Skip to content

Commit a0417ad

Browse files
architectbotactions-user
architectbot
and
actions-user
authored
Align files (#131)
Co-authored-by: github-actions <[email protected]>
1 parent c32a775 commit a0417ad

7 files changed

+140
-16
lines changed

‎.github/workflows/zz_generated.check_values_schema.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
#
33
# devctl
44
#
5-
# https://github.com/giantswarm/devctl/blob/8960b8810d2fdb97543d84baa8b50ffa40da26a9/pkg/gen/input/workflows/internal/file/check_values_schema.yaml.template
5+
# https://github.com/giantswarm/devctl/blob/f2b5cf71dfa175afa70f721eca503072d0e7d4c4/pkg/gen/input/workflows/internal/file/check_values_schema.yaml.template
66
#
77
name: 'Values and schema'
88
on:
@@ -20,7 +20,7 @@ on:
2020
jobs:
2121
check:
2222
name: 'validate values.yaml against values.schema.json'
23-
runs-on: ubuntu-latest
23+
runs-on: ubuntu-24.04
2424
steps:
2525
- name: Checkout
2626
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

‎.github/workflows/zz_generated.create_release.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
#
33
# devctl
44
#
5-
# https://github.com/giantswarm/devctl/blob/8960b8810d2fdb97543d84baa8b50ffa40da26a9/pkg/gen/input/workflows/internal/file/create_release.yaml.template
5+
# https://github.com/giantswarm/devctl/blob/9fedf13cca653e8c1828fdc57294c06273e427d6/pkg/gen/input/workflows/internal/file/create_release.yaml.template
66
#
77
name: Create Release
88
on:
@@ -193,7 +193,7 @@ jobs:
193193
git push "${REMOTE_REPO}" --tags
194194
- name: Create release
195195
id: create_gh_release
196-
uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0
196+
uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1.16.0
197197
env:
198198
GITHUB_TOKEN: "${{ secrets.TAYLORBOT_GITHUB_ACTION }}"
199199
with:

‎.github/workflows/zz_generated.create_release_pr.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
#
33
# devctl
44
#
5-
# https://github.com/giantswarm/devctl/blob/43bd088e6bf64525a8e566fc1b0f4761a293afc4/pkg/gen/input/workflows/internal/file/create_release_pr.yaml.template
5+
# https://github.com/giantswarm/devctl/blob/771e68c7deeda0e8cbd4af23d718a34e708822e4/pkg/gen/input/workflows/internal/file/create_release_pr.yaml.template
66
#
77
name: Create Release PR
88
on:
@@ -146,7 +146,7 @@ jobs:
146146
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
147147
with:
148148
ref: ${{ needs.gather_facts.outputs.branch }}
149-
- uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
149+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
150150
with:
151151
node-version: '20'
152152
- uses: borales/actions-yarn@3766bb1335b98fb13c60eaf358fe20811b730a88 # v5.0.0

‎.github/workflows/zz_generated.fix_vulnerabilities.yaml

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
# DO NOT EDIT. Generated with:
2+
#
3+
# devctl
4+
#
5+
# https://github.com/giantswarm/devctl/blob/4460c761238f42b86238478267338d8e2a74d901/pkg/gen/input/workflows/internal/file/fix_vulnerabilities.yaml.template
6+
#
7+
name: Fix Vulnerabilities
8+
on:
9+
schedule:
10+
- cron: '0 9 * * 1-5'
11+
workflow_dispatch:
12+
inputs:
13+
branch:
14+
description: "Branch on which to fix vulnerabilities"
15+
required: true
16+
type: string
17+
workflow_call:
18+
inputs:
19+
branch:
20+
required: true
21+
type: string
22+
jobs:
23+
gather_facts:
24+
name: Gather facts
25+
runs-on: ubuntu-22.04
26+
outputs:
27+
branch: ${{ steps.gather_facts.outputs.branch }}
28+
skip : ${{ steps.gather_facts.outputs.skip }}
29+
steps:
30+
- name: Checkout code
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
32+
with:
33+
ref: ${{ inputs.branch || github.ref }}
34+
- name: Gather facts
35+
id: gather_facts
36+
run: |
37+
head="${{ inputs.branch || github.ref }}"
38+
branch="${{ github.ref_name }}"
39+
40+
echo "branch=${branch}" >> $GITHUB_OUTPUT
41+
42+
head="${head#refs/heads/}" # Strip "refs/heads/" prefix.
43+
echo "head=${head}" >> $GITHUB_OUTPUT
44+
45+
# Skip if there are no go mod files
46+
if [[ ! -e go.mod ]] && [[ ! -e go.sum ]]; then
47+
skip=true
48+
echo "There are no go mod files in the repo, skipping"
49+
else
50+
skip=false
51+
fi
52+
53+
echo "skip=${skip}" >> $GITHUB_OUTPUT
54+
echo "head=\"$head\" branch=\"$branch\" skip=\"$skip\""
55+
run_nancy_fixer:
56+
name: Fix vulnerabilities with nancy-fixer
57+
runs-on: ubuntu-22.04
58+
needs:
59+
- gather_facts
60+
if: ${{ needs.gather_facts.outputs.skip != 'true' }}
61+
steps:
62+
- name: Generate a token
63+
id: generate_token
64+
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
65+
with:
66+
app-id: ${{ secrets.HERALD_APP_ID }}
67+
private-key: ${{ secrets.HERALD_APP_KEY }}
68+
- name: Checkout code
69+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
70+
with:
71+
token: ${{ steps.generate_token.outputs.token }}
72+
persist-credentials: false
73+
ref: ${{ needs.gather_facts.outputs.branch }}
74+
- name: Create new branch
75+
id: create_branch
76+
run: |
77+
branch="remediate-vulnerabilities-${{ needs.gather_facts.outputs.branch }}"
78+
echo "branch=${branch}" >> $GITHUB_OUTPUT
79+
git checkout -b "${branch}"
80+
git pull origin "${branch}" || true
81+
- name: Run nancy-fixer fix
82+
uses: docker://gsoci.azurecr.io/giantswarm/nancy-fixer:0.4.4
83+
timeout-minutes: 20
84+
- name: Set up git identity
85+
run: |
86+
git config --local user.email "149080493+heraldbot[bot]@users.noreply.github.com"
87+
git config --local user.name "HeraldBot[bot]"
88+
- name: Commit new files
89+
id: commit_changes
90+
run: |
91+
git add -A
92+
if git diff-index --quiet HEAD; then
93+
echo "No changes found"
94+
skip=true
95+
else
96+
git commit -m "Remediate Nancy findings"
97+
skip=false
98+
fi
99+
echo "skip=${skip}" >> $GITHUB_OUTPUT
100+
- name: Push changes
101+
if: "${{ steps.commit_changes.outputs.skip != 'true' }}"
102+
env:
103+
remote_repo: "https://${{ github.actor }}:${{ steps.generate_token.outputs.token }}@github.com/${{ github.repository }}.git"
104+
run: |
105+
git push "${remote_repo}" HEAD:"${{ steps.create_branch.outputs.branch }}"
106+
- name: Create PR
107+
env:
108+
GITHUB_TOKEN: "${{ steps.generate_token.outputs.token }}"
109+
if: "${{ steps.commit_changes.outputs.skip != 'true' }}"
110+
run: |
111+
gh pr create --title "Remediate Nancy findings on ${{ needs.gather_facts.outputs.branch }}" --body "Fix Nancy findings on branch ${{ needs.gather_facts.outputs.branch }}" --head ${{ steps.create_branch.outputs.branch }} --base "${{ needs.gather_facts.outputs.branch }}"
112+
gh pr merge --auto --squash

‎.github/workflows/zz_generated.gitleaks.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@
22
#
33
# devctl
44
#
5-
# https://github.com/giantswarm/devctl/blob/8960b8810d2fdb97543d84baa8b50ffa40da26a9/pkg/gen/input/workflows/internal/file/gitleaks.yaml.template
5+
# https://github.com/giantswarm/devctl/blob/f2b5cf71dfa175afa70f721eca503072d0e7d4c4/pkg/gen/input/workflows/internal/file/gitleaks.yaml.template
66
#
77
name: gitleaks
88

99
on: [pull_request]
1010

1111
jobs:
1212
gitleaks:
13-
runs-on: ubuntu-latest
13+
runs-on: ubuntu-24.04
1414
steps:
1515
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1616
with:

‎.github/workflows/zz_generated.run_ossf_scorecard.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
#
33
# devctl
44
#
5-
# https://github.com/giantswarm/devctl/blob/0a98d52f349ee9221b336515b877cd4a728ea9ca/pkg/gen/input/workflows/internal/file/run_ossf_scorecard.yaml.template
5+
# https://github.com/giantswarm/devctl/blob/f2b5cf71dfa175afa70f721eca503072d0e7d4c4/pkg/gen/input/workflows/internal/file/run_ossf_scorecard.yaml.template
66
#
77

88
# This workflow uses actions that are not certified by GitHub. They are provided
@@ -28,7 +28,7 @@ permissions: read-all
2828
jobs:
2929
analysis:
3030
name: Scorecard analysis
31-
runs-on: ubuntu-latest
31+
runs-on: ubuntu-24.04
3232
permissions:
3333
# Needed to upload the results to code-scanning dashboard.
3434
security-events: write
@@ -45,7 +45,7 @@ jobs:
4545
persist-credentials: false
4646

4747
- name: "Run analysis"
48-
uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
48+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
4949
with:
5050
results_file: results.sarif
5151
results_format: sarif
@@ -67,14 +67,14 @@ jobs:
6767
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6868
# format to the repository Actions tab.
6969
- name: "Upload artifact"
70-
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
70+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7171
with:
7272
name: SARIF file
7373
path: results.sarif
7474
retention-days: 5
7575

7676
# Upload the results to GitHub's code scanning dashboard.
7777
- name: "Upload to code-scanning"
78-
uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
78+
uses: github/codeql-action/upload-sarif@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
7979
with:
8080
sarif_file: results.sarif

‎.pre-commit-config.yaml

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# This file is maintained centrally at
2+
# https://github.com/giantswarm/github/blob/main/languages/go/.pre-commit-config.yaml
3+
14
minimum_pre_commit_version: '2.17'
25
repos:
36
# shell scripts
@@ -6,26 +9,35 @@ repos:
69
hooks:
710
- id: shell-lint
811
args: [ --format=json ]
12+
exclude: ".*\\.template"
913

1014
- repo: https://github.com/pre-commit/pre-commit-hooks
1115
rev: v5.0.0
1216
hooks:
1317
- id: check-added-large-files
14-
# check for unresolved merge conflicts
1518
- id: check-merge-conflict
1619
- id: check-shebang-scripts-are-executable
1720
- id: detect-private-key
1821
- id: end-of-file-fixer
22+
exclude: ".*testdata/.*"
1923
- id: mixed-line-ending
2024
- id: trailing-whitespace
25+
exclude: ".*testdata/.*"
2126

2227
- repo: https://github.com/dnephin/pre-commit-golang
2328
rev: v0.5.1
2429
hooks:
2530
- id: go-fmt
2631
- id: go-mod-tidy
2732
- id: golangci-lint
28-
# timeout is needed for CI
29-
args: [ -E, gosec, -E, goconst, -E, govet, --timeout, 300s ]
33+
args:
34+
- -E=gosec
35+
- -E=goconst
36+
- -E=govet
37+
# timeout is needed for CI
38+
- --timeout=300s
39+
# List all issues found
40+
- --max-same-issues=0
41+
- --max-issues-per-linter=0
3042
- id: go-imports
3143
args: [ -local, github.com/giantswarm/encryption-provider-operator ]

0 commit comments

Comments
 (0)