From 172e066ff8e3a037a788c9e5437e6ae8ecbaba41 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Mon, 19 Oct 2026 13:42:04 +0200 Subject: [PATCH 1/4] Enable shared Renovate automerge --- .github/workflows/auto-approve-bot-prs.yml | 26 ++++++++++++++++++++++ .github/workflows/renovate.yml | 15 +++++++++++++ renovate.json | 9 ++++++++ 3 files changed, 50 insertions(+) create mode 100644 .github/workflows/auto-approve-bot-prs.yml create mode 100644 .github/workflows/renovate.yml create mode 100644 renovate.json diff --git a/.github/workflows/auto-approve-bot-prs.yml b/.github/workflows/auto-approve-bot-prs.yml new file mode 100644 index 00000000..372ec777 --- /dev/null +++ b/.github/workflows/auto-approve-bot-prs.yml @@ -0,0 +1,26 @@ +name: Renovate Auto-Approve + +on: + schedule: + - cron: "7 * * * *" + workflow_dispatch: + +permissions: {} + +concurrency: + group: renovate-auto-approve + +jobs: + approve: + if: github.ref == 'refs/heads/main' && vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID != '' + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: read + pull-requests: read + steps: + - name: Approve verified Renovate PRs + uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@f390d2bef95ac180f581d8263b288ded387c085c # main + with: + app-client-id: ${{ vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID }} + app-private-key: ${{ secrets.RENOVATE_APPROVAL_GH_APP_PRIVATE_KEY }} diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml new file mode 100644 index 00000000..183a427b --- /dev/null +++ b/.github/workflows/renovate.yml @@ -0,0 +1,15 @@ +name: Renovate + +on: + schedule: + - cron: "0 1,8 * * *" + workflow_dispatch: + +permissions: + contents: read + +jobs: + renovate: + uses: StackVista/renovate-config/.github/workflows/renovate.yml@f390d2bef95ac180f581d8263b288ded387c085c # main + secrets: + RENOVATE_GH_APP_PRIVATE_KEY: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }} diff --git a/renovate.json b/renovate.json new file mode 100644 index 00000000..b5979784 --- /dev/null +++ b/renovate.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "github>StackVista/renovate-config", + "github>StackVista/renovate-config:go", + "github>StackVista/renovate-config:docker", + "github>StackVista/renovate-config:automerge" + ] +} From 62dd3c6b00dbb182887951e7523cd7640efc9d3e Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Mon, 19 Oct 2026 14:08:41 +0200 Subject: [PATCH 2/4] Pin Renovate workflows to merged policy commit --- .github/workflows/auto-approve-bot-prs.yml | 2 +- .github/workflows/renovate.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/auto-approve-bot-prs.yml b/.github/workflows/auto-approve-bot-prs.yml index 372ec777..a06f5419 100644 --- a/.github/workflows/auto-approve-bot-prs.yml +++ b/.github/workflows/auto-approve-bot-prs.yml @@ -20,7 +20,7 @@ jobs: pull-requests: read steps: - name: Approve verified Renovate PRs - uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@f390d2bef95ac180f581d8263b288ded387c085c # main + uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@c5f974f5b7b1951c12daaa63b607d9eecc2574d3 # main with: app-client-id: ${{ vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID }} app-private-key: ${{ secrets.RENOVATE_APPROVAL_GH_APP_PRIVATE_KEY }} diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 183a427b..2298d4e2 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -10,6 +10,6 @@ permissions: jobs: renovate: - uses: StackVista/renovate-config/.github/workflows/renovate.yml@f390d2bef95ac180f581d8263b288ded387c085c # main + uses: StackVista/renovate-config/.github/workflows/renovate.yml@c5f974f5b7b1951c12daaa63b607d9eecc2574d3 # main secrets: RENOVATE_GH_APP_PRIVATE_KEY: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }} From 6711a13baa9e556b6018fbb28bb3ce3c0dd6db88 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Mon, 19 Oct 2026 14:35:43 +0200 Subject: [PATCH 3/4] Gate CI with Zizmor and fix workflow findings --- .github/actions/quay/action.yml | 13 +++--- .github/workflows/ci.yml | 81 +++++++++++++++++++++++++-------- 2 files changed, 70 insertions(+), 24 deletions(-) diff --git a/.github/actions/quay/action.yml b/.github/actions/quay/action.yml index 377b2ae2..91af892d 100644 --- a/.github/actions/quay/action.yml +++ b/.github/actions/quay/action.yml @@ -17,16 +17,20 @@ runs: using: 'composite' steps: - name: Log in to the Container registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: quay.io username: ${{ env.QUAY_USER }} password: ${{ env.QUAY_PASSWORD }} - name: Run command shell: bash + env: + ENTRYPOINT: ${{ inputs.entrypoint }} + COMMAND: ${{ inputs.run }} + OPTIONS: ${{ inputs.options }} + IMAGE: ${{ inputs.image }} + WORKSPACE: ${{ github.workspace }} run: | - export ENTRYPOINT='${{ inputs.entrypoint }}' - export COMMAND='${{ inputs.run }}' export COMMAND_PREFIX='' # Prep for a shell script. @@ -38,15 +42,12 @@ runs: fi # Strip newlines in options. - export OPTIONS='${{ inputs.options }}' OPTIONS=${OPTIONS//$'\n'/ } # Sanitize the image name. - export IMAGE='${{ inputs.image }}' IMAGE=${IMAGE//$'\n'/} # Prep the workspace. - export WORKSPACE='${{ github.workspace }}' WORKSPACE=${WORKSPACE//$'\n'/} # Prep volumes. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1bb69cd7..4a85bb21 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,10 +12,32 @@ on: # Allows to run this via the Actions tab workflow_dispatch: +permissions: {} + env: REGISTRY: quay.io jobs: + workflow-security-lint: + name: Workflow security lint (Zizmor) + runs-on: ubuntu-24.04 + timeout-minutes: 10 + permissions: + contents: read + steps: + - name: Check out repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Audit workflows, composite actions, and Dependabot + env: + GH_TOKEN: ${{ github.token }} + # renovate: datasource=pypi depName=zizmor + ZIZMOR_VERSION: 1.31.1 + run: | + pipx run --spec "zizmor==${ZIZMOR_VERSION}" zizmor --strict-collection --collect=workflows,actions,dependabot . + lint: permissions: # Required: allow read access to the content for analysis. @@ -28,13 +50,15 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v5 - - uses: actions/setup-go@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + with: + persist-credentials: false + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: go.mod cache: false - name: golangci-lint - uses: golangci/golangci-lint-action@v8 + uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8 with: # Require: The version of golangci-lint to use. # When `install-mode` is `binary` (default) the value can be v1.2 or v1.2.3 or `latest` to use the latest version. @@ -43,16 +67,21 @@ jobs: check-license: name: License scan + permissions: + contents: read runs-on: ubuntu-latest timeout-minutes: 5 env: REPORT_FILE: gl-license-scanning-report.json steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: go.mod + cache: false - name: License scanning run: | go install github.com/google/go-licenses@latest @@ -61,23 +90,28 @@ jobs: run: | go-licenses report . > licenses.csv - name: Save license scan report - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: license_scanning path: licenses.csv check-go-releaser: name: Go releaser check + permissions: + contents: read runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: go.mod + cache: false - name: Run GoReleaser - uses: goreleaser/goreleaser-action@v5 + uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5 with: # either 'goreleaser' (default) or 'goreleaser-pro' distribution: goreleaser @@ -87,21 +121,29 @@ jobs: test: name: Tests + permissions: + contents: read needs: - lint + - workflow-security-lint runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: go.mod + cache: false - name: Run tests run: go test -v ./... publish: name: Publish the release + permissions: + contents: write if: ${{ github.ref_type == 'tag' }} needs: - test @@ -114,26 +156,29 @@ jobs: QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: go.mod + cache: false - name: Log in to the Container registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 if: github.event_name != 'pull_request' with: registry: quay.io username: ${{ secrets.QUAY_USER }} password: ${{ secrets.QUAY_PASSWORD }} - name: Log in to the Container registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 if: github.event_name != 'pull_request' with: registry: docker.io username: ${{ secrets.DOCKERHUB_USER }} password: ${{ secrets.DOCKERHUB_PASSWORD }} - name: Go releaser publish - uses: goreleaser/goreleaser-action@v5 + uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} @@ -146,10 +191,10 @@ jobs: version: v1.25.1 args: release - name: Write latest version to file - run: mkdir -p dist && echo "${{ env.TAG }}" > dist/LATEST_VERSION + run: mkdir -p dist && printf '%s\n' "${TAG}" > dist/LATEST_VERSION - name: Authenticate with AWS - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} From 510673952acd1137af58e2f330727663ebdc4f13 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Mon, 19 Oct 2026 14:47:44 +0200 Subject: [PATCH 4/4] Use the standard Zizmor action in CI --- .github/workflows/ci.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4a85bb21..68a8c364 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -31,12 +31,12 @@ jobs: persist-credentials: false - name: Audit workflows, composite actions, and Dependabot - env: - GH_TOKEN: ${{ github.token }} - # renovate: datasource=pypi depName=zizmor - ZIZMOR_VERSION: 1.31.1 - run: | - pipx run --spec "zizmor==${ZIZMOR_VERSION}" zizmor --strict-collection --collect=workflows,actions,dependabot . + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 + with: + advanced-security: false + version: 1.31.1 + inputs: . + collect: workflows,actions,dependabot lint: permissions: