Commit Graph

23 Commits

Author SHA1 Message Date
Aurélien Bombo
a678046d13 gha: Pin third-party actions to commit hashes
A popular third-party action has recently been compromised [1][2] and
the attacker managed to point multiple git version tags to a malicious
commit containing code to exfiltrate secrets.

This PR follows GitHub's recommendation [3] to pin third-party actions
to a full-length commit hash, to mitigate such attacks.

Hopefully actionlint starts warning about this soon [4].

 [1] https://www.cve.org/CVERecord?id=CVE-2025-30066
 [2] https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
 [3] https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
 [4] https://github.com/rhysd/actionlint/pull/436

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-19 13:52:49 -05:00
stevenhorsman
c2ba15c111 workflows: linting: Fix shellcheck SC2206
>  Quote to prevent word splitting/globbing

Double quote variables expanded in an array

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2024-12-06 13:50:12 +00:00
stevenhorsman
007514154c workflows: linting: Fix shellcheck SC2068
> Double quote array expansions to avoid re-splitting elements

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2024-12-06 13:50:12 +00:00
stevenhorsman
935327b5aa workflows: linting: Fix shellcheck SC2046
> Quote this to prevent word splitting.

Quote around subshell

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2024-12-06 13:50:12 +00:00
stevenhorsman
9113606d45 workflows: linting: Fix shellcheck SC2086
> Double quote to prevent globbing and word splitting.

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2024-12-06 13:50:12 +00:00
Hyounggyu Choi
8d529b960a gha: Eradicate {pre,post}-action steps for s390x runners
As suggested in #9934, the following hooks have been introduced for s390x runners:

- ACTIONS_RUNNER_HOOK_JOB_STARTED
- ACTIONS_RUNNER_HOOK_JOB_COMPLETED

These hooks will perfectly replace the existing {pre,post}-action scripts.
This commit wipes out all GHA steps for s390x where the actions are triggered.

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2024-07-30 17:10:19 +02:00
stevenhorsman
d93156d84d gha: release: Push artifacts to registry on release
For other projects (e.g. CoCo projects) being able to
access the released versions of components is helpful,
so push these during the release process

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2024-05-15 16:55:55 +01:00
Greg Kurz
424a5e243f gha: Bump to actions/[down|up]load-artifact@v4 (all the rest)
`Node.js 19` is deprecated. Bump to a new version based on `Node.js 20`.

This fixes all remaining sites.

Fixes #9245

Signed-off-by: Greg Kurz <groug@kaod.org>
2024-04-05 18:36:51 +02:00
Greg Kurz
0a43d26c94 gha: Bump to docker/login-action@v3
`Node.js 19` is deprecated. Bump to a new version based on `Node.js 20`.

Fixes #9245

Signed-off-by: Greg Kurz <groug@kaod.org>
2024-04-05 18:36:50 +02:00
Hyounggyu Choi
f2bc819644 gha: Place pre-action on s390x runner for kata-deploy during release
This is to place a pre-action step for the kata-deploy job in order to
clean up the github workspace directory before checking out the repo.

Fixes: #9301

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2024-03-19 10:18:38 +01:00
stevenhorsman
0ab8e61a64 release: Remove release type from arch release
Now we don't have minor and major releases and
we are now generating a new version
in the release workflow, we can
tidy up the arch specific releases workflows to remove
the extra required inputs

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2024-03-18 12:27:57 +00:00
Fabiano Fidêncio
658fb6972b release: Ensure the release-type is passed to workflows
We need to ensure the release type is passed down to workflows,
otherwise we'll fail to get the correct release version for tagging the
daemonset images.

Fixes: #9064 - part III

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-03-07 12:02:51 +00:00
Fabiano Fidêncio
757f958943
release: Adjust tags used to publish our deamonset
We need to adjust the tags as when this workflow ends up being called
from the release side, we'll receive "refs/tags/main"  as the
GITHUB_REF, and in that case we must use the release version.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-02-28 12:34:51 +01:00
Hyounggyu Choi
636eef8907 GHA: make secrets inherited for build-kata-static-tarball-s390x
This is to make GHA secrets inherited for the workflow titled
`build-kata-static-tarball-s390x` to configure an environment
variable `CI_HKD_PATH` for a `build-asset-boot-image-se` step.

Fixes: #8611

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2023-12-08 13:55:45 +01:00
Fabiano Fidêncio
c5cfad7023 actions: Move all the checkout actions to v4
It's been released for a while now, and we need to keep consistency
between what we used.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-10-23 14:01:53 +02:00
Fabiano Fidêncio
684a6e1a55 Revert "gha: release: stage must be a string"
This reverts commit 7c857d38c1.

I've misunderstood the error given by github action, let's fix this in
the next commit.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-07-31 14:37:52 +02:00
Fabiano Fidêncio
7c857d38c1 gha: release: stage must be a string
Otherwise we'll face the following error as part of our GHA:
```
The workflow is not valid.
kata-containers/kata-containers/.github/workflows/release-$foo.yaml
(Line: 13, Col: 14): Invalid input, stage is not defined in the
referenced workflow.
```

Fixes: #7497

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-07-31 13:39:13 +02:00
Aurélien Bombo
f28a62164a gha: Add cloud-hypervisor-glibc build target
This adds the glibc flavor of CLH to the list of assets as preparation
for #6839. Mariner Kata is only tested with glibc.

Fixes: #7026

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2023-06-09 11:35:50 -07:00
Fabiano Fidêncio
f636c1f8a4 gha: release: Simplify the process for tagging the payload
We previously were doing:
* Create a new image on kata-deploy-ci using the commit hash of the
  latest tag
  * This was used to test on AKS, which is no longer needed as we test
    on AKS on every PR
* Create a new image on kata-deploy using the release tag and "latest"
  or "stable", by tagging the kata-deploy-ci image accordingly

As part of cfe63527c5, we broke the
workflow described above, as in the first step we would save the PKG_SHA
to be used in the second step, but that part ended up being removed.

Anyways, this back and forth is not needed anymore and we can simplify
the process by doing:
* Create a new image on kata-deploy, using:
  - The tag received as ref from the event that triggered this worklow
  - "latest" or "stable" tag, depending on whether it's a stable release
    or not

Fixes: #6946

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-05-24 08:54:43 +02:00
Fabiano Fidêncio
d10c9be603 gha: release: login-action: Don't specify docker.io registry
For some bizarre reason, the login-action will simply fail to
authenticate to docker.io in it's specified as a registry.  The way to
proceed, instead, is to *not* specify any registry as it'd be used by
default.

Fixes: #6943

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-05-23 22:38:12 +02:00
Fabiano Fidêncio
f3702268d1 release: Fix docker/login-action version
`docker/login-action@v3` does *not* exist and `docker/login-action@v2`
should be used instead.

Fixes: #6934

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-05-23 14:11:03 +02:00
Fabiano Fidêncio
191b6dd9dd gha: release: Fix s390x worklow
GitHub is warning us that:
"""
The workflow is not valid. In .github/workflows/release.yaml (Line: 21,
Col: 11): Error from called workflow
kata-containers/kata-containers/.github/workflows/release-s390x.yaml@d2e92c9ec993f56537044950a4673e50707369b5
(Line: 14, Col: 12): Job 'kata-deploy' depends on unknown job
'create-kata-tarball'.
"""

This is happening as we need to reference
"build-kata-static-tarball-s390x" instead of "create-kata-tarball".

Fixes: #6903

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-05-19 16:21:49 +02:00
SinghWang
cfe63527c5 release: Fix multi-arch publishing is not supported
When release is published, kata-deploy payload and kata-static package
can support multi-arch publishing.

Fixes: #6449

Signed-off-by: SinghWang <wangxin_0611@126.com>
Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-05-12 13:36:44 +02:00