diff --git a/.github/workflows/auto-approve-bot-prs.yml b/.github/workflows/auto-approve-bot-prs.yml new file mode 100644 index 00000000..ea05eafd --- /dev/null +++ b/.github/workflows/auto-approve-bot-prs.yml @@ -0,0 +1,26 @@ +name: Renovate Auto-Approve + +on: + schedule: + - cron: "7 * * * *" + workflow_dispatch: + +permissions: {} + +concurrency: + group: renovate-auto-approve + +jobs: + approve: + if: github.ref == 'refs/heads/master' && vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID != '' + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: read + pull-requests: read + steps: + - name: Approve verified Renovate PRs + uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@c5f974f5b7b1951c12daaa63b607d9eecc2574d3 # main + with: + app-client-id: ${{ vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID }} + app-private-key: ${{ secrets.RENOVATE_APPROVAL_GH_APP_PRIVATE_KEY }} diff --git a/.github/workflows/beest-verification.yml b/.github/workflows/beest-verification.yml index 671a4075..f681254d 100644 --- a/.github/workflows/beest-verification.yml +++ b/.github/workflows/beest-verification.yml @@ -47,7 +47,7 @@ jobs: steps: - name: Mint GitHub App token (dispatch beest workflows) id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ vars.BEEST_GH_APP_CLIENT_ID }} private-key: ${{ secrets.BEEST_GH_APP_PRIVATE_KEY }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 29019bf0..405c65f8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,6 +17,26 @@ env: IMAGE: quay.io/stackstate/stackstate-k8s-process-agent jobs: + workflow-security-lint: + name: Workflow security lint (Zizmor) + runs-on: ubuntu-24.04 + timeout-minutes: 10 + permissions: + contents: read + steps: + - name: Check out repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Audit workflows, composite actions, and Dependabot + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 + with: + advanced-security: false + version: 1.31.1 + inputs: . + collect: workflows,actions,dependabot + build-and-test: name: Prebuild, generated-code check, build, and unit tests (${{ matrix.arch }}) runs-on: ${{ matrix.runner }} @@ -29,13 +49,13 @@ jobs: - arch: amd64 runner: ubuntu-24.04 llvm-arch: x86_64 - prebuild-image: quay.io/stackstate/datadog_build_system-probe_x64:61b4ad67 - builder-image: quay.io/stackstate/datadog_build_deb_x64:61b4ad67 + prebuild-image: quay.io/stackstate/datadog_build_system-probe_x64:main@sha256:99e15e84fee2a8cc182ccb478dabed47a55571896165ec92e642eed62ebea553 + builder-image: quay.io/stackstate/datadog_build_deb_x64:main@sha256:9208772fc8f640634eef8a1cb5799c6129a3d1f730ce96884fd0a27224fdddf3 - arch: arm64 runner: ubuntu-24.04-arm llvm-arch: arm64 - prebuild-image: quay.io/stackstate/datadog_build_system-probe_arm64:61b4ad67 - builder-image: quay.io/stackstate/datadog_build_deb_arm64:61b4ad67 + prebuild-image: quay.io/stackstate/datadog_build_system-probe_arm64:main@sha256:794ebded2c35f9ad725b5381591a8da14162fbda64f8e23ad47a0dff0aef2644 + builder-image: quay.io/stackstate/datadog_build_deb_arm64:main@sha256:ad9102e44c436a0a503a4275b2e15d061cf8723f754f439591b85fb2217f2593 steps: - name: Check out source commit uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -203,7 +223,9 @@ jobs: publish-image: name: Publish and sign commit image (${{ matrix.arch }}) - needs: image-smoke-and-scan + needs: + - workflow-security-lint + - image-smoke-and-scan if: >- (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || @@ -260,7 +282,7 @@ jobs: description: Process agent collecting per-process and per-container telemetry for SUSE Observability. component: stackstate-k8s-process-agent dockerfile: BCI.dockerfile - base-name: registry.suse.com/bci/bci-micro:15.7 + base-name: registry.suse.com/bci/bci-micro:15.7-61.16@sha256:62a5e3d2574139c4334217e2f342960e3c03ac8b8c7a956504829e4cd79d9e97 - name: Build, publish, and sign architecture image uses: StackVista/image-pipeline/.github/actions/push-single-arch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63 @@ -314,6 +336,7 @@ jobs: ci-success: name: Process-agent CI needs: + - workflow-security-lint - build-and-test - image-smoke-and-scan - publish-image @@ -346,7 +369,7 @@ jobs: failure() && github.ref == 'refs/heads/master' && github.event_name == 'push' - uses: ./.github/workflows/cerberus-notify.yml + uses: $/.github/workflows/cerberus-notify.yml with: suite: build secrets: diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml new file mode 100644 index 00000000..f99da021 --- /dev/null +++ b/.github/workflows/renovate.yml @@ -0,0 +1,19 @@ +name: Renovate + +on: + schedule: + - cron: "0 1,8 * * *" + workflow_dispatch: + +permissions: + contents: read + +jobs: + renovate: + uses: StackVista/renovate-config/.github/workflows/renovate.yml@c5f974f5b7b1951c12daaa63b607d9eecc2574d3 # main + with: + docker_registry_1: quay.io + docker_registry_1_username: ${{ vars.QUAY_USER }} + secrets: + RENOVATE_GH_APP_PRIVATE_KEY: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }} + DOCKER_REGISTRY_1_PASSWORD: ${{ secrets.QUAY_PASSWORD }} diff --git a/.github/workflows/update-datadog-dependency.yml b/.github/workflows/update-datadog-dependency.yml index 8e55809e..6a733919 100644 --- a/.github/workflows/update-datadog-dependency.yml +++ b/.github/workflows/update-datadog-dependency.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Create updatecli GitHub App token id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ vars.UPDATECLI_GH_APP_CLIENT_ID }} private-key: ${{ secrets.UPDATECLI_GH_APP_PRIVATE_KEY }} diff --git a/BCI.dockerfile b/BCI.dockerfile index 994f8b97..67d6f3e9 100644 --- a/BCI.dockerfile +++ b/BCI.dockerfile @@ -1,11 +1,11 @@ -FROM registry.suse.com/bci/bci-micro:15.7 AS final +FROM registry.suse.com/bci/bci-micro:15.7-61.16@sha256:62a5e3d2574139c4334217e2f342960e3c03ac8b8c7a956504829e4cd79d9e97 AS final ARG LONG_ARCH="x86_64" ARG SHORT_ARCH="amd64" ARG EBPF_SUBFOLDER="x86_64" RUN : # No-op command to create an explicit layer - this fixes a weird buildkit/buildx bug on macos arm # Temporary build stage image -FROM registry.suse.com/bci/bci-base:15.7 AS chroot-builder +FROM registry.suse.com/bci/bci-base:15.7-5.23.49@sha256:b9d19a145a6a7832291fcaf354c61b9d229e38dc4b47ea90e885d9dc02079beb AS chroot-builder # Install system packages using builder image that has zypper COPY --from=final / /chroot/ diff --git a/README.md b/README.md index 9f49e7b5..2f3c84f9 100644 --- a/README.md +++ b/README.md @@ -7,6 +7,8 @@ ## Build the process agent +Renovate excludes Datadog dependencies, including their forks and build images, even for security fixes. Updatecli owns their controlled updates. + If you want to use a custom version of `datadog-agent-upstream-for-process-agent` use the following script before invoking the build command. ```bash diff --git a/renovate.json b/renovate.json new file mode 100644 index 00000000..6b9799e5 --- /dev/null +++ b/renovate.json @@ -0,0 +1,28 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "github>StackVista/renovate-config#f5d8a69a238645b13ddedc25457daced35834d98", + "github>StackVista/renovate-config:go", + "github>StackVista/renovate-config:docker", + "github>StackVista/renovate-config:automerge" + ], + "packageRules": [ + { + "matchDepNames": [ + "/datadog/i", + "github.com/StackVista/sketches-go" + ], + "enabled": false + } + ], + "customManagers": [ + { + "customType": "regex", + "managerFilePatterns": ["/^\\.github/workflows/ci\\.yml$/"], + "matchStrings": [ + "(?(?:quay\\.io/stackstate/datadog_build_(?:system-probe|deb)_(?:x64|arm64)|registry\\.suse\\.com/bci/bci-micro)):(?[^\\s@]+)@(?sha256:[a-f0-9]{64})" + ], + "datasourceTemplate": "docker" + } + ] +}