mirror of
https://github.com/kata-containers/kata-containers.git
synced 2025-04-27 19:35:32 +00:00
a678046d13
A popular third-party action has recently been compromised [1][2] and the attacker managed to point multiple git version tags to a malicious commit containing code to exfiltrate secrets. This PR follows GitHub's recommendation [3] to pin third-party actions to a full-length commit hash, to mitigate such attacks. Hopefully actionlint starts warning about this soon [4]. [1] https://www.cve.org/CVERecord?id=CVE-2025-30066 [2] https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised [3] https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions [4] https://github.com/rhysd/actionlint/pull/436 Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
60 lines
2.1 KiB
YAML
60 lines
2.1 KiB
YAML
name: Publish Kata release artifacts for amd64
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
target-arch:
|
|
required: true
|
|
type: string
|
|
|
|
jobs:
|
|
build-kata-static-tarball-amd64:
|
|
uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
|
|
with:
|
|
push-to-registry: yes
|
|
stage: release
|
|
secrets: inherit
|
|
|
|
kata-deploy:
|
|
needs: build-kata-static-tarball-amd64
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Login to Kata Containers docker.io
|
|
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
|
|
with:
|
|
username: ${{ secrets.DOCKER_USERNAME }}
|
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
|
|
|
- name: Login to Kata Containers quay.io
|
|
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
|
|
with:
|
|
registry: quay.io
|
|
username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
|
|
password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
|
|
|
|
- uses: actions/checkout@v4
|
|
- name: get-kata-tarball
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: kata-static-tarball-amd64
|
|
|
|
- name: build-and-push-kata-deploy-ci-amd64
|
|
id: build-and-push-kata-deploy-ci-amd64
|
|
run: |
|
|
# We need to do such trick here as the format of the $GITHUB_REF
|
|
# is "refs/tags/<tag>"
|
|
tag=$(echo "$GITHUB_REF" | cut -d/ -f3-)
|
|
if [ "${tag}" = "main" ]; then
|
|
tag=$(./tools/packaging/release/release.sh release-version)
|
|
tags=("${tag}" "latest")
|
|
else
|
|
tags=("${tag}")
|
|
fi
|
|
for tag in "${tags[@]}"; do
|
|
./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
|
|
"$(pwd)"/kata-static.tar.xz "docker.io/katadocker/kata-deploy" \
|
|
"${tag}-${{ inputs.target-arch }}"
|
|
./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
|
|
"$(pwd)"/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
|
|
"${tag}-${{ inputs.target-arch }}"
|
|
done
|