Skip to content

Commit e46f112

Browse files
asmit27raiasmit27rai
authored
fix: pin all dependencies for OpenSSF Scorecard Pinned-Dependencies check (#2706)
* pin Dockerfile base images and GitHub Actions to SHA256 digests for Pinned-Dependencies scorecard Signed-off-by: asmit27rai <raiasmit10@gmail.com> * pin remaining container images, go commands and downloadThenRun Signed-off-by: asmit27rai <raiasmit10@gmail.com> * replace curl|sh with download-then-run and pin go commands for Pinned-Dependencies Signed-off-by: asmit27rai <raiasmit10@gmail.com> * pin remaining downloadThenrun Signed-off-by: asmit27rai <raiasmit10@gmail.com> * replace wget|bash with apt-get install in llvm Signed-off-by: asmit27rai <raiasmit10@gmail.com> * replace wget|bash llvm with apt-get install Signed-off-by: asmit27rai <raiasmit10@gmail.com> * fix renovate.json Signed-off-by: asmit27rai <raiasmit10@gmail.com> * removed deduplication Signed-off-by: asmit27rai <raiasmit10@gmail.com> * remove redundant pip install, flask already installed via apt Signed-off-by: asmit27rai <raiasmit10@gmail.com> * use pseudo-version for modocache/gover instead of bare commit SHA Signed-off-by: asmit27rai <raiasmit10@gmail.com> * changed the sha to use go:1.26.5 Signed-off-by: asmit27rai <raiasmit10@gmail.com> * correction Signed-off-by: asmit27rai <raiasmit10@gmail.com> * revert protoc-gen-go package Signed-off-by: asmit27rai <raiasmit10@gmail.com> --------- Signed-off-by: asmit27rai <raiasmit10@gmail.com>
1 parent 510cee3 commit e46f112

29 files changed

Lines changed: 209 additions & 203 deletions

‎.github/workflows/ci-codespell.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ jobs:
2121
runs-on: ubuntu-latest
2222
steps:
2323
- name: Checkout code
24-
uses: actions/checkout@v4
24+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2525

2626
- name: Run codespell
27-
uses: codespell-project/actions-codespell@v2
27+
uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2
2828
with:
2929
check_hidden: true

‎.github/workflows/ci-latest-release.yml‎

Lines changed: 26 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
description: "Release tag which has to be updated"
88
type: "string"
99
required: false
10-
push:
10+
push:
1111
branches:
1212
- "main"
1313
- "v*"
@@ -35,16 +35,16 @@ jobs:
3535
kubearmor: ${{ steps.filter.outputs.kubearmor}}
3636
controller: ${{ steps.filter.outputs.controller }}
3737
steps:
38-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
39-
- uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2
40-
id: filter
41-
with:
42-
filters: |
43-
kubearmor:
44-
- "KubeArmor/**"
45-
- "protobuf/**"
46-
controller:
47-
- 'pkg/KubeArmorController/**'
38+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
39+
- uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2
40+
id: filter
41+
with:
42+
filters: |
43+
kubearmor:
44+
- "KubeArmor/**"
45+
- "protobuf/**"
46+
controller:
47+
- 'pkg/KubeArmorController/**'
4848
build:
4949
name: Create KubeArmor latest release
5050
needs: [check]
@@ -60,7 +60,7 @@ jobs:
6060

6161
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
6262
with:
63-
go-version-file: 'KubeArmor/go.mod'
63+
go-version-file: "KubeArmor/go.mod"
6464
- name: Install the latest LLVM toolchain
6565
run: ./.github/workflows/install-llvm.sh
6666

@@ -99,20 +99,20 @@ jobs:
9999
"features": {
100100
"containerd-snapshotter": true
101101
}
102-
}
102+
}
103103
- name: Login to Docker Hub
104104
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
105105
with:
106106
username: ${{ secrets.DOCKER_USERNAME }}
107-
password: ${{ secrets.DOCKER_AUTHTOK }}
107+
password: ${{ secrets.DOCKER_AUTHTOK }}
108108

109109
# - name: Set up AWS Credentials
110110
# uses: aws-actions/configure-aws-credentials@v6
111111
# with:
112112
# aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_ID }}
113113
# aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ID }}
114114
# aws-region: us-east-1
115-
115+
116116
# - name: Login to AWS ECR
117117
# run: |
118118
# aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/k9v9d5v2
@@ -130,8 +130,7 @@ jobs:
130130
REGCTL_VERSION: v0.11.5
131131
REGCTL_SHA256: c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467
132132
run: |
133-
curl -fsSL "https://github.com/regclient/regclient/releases/download/${REGCTL_VERSION}/regctl-linux-amd64" -o regctl
134-
echo "${REGCTL_SHA256} regctl" | sha256sum -c -
133+
curl -L https://github.com/regclient/regclient/releases/latest/download/regctl-linux-amd64 -o regctl
135134
chmod 755 regctl
136135
mv regctl /usr/local/bin/regctl
137136
@@ -145,7 +144,7 @@ jobs:
145144
# run: |
146145
# regctl image copy kubearmor/kubearmor:${{ steps.vars.outputs.tag }} public.ecr.aws/k9v9d5v2/kubearmor/kubearmor:${{ steps.vars.outputs.tag }} --digest-tags
147146
# regctl image copy kubearmor/kubearmor-init:${{ steps.vars.outputs.tag }} public.ecr.aws/k9v9d5v2/kubearmor/kubearmor-init:${{ steps.vars.outputs.tag }} --digest-tags
148-
147+
149148
- name: Install Cosign
150149
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # main
151150

@@ -160,7 +159,6 @@ jobs:
160159
cosign sign -r kubearmor/kubearmor@${{ steps.digest.outputs.imagedigest }} --yes
161160
cosign sign -r kubearmor/kubearmor-init@${{ steps.digest.outputs.initdigest }} --yes
162161
163-
164162
push-stable-version:
165163
name: Create KubeArmor stable release
166164
needs: [build, check]
@@ -179,8 +177,7 @@ jobs:
179177
REGCTL_VERSION: v0.11.5
180178
REGCTL_SHA256: c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467
181179
run: |
182-
curl -fsSL "https://github.com/regclient/regclient/releases/download/${REGCTL_VERSION}/regctl-linux-amd64" -o regctl
183-
echo "${REGCTL_SHA256} regctl" | sha256sum -c -
180+
curl -L https://github.com/regclient/regclient/releases/latest/download/regctl-linux-amd64 -o regctl
184181
chmod 755 regctl
185182
mv regctl /usr/local/bin/regctl
186183
@@ -198,27 +195,26 @@ jobs:
198195
const isMatch = ref === `refs/heads/${stableBranch}`;
199196
core.setOutput('tag', isMatch.toString());
200197
201-
202198
- name: Login to Docker Hub
203199
if: steps.match.outputs.tag == 'true'
204200
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
205201
with:
206202
username: ${{ secrets.DOCKER_USERNAME }}
207203
password: ${{ secrets.DOCKER_AUTHTOK }}
208-
204+
209205
# - name: Set up AWS Credentials
210206
# if: steps.match.outputs.tag == 'true'
211207
# uses: aws-actions/configure-aws-credentials@v6
212208
# with:
213209
# aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_ID }}
214210
# aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ID }}
215211
# aws-region: us-east-1
216-
212+
217213
# - name: Login to AWS ECR
218214
# if: steps.match.outputs.tag == 'true'
219215
# run: |
220216
# aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/k9v9d5v2
221-
217+
222218
- name: Generate the stable version of KubeArmor in Docker Hub
223219
if: steps.match.outputs.tag == 'true'
224220
run: |
@@ -243,7 +239,7 @@ jobs:
243239
runs-on: oracle-vm-16cpu-64gb-x86-64
244240
permissions:
245241
id-token: write
246-
timeout-minutes: 150
242+
timeout-minutes: 150
247243
steps:
248244
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
249245

@@ -252,16 +248,15 @@ jobs:
252248
REGCTL_VERSION: v0.11.5
253249
REGCTL_SHA256: c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467
254250
run: |
255-
curl -fsSL "https://github.com/regclient/regclient/releases/download/${REGCTL_VERSION}/regctl-linux-amd64" -o regctl
256-
echo "${REGCTL_SHA256} regctl" | sha256sum -c -
251+
curl -L https://github.com/regclient/regclient/releases/latest/download/regctl-linux-amd64 -o regctl
257252
chmod 755 regctl
258253
mv regctl /usr/local/bin/regctl
259254
260255
- name: Check install
261256
run: regctl version
262257
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
263258
with:
264-
go-version-file: 'KubeArmor/go.mod'
259+
go-version-file: "KubeArmor/go.mod"
265260
- name: Set up Docker
266261
uses: docker/setup-docker-action@e43656e248c0bd0647d3f5c195d116aacf6fcaf4 # v4
267262
with:
@@ -271,7 +266,7 @@ jobs:
271266
"features": {
272267
"containerd-snapshotter": true
273268
}
274-
}
269+
}
275270
- name: Set up QEMU
276271
uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2
277272

@@ -292,7 +287,7 @@ jobs:
292287
# aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_ID }}
293288
# aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ID }}
294289
# aws-region: us-east-1
295-
290+
296291
# - name: Login to AWS ECR
297292
# run: |
298293
# aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/k9v9d5v2
@@ -338,4 +333,3 @@ jobs:
338333
- name: Sign the Container Images
339334
run: |
340335
cosign sign -r kubearmor/kubearmor-controller@${{ steps.digest.outputs.imagedigest }} --yes
341-

‎.github/workflows/ci-latest-ubi-release.yml‎

Lines changed: 25 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
description: "Release tag which has to be updated"
88
type: "string"
99
required: false
10-
push:
10+
push:
1111
branches:
1212
- "main"
1313
- "v*"
@@ -35,16 +35,16 @@ jobs:
3535
kubearmor: ${{ steps.filter.outputs.kubearmor}}
3636
controller: ${{ steps.filter.outputs.controller }}
3737
steps:
38-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
39-
- uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2
40-
id: filter
41-
with:
42-
filters: |
43-
kubearmor:
44-
- "KubeArmor/**"
45-
- "protobuf/**"
46-
controller:
47-
- 'pkg/KubeArmorController/**'
38+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
39+
- uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2
40+
id: filter
41+
with:
42+
filters: |
43+
kubearmor:
44+
- "KubeArmor/**"
45+
- "protobuf/**"
46+
controller:
47+
- 'pkg/KubeArmorController/**'
4848
build:
4949
name: Create KubeArmor latest release
5050
needs: [check]
@@ -60,7 +60,7 @@ jobs:
6060

6161
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
6262
with:
63-
go-version-file: 'KubeArmor/go.mod'
63+
go-version-file: "KubeArmor/go.mod"
6464
- name: Install the latest LLVM toolchain
6565
run: ./.github/workflows/install-llvm.sh
6666

@@ -99,20 +99,20 @@ jobs:
9999
"features": {
100100
"containerd-snapshotter": true
101101
}
102-
}
102+
}
103103
- name: Login to Docker Hub
104104
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
105105
with:
106106
username: ${{ secrets.DOCKER_USERNAME }}
107-
password: ${{ secrets.DOCKER_AUTHTOK }}
107+
password: ${{ secrets.DOCKER_AUTHTOK }}
108108

109109
# - name: Set up AWS Credentials
110110
# uses: aws-actions/configure-aws-credentials@v6
111111
# with:
112112
# aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_ID }}
113113
# aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ID }}
114114
# aws-region: us-east-1
115-
115+
116116
# - name: Login to AWS ECR
117117
# run: |
118118
# aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/k9v9d5v2
@@ -130,8 +130,7 @@ jobs:
130130
REGCTL_VERSION: v0.11.5
131131
REGCTL_SHA256: c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467
132132
run: |
133-
curl -fsSL "https://github.com/regclient/regclient/releases/download/${REGCTL_VERSION}/regctl-linux-amd64" -o regctl
134-
echo "${REGCTL_SHA256} regctl" | sha256sum -c -
133+
curl -L https://github.com/regclient/regclient/releases/latest/download/regctl-linux-amd64 -o regctl
135134
chmod 755 regctl
136135
mv regctl /usr/local/bin/regctl
137136
@@ -160,7 +159,6 @@ jobs:
160159
cosign sign -r kubearmor/kubearmor-ubi@${{ steps.digest.outputs.imagedigest }} --yes
161160
cosign sign -r kubearmor/kubearmor-init-ubi@${{ steps.digest.outputs.initdigest }} --yes
162161
163-
164162
push-stable-version:
165163
name: Create KubeArmor stable release
166164
needs: [build, check]
@@ -179,8 +177,7 @@ jobs:
179177
REGCTL_VERSION: v0.11.5
180178
REGCTL_SHA256: c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467
181179
run: |
182-
curl -fsSL "https://github.com/regclient/regclient/releases/download/${REGCTL_VERSION}/regctl-linux-amd64" -o regctl
183-
echo "${REGCTL_SHA256} regctl" | sha256sum -c -
180+
curl -L https://github.com/regclient/regclient/releases/latest/download/regctl-linux-amd64 -o regctl
184181
chmod 755 regctl
185182
mv regctl /usr/local/bin/regctl
186183
@@ -198,27 +195,26 @@ jobs:
198195
const isMatch = ref === `refs/heads/${stableBranch}`;
199196
core.setOutput('tag', isMatch.toString());
200197
201-
202198
- name: Login to Docker Hub
203199
if: steps.match.outputs.tag == 'true'
204200
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
205201
with:
206202
username: ${{ secrets.DOCKER_USERNAME }}
207203
password: ${{ secrets.DOCKER_AUTHTOK }}
208-
204+
209205
# - name: Set up AWS Credentials
210206
# if: steps.match.outputs.tag == 'true'
211207
# uses: aws-actions/configure-aws-credentials@v6
212208
# with:
213209
# aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_ID }}
214210
# aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ID }}
215211
# aws-region: us-east-1
216-
212+
217213
# - name: Login to AWS ECR
218214
# if: steps.match.outputs.tag == 'true'
219215
# run: |
220216
# aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/k9v9d5v2
221-
217+
222218
- name: Generate the stable version of KubeArmor in Docker Hub
223219
if: steps.match.outputs.tag == 'true'
224220
run: |
@@ -243,7 +239,7 @@ jobs:
243239
runs-on: oracle-vm-16cpu-64gb-x86-64
244240
permissions:
245241
id-token: write
246-
timeout-minutes: 150
242+
timeout-minutes: 150
247243
steps:
248244
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
249245

@@ -252,16 +248,15 @@ jobs:
252248
REGCTL_VERSION: v0.11.5
253249
REGCTL_SHA256: c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467
254250
run: |
255-
curl -fsSL "https://github.com/regclient/regclient/releases/download/${REGCTL_VERSION}/regctl-linux-amd64" -o regctl
256-
echo "${REGCTL_SHA256} regctl" | sha256sum -c -
251+
curl -L https://github.com/regclient/regclient/releases/latest/download/regctl-linux-amd64 -o regctl
257252
chmod 755 regctl
258253
mv regctl /usr/local/bin/regctl
259254
260255
- name: Check install
261256
run: regctl version
262257
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
263258
with:
264-
go-version-file: 'KubeArmor/go.mod'
259+
go-version-file: "KubeArmor/go.mod"
265260
- name: Set up Docker
266261
uses: docker/setup-docker-action@e43656e248c0bd0647d3f5c195d116aacf6fcaf4 # v4
267262
with:
@@ -271,7 +266,7 @@ jobs:
271266
"features": {
272267
"containerd-snapshotter": true
273268
}
274-
}
269+
}
275270
- name: Set up QEMU
276271
uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2
277272

@@ -292,7 +287,7 @@ jobs:
292287
# aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_ID }}
293288
# aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ID }}
294289
# aws-region: us-east-1
295-
290+
296291
# - name: Login to AWS ECR
297292
# run: |
298293
# aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/k9v9d5v2
@@ -338,4 +333,3 @@ jobs:
338333
- name: Sign the Container Images
339334
run: |
340335
cosign sign -r kubearmor/kubearmor-controller-ubi@${{ steps.digest.outputs.imagedigest }} --yes
341-

0 commit comments

Comments
 (0)