 Kathryn Baldauf
|
1437c67f5a
|
Update github actions to use SHA versions (#763)
Related to https://github.com/apple/container/pull/1649. This PR updates
the GitHub workflows to ensure all imported actions are referenced by
commit SHA.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
|
2026-06-04 15:08:22 -07:00 |
|
|
Melissa Kilby
|
26dcd68340
|
chore: restrict GitHub workflow permissions - future-proof (#339)
See https://github.com/swiftlang/github-workflows/issues/167 for
additional context
This approach aligns with security best practices, as detailed in the
following documentation:
-
https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
-
https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#defining-access-for-the-github_token-scopes
-
https://openssf.org/blog/2024/08/12/mitigating-attack-vectors-in-github-workflows/
The default GITHUB_TOKEN permissions are defined at the repository
level. This PR modifies the workflow-level overrides to conform to
OpenSSF best practices -> defense in depth.
Allow me to quote OpenSSF:
https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
> The highest score is awarded when the permissions definitions in each
workflow's yaml file are set as read-only at the top level and the
required write permissions are declared at the run-level.”
> Remediation steps
> - Set top-level permissions as read-all or contents: read as described
in GitHub's documentation.
> - Set any required write permissions at the job-level. Only set the
permissions required for that job; do not set permissions: write-all at
the job level.
Compare to the LLVM project:
Top-level: contents read, e.g.
https://github.com/swiftlang/llvm-project/blob/next/.github/workflows/build-ci-container-windows.yml#L3-L4
-> this makes it future-proof
Job-level: Allow write permissions as needed, e.g.
https://github.com/swiftlang/llvm-project/blob/next/.github/workflows/build-ci-container-windows.yml#L53-L58
Signed-off-by: Melissa Kilby <mkilby@apple.com>
|
2025-10-17 15:00:03 -07:00 |
|
|
Kathryn Baldauf
|
4751d073bb
|
Improve release tag regex (#122)
Matches changes made in https://github.com/apple/container/pull/187 by
@Thedarkmatter10
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
|
2025-06-13 14:45:16 -07:00 |
|
|
Kathryn Baldauf
|
46260fd6a6
|
Move permissions in release and add id-token (#24)
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
|
2025-06-05 20:28:08 -07:00 |
|
|
Kathryn Baldauf
|
8d880efc36
|
Remove extra source tar from release (#13)
A release is made by default with sources in a tar and zip (example
[here](https://github.com/apple/containerization/releases/tag/untagged-a4e930d3152ef58348f1))
so we can remove this extra tar
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
|
2025-06-05 16:16:17 -07:00 |
|
|
Kathryn Baldauf
|
502dab6108
|
Update containerization apple main (#4)
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
|
2025-06-05 16:15:44 -07:00 |
|
|
Kathryn Baldauf
|
6bc739a670
|
Add github actions workflows (#1)
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
|
2025-06-05 16:15:28 -07:00 |
|