138.diff (12614B)
1 diff --git a/.github/workflows/build-blog.yaml b/.github/workflows/build-blog.yaml 2 index 7557d72e..156f2d79 100644 3 --- a/.github/workflows/build-blog.yaml 4 +++ b/.github/workflows/build-blog.yaml 5 @@ -19,31 +19,31 @@ jobs: 6 environment: registry 7 steps: 8 - name: Checkout 9 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 10 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 11 with: 12 persist-credentials: false 13 14 - name: Set up QEMU 15 - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4 16 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4 17 18 - name: Set up Docker Buildx 19 - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 20 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 21 22 - name: Log in to self-hosted registry 23 - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4 24 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 25 with: 26 registry: registry.midnightthoughts.space 27 username: ${{ secrets.REGISTRY_USERNAME }} 28 password: ${{ secrets.REGISTRY_PASSWORD }} 29 30 - name: Install cosign 31 - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 32 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 33 with: 34 cosign-release: v3.0.5 35 36 - name: Extract metadata 37 id: meta 38 - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6 39 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6 40 with: 41 images: registry.midnightthoughts.space/mtrnord/blog 42 labels: | 43 @@ -57,7 +57,7 @@ jobs: 44 45 - name: Build and push 46 id: build 47 - uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 48 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 49 with: 50 context: apps/talos_cluster/blog/docker 51 file: apps/talos_cluster/blog/docker/Dockerfile 52 diff --git a/.github/workflows/build-bookwyrm.yaml b/.github/workflows/build-bookwyrm.yaml 53 index 3120fe45..9adb9fab 100644 54 --- a/.github/workflows/build-bookwyrm.yaml 55 +++ b/.github/workflows/build-bookwyrm.yaml 56 @@ -69,14 +69,14 @@ jobs: 57 environment: registry 58 steps: 59 - name: Checkout bookwyrm source 60 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 61 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 62 with: 63 repository: bookwyrm-social/bookwyrm 64 ref: ${{ needs.check.outputs.new_version }} 65 persist-credentials: false 66 67 - name: Checkout gitops for Dockerfile patch 68 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 69 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 70 with: 71 path: _gitops 72 persist-credentials: false 73 @@ -91,26 +91,26 @@ jobs: 74 fi 75 76 - name: Set up QEMU 77 - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4 78 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4 79 80 - name: Set up Docker Buildx 81 - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 82 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 83 84 - name: Log in to self-hosted registry 85 - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4 86 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 87 with: 88 registry: registry.midnightthoughts.space 89 username: ${{ secrets.REGISTRY_USERNAME }} 90 password: ${{ secrets.REGISTRY_PASSWORD }} 91 92 - name: Install cosign 93 - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 94 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 95 with: 96 cosign-release: v3.0.5 97 98 - name: Build and push 99 id: build 100 - uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 101 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 102 with: 103 context: . 104 push: true 105 diff --git a/.github/workflows/build-continuwuity.yaml b/.github/workflows/build-continuwuity.yaml 106 index 47163777..369277bb 100644 107 --- a/.github/workflows/build-continuwuity.yaml 108 +++ b/.github/workflows/build-continuwuity.yaml 109 @@ -22,18 +22,18 @@ jobs: 110 environment: registry 111 steps: 112 - name: Checkout 113 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 114 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 115 with: 116 persist-credentials: false 117 118 - name: Set up QEMU 119 - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4 120 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4 121 122 - name: Set up Docker Buildx 123 - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 124 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 125 126 - name: Log in to self-hosted registry 127 - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4 128 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 129 with: 130 registry: registry.midnightthoughts.space 131 username: ${{ secrets.REGISTRY_USERNAME }} 132 @@ -41,7 +41,7 @@ jobs: 133 134 - name: Extract metadata 135 id: meta 136 - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6 137 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6 138 with: 139 images: registry.midnightthoughts.space/mtrnord/cluster/continuwuity 140 labels: | 141 @@ -54,13 +54,13 @@ jobs: 142 type=sha,prefix=sha- 143 144 - name: Install cosign 145 - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 146 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 147 with: 148 cosign-release: v3.0.5 149 150 - name: Build and push 151 id: build 152 - uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 153 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 154 with: 155 context: apps/talos_cluster/continuwuity 156 file: apps/talos_cluster/continuwuity/Dockerfile 157 diff --git a/.github/workflows/build-mediawiki.yaml b/.github/workflows/build-mediawiki.yaml 158 index 97130a1a..041ca347 100644 159 --- a/.github/workflows/build-mediawiki.yaml 160 +++ b/.github/workflows/build-mediawiki.yaml 161 @@ -81,31 +81,31 @@ jobs: 162 environment: registry 163 steps: 164 - name: Checkout 165 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 166 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 167 with: 168 persist-credentials: false 169 170 - name: Set up QEMU 171 - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4 172 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4 173 174 - name: Set up Docker Buildx 175 - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 176 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 177 178 - name: Log in to self-hosted registry 179 - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4 180 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 181 with: 182 registry: registry.midnightthoughts.space 183 username: ${{ secrets.REGISTRY_USERNAME }} 184 password: ${{ secrets.REGISTRY_PASSWORD }} 185 186 - name: Install cosign 187 - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 188 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 189 with: 190 cosign-release: v3.0.5 191 192 - name: Build and push 193 id: build 194 - uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 195 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 196 with: 197 context: apps/talos_cluster/mediawiki 198 file: apps/talos_cluster/mediawiki/Dockerfile 199 diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml 200 index 74ed76dc..c906ffd7 100644 201 --- a/.github/workflows/docs.yml 202 +++ b/.github/workflows/docs.yml 203 @@ -18,12 +18,12 @@ jobs: 204 deploy: 205 runs-on: ubuntu-latest 206 steps: 207 - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 208 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 209 with: 210 fetch-depth: 0 211 persist-credentials: false 212 213 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 214 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 215 with: 216 python-version: "3.12" 217 cache: pip 218 diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml 219 index cb991bc4..0d3eb970 100644 220 --- a/.github/workflows/validate.yaml 221 +++ b/.github/workflows/validate.yaml 222 @@ -26,12 +26,12 @@ jobs: 223 runs-on: ubuntu-latest 224 steps: 225 - name: Checkout 226 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 227 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 228 with: 229 persist-credentials: false 230 231 - name: Setup Flux CLI 232 - uses: fluxcd/flux2/action@7d27a26665b34463b0ed5fb54fa06642375536f9 # main 233 + uses: fluxcd/flux2/action@1ed703a34462da3527564befc791436d1711aca7 # main 234 235 - name: Setup tools 236 run: | 237 @@ -67,7 +67,7 @@ jobs: 238 security-events: write 239 steps: 240 - name: Checkout 241 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 242 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 243 with: 244 fetch-depth: 0 245 persist-credentials: false 246 @@ -115,7 +115,7 @@ jobs: 247 cat /tmp/images_final.txt 248 249 - name: Run Trivy vulnerability scanner 250 - uses: aquasecurity/trivy-action@876cf04c63f65e9799bcf1043b584e72469c7143 # master 251 + uses: aquasecurity/trivy-action@c07df6fec6fa692e6fd1200d50aaa1fdd66f03c8 # master 252 with: 253 scan-type: "config" 254 scan-ref: "." 255 @@ -124,7 +124,7 @@ jobs: 256 severity: "CRITICAL,HIGH" 257 258 - name: Upload Trivy results to GitHub Security 259 - uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4 260 + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4 261 if: always() 262 with: 263 sarif_file: "trivy-results.sarif" 264 @@ -137,7 +137,7 @@ jobs: 265 security-events: write 266 steps: 267 - name: Checkout 268 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 269 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 270 with: 271 persist-credentials: false 272 273 @@ -158,7 +158,7 @@ jobs: 274 ls -la manifests/ 275 276 - name: Run Kubescape 277 - uses: kubescape/github-action@47d8e4561a2a1be8e22a4edfbd02c0b97f7335cb # main 278 + uses: kubescape/github-action@7d90c1f159f02df1e3c79f839eeabe42ea30d4e3 # main 279 continue-on-error: true 280 with: 281 files: "manifests/" 282 @@ -189,7 +189,7 @@ jobs: 283 fi 284 285 - name: Upload Kubescape results to GitHub Security 286 - uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4 287 + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4 288 if: always() 289 with: 290 sarif_file: "results.sarif" 291 @@ -199,7 +199,7 @@ jobs: 292 runs-on: ubuntu-latest 293 steps: 294 - name: Checkout 295 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 296 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 297 with: 298 persist-credentials: false 299