mirror of
https://github.com/apple/container.git
synced 2026-09-12 18:55:43 +00:00
Melissa Kilby
26dcd68340
See https://github.com/swiftlang/github-workflows/issues/167 for additional context This approach aligns with security best practices, as detailed in the following documentation: - https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions - https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#defining-access-for-the-github_token-scopes - https://openssf.org/blog/2024/08/12/mitigating-attack-vectors-in-github-workflows/ The default GITHUB_TOKEN permissions are defined at the repository level. This PR modifies the workflow-level overrides to conform to OpenSSF best practices -> defense in depth. Allow me to quote OpenSSF: https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions > The highest score is awarded when the permissions definitions in each workflow's yaml file are set as read-only at the top level and the required write permissions are declared at the run-level.” > Remediation steps > - Set top-level permissions as read-all or contents: read as described in GitHub's documentation. > - Set any required write permissions at the job-level. Only set the permissions required for that job; do not set permissions: write-all at the job level. Compare to the LLVM project: Top-level: contents read, e.g. https://github.com/swiftlang/llvm-project/blob/next/.github/workflows/build-ci-container-windows.yml#L3-L4 -> this makes it future-proof Job-level: Allow write permissions as needed, e.g. https://github.com/swiftlang/llvm-project/blob/next/.github/workflows/build-ci-container-windows.yml#L53-L58 Signed-off-by: Melissa Kilby <mkilby@apple.com>
126 lines
3.4 KiB
YAML
126 lines
3.4 KiB
YAML
name: Build containerization template
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
release:
|
|
type: boolean
|
|
description: "Create a release"
|
|
default: false
|
|
version:
|
|
type: string
|
|
description: Version of containerization
|
|
default: test
|
|
|
|
jobs:
|
|
buildAndTest:
|
|
name: Build and Test repo
|
|
if: github.repository == 'apple/containerization'
|
|
timeout-minutes: 60
|
|
runs-on: [self-hosted, macos, sequoia, ARM64]
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
env:
|
|
DEVELOPER_DIR: "/Applications/Xcode-latest.app/Contents/Developer"
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Activate Swiftly
|
|
run: |
|
|
source /opt/swiftly/env.sh
|
|
cat /opt/swiftly/env.sh
|
|
|
|
- name: Check formatting
|
|
run: |
|
|
./scripts/install-hawkeye.sh
|
|
make fmt
|
|
git diff
|
|
if ! git diff --quiet ; then echo the following files require formatting or license headers: ; git diff --name-only ; false ; fi
|
|
|
|
- name: Check protobufs
|
|
run: |
|
|
make protos
|
|
if ! git diff --quiet ; then echo the following files require formatting or license headers: ; git diff --name-only ; false ; fi
|
|
|
|
- name: Make containerization and docs
|
|
run: |
|
|
make clean containerization docs
|
|
tar cfz _site.tgz _site
|
|
|
|
- name: Make vminitd image
|
|
run: |
|
|
source /opt/swiftly/env.sh
|
|
make -C vminitd swift linux-sdk
|
|
make init
|
|
|
|
- name: Test containerization
|
|
run: |
|
|
make fetch-default-kernel
|
|
make test integration
|
|
env:
|
|
REGISTRY_TOKEN: ${{ github.token }}
|
|
REGISTRY_USERNAME: ${{ github.actor }}
|
|
|
|
- name: Push vminitd image
|
|
if: ${{ inputs.release }}
|
|
run: |
|
|
bin/cctl images tag vminit:latest ghcr.io/apple/containerization/vminit:${{ inputs.version }}
|
|
bin/cctl images push ghcr.io/apple/containerization/vminit:${{ inputs.version }}
|
|
env:
|
|
REGISTRY_TOKEN: ${{ github.token }}
|
|
REGISTRY_USERNAME: ${{ github.actor }}
|
|
REGISTRY_HOST: ghcr.io
|
|
|
|
- name: Create image tar
|
|
if: ${{ !inputs.release }}
|
|
run: |
|
|
bin/cctl images save vminit:latest -o vminit.tar
|
|
|
|
- name: Save vminit artifact
|
|
if: ${{ !inputs.release }}
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: vminit
|
|
path: vminit.tar
|
|
|
|
- name: Save documentation artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: api-docs
|
|
path: "./_site.tgz"
|
|
retention-days: 14
|
|
|
|
uploadPages:
|
|
# Separate upload step required because upload-pages-artifact needs
|
|
# gtar which is not on the macOS runner.
|
|
name: Upload artifact for GitHub Pages
|
|
needs: buildAndTest
|
|
timeout-minutes: 5
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Setup Pages
|
|
uses: actions/configure-pages@v5
|
|
|
|
- name: Download a single artifact
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: api-docs
|
|
|
|
- name: Add API docs to documentation
|
|
run: |
|
|
tar xfz _site.tgz
|
|
|
|
- name: Upload Artifact
|
|
uses: actions/upload-pages-artifact@v3
|
|
with:
|
|
path: "./_site"
|