From 99a9dd78606e000a3f0c6189a4ee8fcb36b83e6d Mon Sep 17 00:00:00 2001 From: Saul Beck Date: Tue, 18 Aug 2026 08:49:49 +0100 Subject: [PATCH 1/2] CI: Address zizmor warnings and bump deps --- .github/workflows/scan.yaml | 14 ++++++++++---- .github/workflows/scan_release.yml | 18 +++++++++++++----- .github/workflows/scan_single_image.yml | 18 ++++++++++++++---- .github/workflows/upload_sbom_release.yml | 18 +++++++++++++----- 4 files changed, 50 insertions(+), 18 deletions(-) diff --git a/.github/workflows/scan.yaml b/.github/workflows/scan.yaml index d8b0a4e..c94e108 100644 --- a/.github/workflows/scan.yaml +++ b/.github/workflows/scan.yaml @@ -4,20 +4,26 @@ on: schedule: - cron: '30 2 * * *' +permissions: {} + jobs: scan_images: runs-on: ubuntu-latest + permissions: + contents: read steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Init submodules run: git submodule update --init --recursive - name: Set up Cosign - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.11 - name: Setup Rust - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: toolchain: stable - name: Run image diff --git a/.github/workflows/scan_release.yml b/.github/workflows/scan_release.yml index 07c6cca..b382703 100644 --- a/.github/workflows/scan_release.yml +++ b/.github/workflows/scan_release.yml @@ -7,20 +7,26 @@ on: required: true default: '0.0.0-dev' +permissions: {} + jobs: scan_release: runs-on: ubuntu-latest + permissions: + contents: read steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Init submodules run: git submodule update --init --recursive - name: Set up Cosign - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.11 - name: Setup Rust - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: toolchain: stable - name: Run image @@ -35,4 +41,6 @@ jobs: run: poetry install - name: Scan release id: scan - run: poetry run python stack_scanner/main.py scan-release ${{ secrets.SECOBSERVE_API_TOKEN }} ${{ github.event.inputs.release }} + env: + RELEASE: ${{ github.event.inputs.release }} + run: poetry run python stack_scanner/main.py scan-release ${{ secrets.SECOBSERVE_API_TOKEN }} "$RELEASE" diff --git a/.github/workflows/scan_single_image.yml b/.github/workflows/scan_single_image.yml index 45482c3..a47e32f 100644 --- a/.github/workflows/scan_single_image.yml +++ b/.github/workflows/scan_single_image.yml @@ -12,14 +12,20 @@ on: description: "Location of the image (example: oci.stackable.tech/sdp/hbase:2.4.17-stackable24.7.0-amd64). Please use the tag for the image itself (usually one including the CPU architecture) and not the tag for the manifest list, since the tag for the manifest list won't have an SBOM attached." required: true +permissions: {} + jobs: scan_image: runs-on: ubuntu-latest + permissions: + contents: read steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Cosign - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.11 - name: Run image @@ -30,4 +36,8 @@ jobs: run: poetry install - name: Scan image id: scan - run: poetry run python stack_scanner/main.py scan-image ${{ secrets.SECOBSERVE_API_TOKEN }} ${{ github.event.inputs.image }} ${{ github.event.inputs.product_name }} ${{ github.event.inputs.product_version }} \ No newline at end of file + env: + IMAGE: ${{ github.event.inputs.image }} + PRODUCT_NAME: ${{ github.event.inputs.product_name }} + PRODUCT_VERSION: ${{ github.event.inputs.product_version }} + run: poetry run python stack_scanner/main.py scan-image ${{ secrets.SECOBSERVE_API_TOKEN }} "$IMAGE" "$PRODUCT_NAME" "$PRODUCT_VERSION" \ No newline at end of file diff --git a/.github/workflows/upload_sbom_release.yml b/.github/workflows/upload_sbom_release.yml index 4bdebbc..c50a6bb 100644 --- a/.github/workflows/upload_sbom_release.yml +++ b/.github/workflows/upload_sbom_release.yml @@ -7,20 +7,26 @@ on: required: true default: '0.0.0-dev' +permissions: {} + jobs: scan_release: runs-on: ubuntu-latest + permissions: + contents: read steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Init submodules run: git submodule update --init --recursive - name: Set up Cosign - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.11 - name: Setup Rust - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: toolchain: stable - name: Run image @@ -35,4 +41,6 @@ jobs: run: poetry install - name: Upload SBOMs for release id: scan - run: poetry run python stack_scanner/main.py upload-sbom-release ${{ secrets.SECOBSERVE_API_TOKEN }} ${{ github.event.inputs.release }} + env: + RELEASE: ${{ github.event.inputs.release }} + run: poetry run python stack_scanner/main.py upload-sbom-release ${{ secrets.SECOBSERVE_API_TOKEN }} "$RELEASE" From a9e0e68d74d9783dacfa148dc82deb4986cad176 Mon Sep 17 00:00:00 2001 From: Saul Beck Date: Fri, 21 Aug 2026 14:47:42 +0100 Subject: [PATCH 2/2] ci: remove actions-rust-lang action and add new line --- .github/workflows/scan.yaml | 6 ++---- .github/workflows/scan_release.yml | 4 +--- .github/workflows/scan_single_image.yml | 2 +- .github/workflows/upload_sbom_release.yml | 4 +--- 4 files changed, 5 insertions(+), 11 deletions(-) diff --git a/.github/workflows/scan.yaml b/.github/workflows/scan.yaml index c94e108..8657570 100644 --- a/.github/workflows/scan.yaml +++ b/.github/workflows/scan.yaml @@ -23,9 +23,7 @@ jobs: with: python-version: 3.11 - name: Setup Rust - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 - with: - toolchain: stable + run: rustup toolchain install stable --profile minimal - name: Run image uses: abatilo/actions-poetry@3765cf608f2d4a72178a9fc5b918668e542b89b1 # v4.0.0 with: @@ -37,4 +35,4 @@ jobs: - name: Install deps run: poetry install - name: Scan dev plus current and previous release - run: poetry run python stack_scanner/main.py scan-latest ${{ secrets.SECOBSERVE_API_TOKEN }} \ No newline at end of file + run: poetry run python stack_scanner/main.py scan-latest ${{ secrets.SECOBSERVE_API_TOKEN }} diff --git a/.github/workflows/scan_release.yml b/.github/workflows/scan_release.yml index b382703..e2c01a3 100644 --- a/.github/workflows/scan_release.yml +++ b/.github/workflows/scan_release.yml @@ -26,9 +26,7 @@ jobs: with: python-version: 3.11 - name: Setup Rust - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 - with: - toolchain: stable + run: rustup toolchain install stable --profile minimal - name: Run image uses: abatilo/actions-poetry@3765cf608f2d4a72178a9fc5b918668e542b89b1 # v4.0.0 with: diff --git a/.github/workflows/scan_single_image.yml b/.github/workflows/scan_single_image.yml index a47e32f..1557677 100644 --- a/.github/workflows/scan_single_image.yml +++ b/.github/workflows/scan_single_image.yml @@ -40,4 +40,4 @@ jobs: IMAGE: ${{ github.event.inputs.image }} PRODUCT_NAME: ${{ github.event.inputs.product_name }} PRODUCT_VERSION: ${{ github.event.inputs.product_version }} - run: poetry run python stack_scanner/main.py scan-image ${{ secrets.SECOBSERVE_API_TOKEN }} "$IMAGE" "$PRODUCT_NAME" "$PRODUCT_VERSION" \ No newline at end of file + run: poetry run python stack_scanner/main.py scan-image ${{ secrets.SECOBSERVE_API_TOKEN }} "$IMAGE" "$PRODUCT_NAME" "$PRODUCT_VERSION" diff --git a/.github/workflows/upload_sbom_release.yml b/.github/workflows/upload_sbom_release.yml index c50a6bb..7a61185 100644 --- a/.github/workflows/upload_sbom_release.yml +++ b/.github/workflows/upload_sbom_release.yml @@ -26,9 +26,7 @@ jobs: with: python-version: 3.11 - name: Setup Rust - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 - with: - toolchain: stable + run: rustup toolchain install stable --profile minimal - name: Run image uses: abatilo/actions-poetry@3765cf608f2d4a72178a9fc5b918668e542b89b1 # v4.0.0 with: