diff --git a/.github/workflows/gpg-sign-artifacts.yml b/.github/workflows/gpg-sign-artifacts.yml index 19cc070..55ffcc1 100644 --- a/.github/workflows/gpg-sign-artifacts.yml +++ b/.github/workflows/gpg-sign-artifacts.yml @@ -46,14 +46,14 @@ jobs: fetch-depth: 0 - name: Check for repo key expiry - uses: OpenCHAMI/github-actions/actions/gpg-check-key-expiration@v3.5 + uses: OpenCHAMI/github-actions/actions/gpg-check-key-expiration@v3.7 with: repo-key-armored-b64: ${{ secrets.GPG_REPO_KEY_B64 }} warn-days: '30' - name: Configure GPG release keys id: gpg - uses: OpenCHAMI/github-actions/actions/gpg-configure-release-keys@v3.5 + uses: OpenCHAMI/github-actions/actions/gpg-configure-release-keys@v3.7 with: repo-cert-key-armored-b64: ${{ secrets.GPG_REPO_CERT_KEY_B64 }} master-public-key-asc: ${{ secrets.MASTER_PUBLIC_ASC }} @@ -71,14 +71,14 @@ jobs: - name: Sign rpms id: rpmsign - uses: OpenCHAMI/github-actions/actions/gpg-sign-rpm@v3.5 + uses: OpenCHAMI/github-actions/actions/gpg-sign-rpm@v3.7 with: resign: true gnupg-home: ${{ steps.gpg.outputs.gnupg-home }} gpg-fingerprint: ${{ steps.gpg.outputs.ephemeral-fingerprint }} - name: Verify trust chain - uses: OpenCHAMI/github-actions/actions/gpg-verify-trust-chain@v3.5 + uses: OpenCHAMI/github-actions/actions/gpg-verify-trust-chain@v3.7 with: master-public-key: ${{ secrets.MASTER_PUBLIC_ASC }} require-master: true diff --git a/README.md b/README.md index 8ace4ea..007e03d 100644 --- a/README.md +++ b/README.md @@ -34,13 +34,13 @@ Use major version tags for stability: ```yaml # For actions -- uses: OpenCHAMI/github-actions/actions/gpg-configure-release-keys@v1 -- uses: OpenCHAMI/github-actions/actions/gpg-sign-rpm@v1 +- uses: OpenCHAMI/github-actions/actions/gpg-configure-release-keys@v3.8 +- uses: OpenCHAMI/github-actions/actions/gpg-sign-rpm@v3.8 # For reusable workflows jobs: release: - uses: OpenCHAMI/github-actions/.github/workflows/go-build-release.yml@v3.3 + uses: OpenCHAMI/github-actions/.github/workflows/go-build-release.yml@v3.8 ``` Pin a commit SHA internally for maximum supply-chain safety if desired. @@ -71,7 +71,7 @@ on: jobs: goreleaser: name: GoReleaser ${{ startsWith(github.ref, 'refs/tags/v') && 'Release' || 'Snapshot' }} - uses: OpenCHAMI/github-actions/.github/workflows/go-build-release.yml@v3.3 + uses: OpenCHAMI/github-actions/.github/workflows/go-build-release.yml@v3.8 with: pre-build-commands: | go install github.com/swaggo/swag/cmd/swag@latest @@ -98,7 +98,7 @@ on: jobs: lint: - uses: OpenCHAMI/github-actions/.github/workflows/lint-workflows.yml@v3.4 + uses: OpenCHAMI/github-actions/.github/workflows/lint-workflows.yml@v3.8 ``` ### govulncheck (Reusable Workflow) @@ -116,7 +116,7 @@ on: jobs: govulncheck: - uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@v3.4 + uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@v3.8 ``` ### dependency-review (Reusable Workflow) @@ -130,7 +130,7 @@ on: jobs: dependency-review: - uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@v3.4 + uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@v3.8 # Optional overrides: # with: # fail-on-severity: moderate @@ -144,13 +144,13 @@ Scans an already-pushed container image with Trivy and uploads SARIF findings to ```yaml jobs: build: - uses: OpenCHAMI/github-actions/.github/workflows/docker-build-release.yml@v3.4 + uses: OpenCHAMI/github-actions/.github/workflows/docker-build-release.yml@v3.8 with: registry-name: ghcr.io/openchami/foo scan: needs: build - uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@v3.4 + uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@v3.8 with: image-ref: ghcr.io/openchami/foo:${{ github.sha }} ``` @@ -162,7 +162,7 @@ Builds and publishes a container image via GoReleaser, with multi-arch builds, b ```yaml jobs: build: - uses: OpenCHAMI/github-actions/.github/workflows/build-publish-container-goreleaser.yml@v3.5 + uses: OpenCHAMI/github-actions/.github/workflows/build-publish-container-goreleaser.yml@v3.8 with: registry_subject_name: ghcr.io/openchami/foo release_draft: false @@ -175,7 +175,7 @@ Builds the caller repo's podman quadlet RPM and uploads it as an unsigned artifa ```yaml jobs: build: - uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@v3.5 + uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@v3.8 ``` ### gpg-sign-artifacts (Reusable Workflow) @@ -185,7 +185,7 @@ Signs unsigned RPM artifacts with a per-run ephemeral key certified through the ```yaml jobs: sign: - uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@v3.5 + uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@v3.8 secrets: inherit ``` @@ -196,7 +196,7 @@ Validates a signed quadlet RPM's installed file list against the set of files th ```yaml jobs: validate: - uses: OpenCHAMI/github-actions/.github/workflows/validate-rpm-quadlet.yml@v3.5 + uses: OpenCHAMI/github-actions/.github/workflows/validate-rpm-quadlet.yml@v3.8 with: rpms: | - name: foo-*.rpm @@ -211,7 +211,7 @@ Publishes a GitHub Release for a tag, attaching signed RPMs and public keys, wit ```yaml jobs: release: - uses: OpenCHAMI/github-actions/.github/workflows/release-signed-artifacts.yml@v3.5 + uses: OpenCHAMI/github-actions/.github/workflows/release-signed-artifacts.yml@v3.8 with: release_draft: false ``` @@ -224,7 +224,7 @@ Publishes the draft GitHub Release for a tag, for pipelines that set `release_dr jobs: publish: needs: release - uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@v3.9 + uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@v3.8 ``` ### pr-registry-cleanup (Reusable Workflow) @@ -239,7 +239,7 @@ on: jobs: cleanup: - uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@v3.7 + uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@v3.8 permissions: packages: write ``` @@ -310,7 +310,7 @@ jobs: } >> "$GITHUB_OUTPUT" build: - uses: OpenCHAMI/github-actions/.github/workflows/build-publish-container-goreleaser.yml@v3.5 + uses: OpenCHAMI/github-actions/.github/workflows/build-publish-container-goreleaser.yml@v3.8 secrets: inherit with: cgo_enabled: 0 @@ -320,14 +320,14 @@ jobs: rpmbuild: needs: [config, build] - uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@v3.5 + uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@v3.8 secrets: inherit with: artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }} rpmsign: needs: [config, rpmbuild] - uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@v3.5 + uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@v3.8 secrets: inherit with: artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }} @@ -336,7 +336,7 @@ jobs: rpmvalidate: needs: [config, rpmsign] - uses: OpenCHAMI/github-actions/.github/workflows/validate-rpm-quadlet.yml@v3.5 + uses: OpenCHAMI/github-actions/.github/workflows/validate-rpm-quadlet.yml@v3.8 secrets: inherit with: artifact-name-signed-rpms: ${{ needs.config.outputs.rpm-signed }}