Skip to content

ci: harden GitHub Actions security #75

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kratsg merged 2 commits into from
Aug 13, 2026
+32 −9
Merged

ci: harden GitHub Actions security #75

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cd2273f
ci: pin GitHub Actions to SHAs
kratsg Aug 13, 2026
78d3d60
ci: add zizmor hardening and dependabot for actions
kratsg Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "monthly"
groups:
github-actions:
patterns:
- "*"
cooldown:
default-days: 7
29 changes: 20 additions & 9 deletions .github/workflows/base_builder.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,16 +8,27 @@ on:
branches: ["main"]
workflow_dispatch:

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

permissions: {}

jobs:
docker:
name: Build and push base image
runs-on: ubuntu-latest
permissions:
contents: read # actions/checkout
steps:
- name: Checkout
uses: actions/checkout@v4.2.2
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Docker meta
id: meta
uses: docker/metadata-action@v5.7.0
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
with:
# list of Docker images to use as base name for tags
images: |
Expand All @@ -31,29 +42,29 @@ jobs:
type=sha

- name: Set up QEMU
uses: docker/setup-qemu-action@v3.6.0
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3.10.0
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

- name: Login to Docker Hub
if: github.event_name != 'pull_request'
uses: docker/login-action@v3.4.0
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}

- name: Login to Harbor Container Registry
if: github.event_name != 'pull_request'
uses: docker/login-action@v3.4.0
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: hub.opensciencegrid.org
username: ${{ secrets.HARBOR_USERNAME }}
password: ${{ secrets.HARBOR_PASSWORD }}

- name: Test build
if: github.event_name == 'pull_request'
uses: docker/build-push-action@v6.15.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
file: docker/Dockerfile
Expand All @@ -68,7 +79,7 @@ jobs:

- name: Build and push
if: github.event_name != 'pull_request'
uses: docker/build-push-action@v6.15.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
file: docker/Dockerfile
Expand All @@ -78,7 +89,7 @@ jobs:

- name: Repository Dispatch
if: github.event_name != 'pull_request'
uses: peter-evans/repository-dispatch@v3.0.0
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
with:
token: ${{ secrets.GITOPS_REBUILD_TRIGGER }}
repository: usatlas/analysisbase-dask-uc
Expand Down
Loading