Kathryn Baldauf
1437c67f5a
Update github actions to use SHA versions ( #763 )
...
Related to https://github.com/apple/container/pull/1649 . This PR updates
the GitHub workflows to ensure all imported actions are referenced by
commit SHA.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com >
2026-06-04 15:08:22 -07:00
J Logan
f1195fead5
GH actions: do not interpolate template variables in run blocks. ( #567 )
2026-03-02 12:04:36 -08:00
Melissa Kilby
26dcd68340
chore: restrict GitHub workflow permissions - future-proof ( #339 )
...
See https://github.com/swiftlang/github-workflows/issues/167 for
additional context
This approach aligns with security best practices, as detailed in the
following documentation:
-
https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
-
https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#defining-access-for-the-github_token-scopes
-
https://openssf.org/blog/2024/08/12/mitigating-attack-vectors-in-github-workflows/
The default GITHUB_TOKEN permissions are defined at the repository
level. This PR modifies the workflow-level overrides to conform to
OpenSSF best practices -> defense in depth.
Allow me to quote OpenSSF:
https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
> The highest score is awarded when the permissions definitions in each
workflow's yaml file are set as read-only at the top level and the
required write permissions are declared at the run-level.”
> Remediation steps
> - Set top-level permissions as read-all or contents: read as described
in GitHub's documentation.
> - Set any required write permissions at the job-level. Only set the
permissions required for that job; do not set permissions: write-all at
the job level.
Compare to the LLVM project:
Top-level: contents read, e.g.
https://github.com/swiftlang/llvm-project/blob/next/.github/workflows/build-ci-container-windows.yml#L3-L4
-> this makes it future-proof
Job-level: Allow write permissions as needed, e.g.
https://github.com/swiftlang/llvm-project/blob/next/.github/workflows/build-ci-container-windows.yml#L53-L58
Signed-off-by: Melissa Kilby <mkilby@apple.com >
2025-10-17 15:00:03 -07:00
Kathryn Baldauf
2923b33836
Allow building docs from main ( #53 )
...
We eventually only want to support building docs from release branches
and tags, however, while we're working to initially set up the docs, we
may have some churn. So we want to be able to publish from main during
that churn.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com >
2025-06-09 16:40:22 -07:00
Kathryn Baldauf
0338c07283
Only allow docs publish on tags or release branches ( #32 )
...
Matches same changes on container
https://github.com/apple/container/pull/30
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com >
2025-06-08 10:12:38 -07:00
Kathryn Baldauf
816a959ada
Add id token for deploying docs ( #18 )
...
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com >
2025-06-05 16:16:21 -07:00
Kathryn Baldauf
5624a8397e
Add branch protection to the test image build pipeline ( #15 )
...
This adds branch protection to the workflow for building container test
images. This PR additionally moves the permissions for docs deploying to
be job level.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com >
2025-06-05 16:16:19 -07:00
Kathryn Baldauf
502dab6108
Update containerization apple main ( #4 )
...
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com >
2025-06-05 16:15:44 -07:00
Kathryn Baldauf
6bc739a670
Add github actions workflows ( #1 )
...
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com >
2025-06-05 16:15:28 -07:00
Kathryn Baldauf