Skip to content

Commit d0816fa

Browse files
vprashar2929vprashar2929
committed
chore: resolve scorecard checks
Signed-off-by: vprashar2929 <[email protected]>
1 parent 81da201 commit d0816fa

File tree

12 files changed

+95
-28
lines changed

12 files changed

+95
-28
lines changed

‎.github/workflows/assign-labels.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,12 @@ name: Assign Labels
33
on: # yamllint disable-line rule:truthy
44
pull_request_target:
55

6+
# default permissions as read only
7+
permissions: read-all
8+
69
jobs:
710
assign-labels:
811
permissions:
9-
contents: read
1012
pull-requests: write
1113
issues: write
1214
runs-on: ubuntu-latest

‎.github/workflows/check-x-crypto-deps.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,12 @@ name: Check x/crypto
33
on: # yamllint disable-line rule:truthy
44
pull_request:
55

6+
# default permissions as read only
7+
permissions: read-all
8+
69
jobs:
710
check-x-crypto-deps:
811
permissions:
9-
contents: read
1012
pull-requests: write
1113
runs-on: ubuntu-latest
1214
name: Check x/crypto Dependencies in Pull Request

‎.github/workflows/config-change.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ name: Check Config Changes
33
on: # yamllint disable-line rule:truthy
44
pull_request:
55

6+
# default permissions as read only
7+
permissions: read-all
8+
69
jobs:
710
check-changes:
811
runs-on: ubuntu-latest

‎.github/workflows/k8s-bm.yaml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,8 @@ name: Build and Deploy K8s on Self Hosted BM
33
on: # yamllint disable-line rule:truthy
44
pull_request:
55

6-
permissions:
7-
pull-requests: write
8-
contents: write
6+
# default permissions as read only
7+
permissions: read-all
98

109
jobs:
1110
check-changes:

‎.github/workflows/pr-checks.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ name: PR Checks
33
on: # yamllint disable-line rule:truthy
44
pull_request:
55

6+
# default permissions as read only
7+
permissions: read-all
8+
69
jobs:
710
check-changes:
811
runs-on: ubuntu-latest
@@ -97,10 +100,19 @@ jobs:
97100
test-and-codecov:
98101
needs: check-changes
99102
if: needs.check-changes.outputs.changes == 'true'
103+
permissions:
104+
contents: read
100105
uses: ./.github/workflows/test-and-codecov.yaml
101106
secrets:
102107
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
103108

109+
scorecard:
110+
permissions:
111+
contents: read
112+
security-events: write
113+
id-token: write
114+
uses: ./.github/workflows/scorecard.yml
115+
104116
pre-commit:
105117
runs-on: ubuntu-latest
106118
steps:

‎.github/workflows/pr-comment.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,13 @@ on: # yamllint disable-line rule:truthy
1111
types:
1212
- completed
1313

14-
permissions:
15-
pull-requests: write
16-
actions: read
14+
# default permissions as read only
15+
permissions: read-all
1716

1817
jobs:
1918
comment-on-pr:
19+
permissions:
20+
pull-requests: write
2021
runs-on: ubuntu-latest
2122
# Only run if the triggering workflow succeeded
2223
if: github.event.workflow_run.conclusion == 'success'

‎.github/workflows/profiling.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ name: Profiling Report
22
on: # yamllint disable-line rule:truthy
33
pull_request:
44

5+
# default permissions as read only
6+
permissions: read-all
7+
58
jobs:
69
check-changes:
710
runs-on: ubuntu-latest

‎.github/workflows/push.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,22 @@ on: # yamllint disable-line rule:truthy
44
push:
55
branches: [main]
66

7+
# default permissions as read only
8+
permissions: read-all
9+
710
jobs:
811
test-and-codecov:
12+
permissions:
13+
contents: read
914
uses: ./.github/workflows/test-and-codecov.yaml
1015
secrets:
1116
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
1217

13-
# for each PR merge, openSSF scan
1418
scorecard:
19+
permissions:
20+
contents: read
21+
security-events: write
22+
id-token: write
1523
uses: ./.github/workflows/scorecard.yml
1624

1725
publish:

‎.github/workflows/release.yaml‎

Lines changed: 43 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,14 @@ on: # yamllint disable-line rule:truthy
55
tags:
66
- v[0-9]+.[0-9]+.[0-9]+
77

8-
jobs:
9-
release:
10-
permissions:
11-
contents: write
8+
# default permissions as read only
9+
permissions: read-all
1210

11+
jobs:
12+
build:
1313
runs-on: ubuntu-latest
1414
env:
1515
IMG_BASE: quay.io/sustainable_computing_io
16-
1716
steps:
1817
- name: Checkout source
1918
uses: actions/checkout@v5
@@ -90,19 +89,13 @@ jobs:
9089
# Currently the binary is built for linux-amd64 only
9190
tar -czvf bin/kepler-${VERSION}.linux-amd64.tar.gz bin/kepler
9291
93-
- name: Create GitHub Release
94-
uses: softprops/action-gh-release@v2
92+
- name: Upload Release Artifacts
93+
uses: actions/upload-artifact@v4
9594
with:
96-
tag_name: ${{ github.ref_name }}
97-
name: release-${{ steps.version.outputs.version }}
98-
generate_release_notes: true
99-
draft: false
100-
make_latest: true
101-
files: |
95+
name: release-artifacts
96+
path: |
10297
helm-releases/*.tgz
10398
bin/*.tar.gz
104-
env:
105-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
10699
107100
- name: Push Image
108101
shell: bash
@@ -116,3 +109,38 @@ jobs:
116109
# Remove 'v' prefix from version
117110
CHART_VERSION=${VERSION#v}
118111
helm push helm-releases/kepler-helm-${CHART_VERSION}.tgz oci://${{ env.IMG_BASE }}/charts
112+
113+
release:
114+
needs: build
115+
permissions:
116+
# contents: write is required for publishing Github Releases
117+
# This follows Github's recommended pattern: top-level read-all with minimal job-level permissions
118+
# See: https://github.com/softprops/action-gh-release?tab=readme-ov-file#permissions
119+
contents: write
120+
runs-on: ubuntu-latest
121+
steps:
122+
- name: Download Release Artifacts
123+
uses: actions/download-artifact@v4
124+
with:
125+
name: release-artifacts
126+
127+
- name: Extract version
128+
shell: bash
129+
id: version
130+
run: |
131+
TAG_NAME=${{ github.ref_name }}
132+
echo "version=$TAG_NAME" >> "$GITHUB_OUTPUT"
133+
134+
- name: Create GitHub Release
135+
uses: softprops/action-gh-release@v2
136+
with:
137+
tag_name: ${{ github.ref_name }}
138+
name: release-${{ steps.version.outputs.version }}
139+
generate_release_notes: true
140+
draft: false
141+
make_latest: true
142+
files: |
143+
helm-releases/*.tgz
144+
bin/*.tar.gz
145+
env:
146+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/scorecard.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,22 @@ name: Scorecard supply-chain security
66
on: # yamllint disable-line rule:truthy
77
workflow_call:
88

9-
# Declare default permissions as read only.
10-
permissions: read-all
9+
# Restrict permissions for GITHUB_TOKEN by default.
10+
# Each job must explicitly declare what it needs.
11+
permissions: {}
1112

1213
jobs:
1314
analysis:
1415
name: Scorecard analysis
1516
runs-on: ubuntu-latest
1617
permissions:
18+
# Needed to checkout code.
19+
contents: read
1720
# Needed to upload the results to code-scanning dashboard.
1821
security-events: write
1922
# Needed to publish results and get a badge (see publish_results below).
2023
id-token: write
2124
# Uncomment the permissions below if installing in a private repository.
22-
# contents: read
2325
# actions: read
2426

2527
steps:

0 commit comments

Comments
 (0)