ci: Harden workflows - #450
Conversation
Techassi
left a comment
Techassi
left a comment
There was a problem hiding this comment.
The changes themself are fine, but I think we should use the opportunity to improve the workflows in general. That is something which is on my plate since forever, but I just didn't get around to it yet.
There was a problem hiding this comment.
I would be fine removing this entire workflow as we just use the underlying library but don't support/use the container image + helm chart anymore.
There was a problem hiding this comment.
This should also go and all checks/lints should be handled by pre-commit/prek.
| push: | ||
| tags: | ||
| - "stackablectl-[0-9]+.[0-9]+.[0-9]+**" | ||
| - "stackablectl-[0-9]+.[0-9]+.[0-9]+*" |
There was a problem hiding this comment.
The ** is different compared to *. The change should technically be fine, but was there a particular reason you changed this?
There was a problem hiding this comment.
This wasn't meant to be changed and I have reverted it, I think I must have fat-fingered a vim motion
There was a problem hiding this comment.
I think we should switch to prek instead.
| - name: Ensure shell completions up-to-date | ||
| if: matrix.os == 'x86_64-unknown-linux-gnu' | ||
| if: matrix.target == 'x86_64-unknown-linux-gnu' | ||
| run: | | ||
| cargo xtask gen-comp | ||
| git diff --exit-code | ||
|
|
||
| - name: Ensure man page is up-to-date |
There was a problem hiding this comment.
Those two checks should instead be handled by pre-commit/prek.
| run: mv rust/stackablectl/stackablectl_bin.cdx.xml "stackablectl-$TARGET.cdx.xml" | ||
|
|
||
| - name: Upload Release Binary and SBOM | ||
| uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2 |
There was a problem hiding this comment.
I think we should move to a gh release ... approach, similar to other reworks. See https://github.com/stackabletech/docker-images/blob/main/.github/workflows/boil_release.yaml for example.
Techassi
moved this from Development: Waiting for Review
to Development: In Review
in Stackable Engineering
4 participants
Description
This PR adds CI Hardening to the stackablectl repo
This addresses all warnings from Zizmor and also bumps dependency versions.
NOTE: -
sigstore/cosign-installerv3.9.1 → v4.1.2 : v3+ of Cosign has breaking changes to the default signature format, i'm not sure how that affects our registry/signing setup, socosign-releaseis explicitly pinned tov2.6.5for now rather than taking the installer's new default.See:
https://github.com/sigstore/cosign/releases/tag/v3.0.1
https://blog.sigstore.dev/cosign-3-0-available/
goharbor/harbor#22592
Definition of Done Checklist
Author
Reviewer
Acceptance