadolint.sarif
category: hadolint
Expand All @@ -174,13 +174,13 @@
security-events: write
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@v4

- name: Build image (load locally, no push)
uses: docker/build-push-action@v6
uses: docker/build-push-action@v7
with:
context: ${{ env.APP_DIR }}
file: ${{ env.APP_DIR }}/Dockerfile
Expand All @@ -195,7 +195,7 @@
cache-to: type=gha,mode=max

- name: Container smoke test (start, probe, graceful SIGTERM)
run: |

Check failure on line 198 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / Workflow lint (actionlint) 

shellcheck reported issue in this script: SC2034:warning:4:1: i appears unused. Verify use (or export if used externally)

Check failure on line 198 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / Workflow lint (actionlint) 

shellcheck reported issue in this script: SC2034:warning:4:1: i appears unused. Verify use (or export if used externally)

Check failure on line 198 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / Workflow lint (actionlint) 

shellcheck reported issue in this script: SC2034:warning:4:1: i appears unused. Verify use (or export if used externally)
set -euo pipefail
cid=$(docker run -d --rm -p 18080:8080 --read-only --cap-drop ALL \
--security-opt no-new-privileges "$IMAGE_LOCAL")
Expand All @@ -214,7 +214,7 @@
echo "container smoke test passed"

- name: Trivy image scan (SARIF report)
uses: aquasecurity/trivy-action@0.28.0
uses: aquasecurity/trivy-action@v0.36.0
with:
scan-type: image
image-ref: ${{ env.IMAGE_LOCAL }}
Expand All @@ -225,13 +225,13 @@

- name: Upload Trivy image SARIF
if: always()
uses: github/codeql-action/upload-sarif@v3
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: trivy-image.sarif
category: trivy-image

- name: Trivy image scan (policy gate)
uses: aquasecurity/trivy-action@0.28.0
uses: aquasecurity/trivy-action@v0.36.0
with:
scan-type: image
image-ref: ${{ env.IMAGE_LOCAL }}
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/pr-validation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ jobs:
pull-requests: read
steps:
- name: Validate PR title
uses: amannn/action-semantic-pull-request@v5
uses: amannn/action-semantic-pull-request@v6
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
Expand All @@ -52,7 +52,7 @@ jobs:
timeout-minutes: 5
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: actionlint
uses: raven-actions/actionlint@v2
Expand All @@ -69,7 +69,7 @@ jobs:
overlay: [uat, prod]
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Set up kubectl
uses: azure/setup-kubectl@v4
Expand Down Expand Up @@ -101,10 +101,10 @@ jobs:
timeout-minutes: 10
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Trivy Kubernetes misconfiguration scan
uses: aquasecurity/trivy-action@0.28.0
uses: aquasecurity/trivy-action@v0.36.0
with:
scan-type: config
scan-ref: k8s
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/reusable-deploy-gke.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@
new_revision: ${{ steps.post.outputs.revision }}
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Validate digest format
run: |
Expand All @@ -101,13 +101,13 @@
|| { echo "refusing to deploy: '${{ inputs.digest }}' is not an immutable digest"; exit 1; }

- name: Authenticate to Google Cloud (OIDC / WIF)
uses: google-github-actions/auth@v2
uses: google-github-actions/auth@v3
with:
workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}

- name: Get GKE credentials
uses: google-github-actions/get-gke-credentials@v2
uses: google-github-actions/get-gke-credentials@v3
with:
cluster_name: ${{ inputs.cluster }}
location: ${{ inputs.location }}
Expand All @@ -116,7 +116,7 @@
# use_connect_gateway: true

- name: Set up kustomize
uses: imranismail/setup-kustomize@v2
uses: imranismail/setup-kustomize@v3
with:
kustomize-version: "5.4.3"

Expand Down Expand Up @@ -163,7 +163,7 @@
- name: In-cluster smoke test
id: smoke
if: inputs.run_smoke_test
run: |

Check failure on line 166 in .github/workflows/reusable-deploy-gke.yml

View workflow job for this annotation

GitHub Actions / Workflow lint (actionlint) 

shellcheck reported issue in this script: SC2034:warning:6:1: i appears unused. Verify use (or export if used externally)

Check failure on line 166 in .github/workflows/reusable-deploy-gke.yml

View workflow job for this annotation

GitHub Actions / Workflow lint (actionlint) 

shellcheck reported issue in this script: SC2034:warning:6:1: i appears unused. Verify use (or export if used externally)

Check failure on line 166 in .github/workflows/reusable-deploy-gke.yml

View workflow job for this annotation

GitHub Actions / Workflow lint (actionlint) 

shellcheck reported issue in this script: SC2034:warning:6:1: i appears unused. Verify use (or export if used externally)
set -euo pipefail
kubectl -n "$NS" delete job sample-service-smoke --ignore-not-found --wait=true
kubectl -n "$NS" apply -f k8s/smoke-test-job.yaml
Expand Down
20 changes: 10 additions & 10 deletions .github/workflows/reusable-docker-build-push.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@
image_ref: ${{ steps.names.outputs.image }}@${{ steps.build.outputs.digest }}
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Compute image names
id: names
Expand All @@ -91,7 +91,7 @@
PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
REPOSITORY: ${{ inputs.repository }}
IMAGE_NAME: ${{ inputs.image_name }}
run: |

Check failure on line 94 in .github/workflows/reusable-docker-build-push.yml

View workflow job for this annotation

GitHub Actions / Workflow lint (actionlint) 

shellcheck reported issue in this script: SC2129:style:4:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects

Check failure on line 94 in .github/workflows/reusable-docker-build-push.yml

View workflow job for this annotation

GitHub Actions / Workflow lint (actionlint) 

shellcheck reported issue in this script: SC2129:style:4:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects

Check failure on line 94 in .github/workflows/reusable-docker-build-push.yml

View workflow job for this annotation

GitHub Actions / Workflow lint (actionlint) 

shellcheck reported issue in this script: SC2129:style:4:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects
set -euo pipefail
image="${REGISTRY}/${PROJECT_ID}/${REPOSITORY}/${IMAGE_NAME}"
short_sha="${GITHUB_SHA::7}"
Expand All @@ -106,30 +106,30 @@

- name: Authenticate to Google Cloud (OIDC / WIF)
id: auth
uses: google-github-actions/auth@v2
uses: google-github-actions/auth@v3
with:
workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}
token_format: access_token
access_token_lifetime: 1200s

- name: Log in to Artifact Registry
uses: docker/login-action@v3
uses: docker/login-action@v4
with:
registry: ${{ inputs.registry }}
username: oauth2accesstoken
password: ${{ steps.auth.outputs.access_token }}

- name: Set up QEMU
if: inputs.platforms != 'linux/amd64'
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@v4

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@v4

- name: Docker metadata (tags and OCI labels)
id: meta
uses: docker/metadata-action@v5
uses: docker/metadata-action@v6
with:
images: ${{ steps.names.outputs.image }}
# Tagging strategy (see docs/image-tagging-strategy.md):
Expand All @@ -154,7 +154,7 @@

- name: Build and push
id: build
uses: docker/build-push-action@v6
uses: docker/build-push-action@v7
with:
context: ${{ inputs.context }}
file: ${{ inputs.dockerfile }}
Expand All @@ -174,7 +174,7 @@

- name: Trivy scan of pushed image (SARIF report)
if: inputs.scan_pushed_image
uses: aquasecurity/trivy-action@0.28.0
uses: aquasecurity/trivy-action@v0.36.0
with:
scan-type: image
image-ref: ${{ steps.names.outputs.image }}@${{ steps.build.outputs.digest }}
Expand All @@ -189,14 +189,14 @@

- name: Upload Trivy SARIF
if: inputs.scan_pushed_image && always()
uses: github/codeql-action/upload-sarif@v3
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: trivy-pushed-image.sarif
category: trivy-pushed-image

- name: Trivy scan of pushed image (policy gate)
if: inputs.scan_pushed_image
uses: aquasecurity/trivy-action@0.28.0
uses: aquasecurity/trivy-action@v0.36.0
with:
scan-type: image
image-ref: ${{ steps.names.outputs.image }}@${{ steps.build.outputs.digest }}
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/rollback.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@
IMAGE_NAME: sample-service
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Resolve environment settings
id: env
Expand All @@ -70,16 +70,16 @@
echo "image=${{ vars.ARTIFACT_REGISTRY_HOST || 'asia-south1-docker.pkg.dev' }}/${{ secrets.GCP_PROJECT_ID }}/${{ vars.ARTIFACT_REGISTRY_REPO || 'apps' }}/${IMAGE_NAME}" >> "$GITHUB_OUTPUT"

- name: Authenticate to Google Cloud (OIDC / WIF)
uses: google-github-actions/auth@v2
uses: google-github-actions/auth@v3
with:
workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}

- name: Set up gcloud
uses: google-github-actions/setup-gcloud@v2
uses: google-github-actions/setup-gcloud@v3

- name: Get GKE credentials
uses: google-github-actions/get-gke-credentials@v2
uses: google-github-actions/get-gke-credentials@v3
with:
cluster_name: ${{ steps.env.outputs.cluster }}
location: ${{ vars.GKE_LOCATION }}
Expand Down Expand Up @@ -156,7 +156,7 @@
if: inputs.run_smoke_test
env:
NS: ${{ steps.env.outputs.namespace }}
run: |

Check failure on line 159 in .github/workflows/rollback.yml

View workflow job for this annotation

GitHub Actions / Workflow lint (actionlint) 

shellcheck reported issue in this script: SC2034:warning:4:1: i appears unused. Verify use (or export if used externally)

Check failure on line 159 in .github/workflows/rollback.yml

View workflow job for this annotation

GitHub Actions / Workflow lint (actionlint) 

shellcheck reported issue in this script: SC2034:warning:4:1: i appears unused. Verify use (or export if used externally)

Check failure on line 159 in .github/workflows/rollback.yml

View workflow job for this annotation

GitHub Actions / Workflow lint (actionlint) 

shellcheck reported issue in this script: SC2034:warning:4:1: i appears unused. Verify use (or export if used externally)
set -euo pipefail
kubectl -n "$NS" delete job sample-service-smoke --ignore-not-found --wait=true
kubectl -n "$NS" apply -f k8s/smoke-test-job.yaml
Expand Down
Loading