From 79c9e9348fdde70c3de209d744207643e35e05a5 Mon Sep 17 00:00:00 2001 From: Joe Harvey <51208233+jharvey10@users.noreply.github.com> Date: Mon, 26 May 2025 11:38:09 -0400 Subject: [PATCH] ci: address zizmor gh action vulnerabilities (#16530) * ci: address zizmor gh action vulnerabilities --------- Signed-off-by: Joe Harvey <51208233+jharvey10@users.noreply.github.com> Signed-off-by: Arve Knudsen Co-authored-by: Arve Knudsen Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- .github/workflows/buf-lint.yml | 2 ++ .github/workflows/buf.yml | 2 ++ .github/workflows/ci.yml | 36 ++++++++++++++++++++- .github/workflows/codeql-analysis.yml | 2 ++ .github/workflows/container_description.yml | 4 +++ .github/workflows/fuzzing.yml | 6 ++-- .github/workflows/prombench.yml | 2 ++ .github/workflows/repo_sync.yml | 2 ++ 8 files changed, 53 insertions(+), 3 deletions(-) diff --git a/.github/workflows/buf-lint.yml b/.github/workflows/buf-lint.yml index d7adc93cf6..4e942f1f3b 100644 --- a/.github/workflows/buf-lint.yml +++ b/.github/workflows/buf-lint.yml @@ -13,6 +13,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/buf.yml b/.github/workflows/buf.yml index 3384b4aa2f..add72cc89c 100644 --- a/.github/workflows/buf.yml +++ b/.github/workflows/buf.yml @@ -13,6 +13,8 @@ jobs: if: github.repository_owner == 'prometheus' steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 26c6add180..d1ed2c56eb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,9 @@ on: pull_request: push: +permissions: + contents: read + jobs: test_go: name: Go tests @@ -14,6 +17,8 @@ jobs: image: quay.io/prometheus/golang-builder:1.24-base steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: prometheus/promci@443c7fc2397e946bc9f5029e313a9c3441b9b86d # v0.4.7 - uses: ./.github/promci/actions/setup_environment with: @@ -30,6 +35,8 @@ jobs: image: quay.io/prometheus/golang-builder:1.24-base steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: prometheus/promci@443c7fc2397e946bc9f5029e313a9c3441b9b86d # v0.4.7 - uses: ./.github/promci/actions/setup_environment - run: go test --tags=dedupelabels ./... @@ -50,6 +57,8 @@ jobs: image: quay.io/prometheus/golang-builder:1.23-base steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - run: make build # Don't run NPM build; don't run race-detector. - run: make test GO_ONLY=1 test-flags="" @@ -64,6 +73,8 @@ jobs: steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: prometheus/promci@443c7fc2397e946bc9f5029e313a9c3441b9b86d # v0.4.7 - uses: ./.github/promci/actions/setup_environment with: @@ -81,6 +92,8 @@ jobs: runs-on: windows-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with: go-version: 1.24.x @@ -98,6 +111,8 @@ jobs: image: quay.io/prometheus/golang-builder:1.24-base steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - run: go install ./cmd/promtool/. - run: go install github.com/google/go-jsonnet/cmd/jsonnet@latest - run: go install github.com/google/go-jsonnet/cmd/jsonnetfmt@latest @@ -123,6 +138,8 @@ jobs: thread: [ 0, 1, 2 ] steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: prometheus/promci@443c7fc2397e946bc9f5029e313a9c3441b9b86d # v0.4.7 - uses: ./.github/promci/actions/build with: @@ -148,6 +165,8 @@ jobs: # should also be updated. steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: prometheus/promci@443c7fc2397e946bc9f5029e313a9c3441b9b86d # v0.4.7 - uses: ./.github/promci/actions/build with: @@ -182,6 +201,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Install Go uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with: @@ -195,6 +216,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Install Go uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with: @@ -213,6 +236,9 @@ jobs: if: github.event_name == 'pull_request' codeql: uses: ./.github/workflows/codeql-analysis.yml + permissions: + contents: read + security-events: write publish_main: name: Publish main branch artifacts @@ -221,6 +247,8 @@ jobs: if: github.event_name == 'push' && github.event.ref == 'refs/heads/main' steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: prometheus/promci@443c7fc2397e946bc9f5029e313a9c3441b9b86d # v0.4.7 - uses: ./.github/promci/actions/publish_main with: @@ -238,6 +266,8 @@ jobs: (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v3.')) steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: prometheus/promci@443c7fc2397e946bc9f5029e313a9c3441b9b86d # v0.4.7 - uses: ./.github/promci/actions/publish_release with: @@ -253,6 +283,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: prometheus/promci@443c7fc2397e946bc9f5029e313a9c3441b9b86d # v0.4.7 - name: Install nodejs uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 @@ -270,7 +302,9 @@ jobs: (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v2.')) || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v3.')) - run: ./scripts/ui_release.sh --check-package "$(./scripts/get_module_version.sh ${{ github.ref_name }})" + run: ./scripts/ui_release.sh --check-package "$(./scripts/get_module_version.sh ${GH_REF_NAME})" + env: + GH_REF_NAME: ${{ github.ref_name }} - name: build run: make assets - name: Copy files before publishing libs diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 1007b2e8f9..b444815d3c 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -25,6 +25,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Initialize CodeQL uses: github/codeql-action/init@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16 diff --git a/.github/workflows/container_description.yml b/.github/workflows/container_description.yml index dcca16ff34..7de8bb8da7 100644 --- a/.github/workflows/container_description.yml +++ b/.github/workflows/container_description.yml @@ -19,6 +19,8 @@ jobs: steps: - name: git checkout uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set docker hub repo name run: echo "DOCKER_REPO_NAME=$(make docker-repo-name)" >> $GITHUB_ENV - name: Push README to Dockerhub @@ -41,6 +43,8 @@ jobs: steps: - name: git checkout uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set quay.io org name run: echo "DOCKER_REPO=$(echo quay.io/${GITHUB_REPOSITORY_OWNER} | tr -d '-')" >> $GITHUB_ENV - name: Set quay.io repo name diff --git a/.github/workflows/fuzzing.yml b/.github/workflows/fuzzing.yml index d04036f067..27c09b4187 100644 --- a/.github/workflows/fuzzing.yml +++ b/.github/workflows/fuzzing.yml @@ -10,12 +10,14 @@ jobs: steps: - name: Build Fuzzers id: build - uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master + uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@cafd7a0eb8ecb4e007c56897996a9b65c49c972f # master with: oss-fuzz-project-name: "prometheus" dry-run: false - name: Run Fuzzers - uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master + uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@cafd7a0eb8ecb4e007c56897996a9b65c49c972f # master + # Note: Regularly check for updates to the pinned commit hash at: + # https://github.com/google/oss-fuzz/tree/master/infra/cifuzz/actions/run_fuzzers with: oss-fuzz-project-name: "prometheus" fuzz-seconds: 600 diff --git a/.github/workflows/prombench.yml b/.github/workflows/prombench.yml index dc4e29d4f7..65d1d71917 100644 --- a/.github/workflows/prombench.yml +++ b/.github/workflows/prombench.yml @@ -2,6 +2,8 @@ on: repository_dispatch: types: [prombench_start, prombench_restart, prombench_stop] name: Prombench Workflow +permissions: + contents: read env: AUTH_FILE: ${{ secrets.TEST_INFRA_PROVIDER_AUTH }} CLUSTER_NAME: test-infra diff --git a/.github/workflows/repo_sync.yml b/.github/workflows/repo_sync.yml index a659d431d0..fa8d2e5abe 100644 --- a/.github/workflows/repo_sync.yml +++ b/.github/workflows/repo_sync.yml @@ -14,6 +14,8 @@ jobs: image: quay.io/prometheus/golang-builder steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - run: ./scripts/sync_repo_files.sh env: GITHUB_TOKEN: ${{ secrets.PROMBOT_GITHUB_TOKEN }}