mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-27 15:17:13 +09:00
IvanHunters
3ce8279019
Address the remaining review findings: - The materializer now prunes PackageSources it materialized from an earlier revision that the current artifact no longer contains (including a single/multi rename), so a removed package leaves the catalog; installed Packages stay. - A repeat connect updates the fetched OCIRepository's spec, label and name annotation instead of replacing the object, so the operator's finalizer and materialized-revision annotation survive; covered by a test. - OCIRepository write verbs move from the cluster-wide cozystack-api ClusterRole to a namespaced Role in cozy-system (get/list/watch stay cluster-wide for the watch cache), since the API only manages tap sources there. - 'cozypkg validate --require-signature' now pulls the exact manifest digest cosign verified, closing the tag-mutation window between verify and pull. - safeJoin rejects any '..' path segment outright (defense in depth and to satisfy the Zip-Slip scanner) on top of the existing containment check. - Document why the index gate's merge/label steps need a workflow_run split for fork pull requests. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
81 lines
3.1 KiB
YAML
81 lines
3.1 KiB
YAML
# Copy to .github/workflows/validate.yaml in the cozystack/packages-index repo.
|
|
# Publication gate: validate every changed index entry and route it to the
|
|
# auto-merge lane (owner version bump, signed by the recorded identity) or the
|
|
# maintainer-review lane (new entry or a security-relevant edit).
|
|
name: validate
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- "entries/**"
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
validate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
# Full history so the gate can diff the entry against the base ref.
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.26"
|
|
|
|
# Pin both tools: the gate decides auto-merge, so its toolchain must be
|
|
# reproducible and not shiftable by an upstream retag. Bump COZYPKG_VERSION
|
|
# to the released cozypkg tag this index targets.
|
|
- name: Install cozypkg
|
|
env:
|
|
COZYPKG_VERSION: v1.0.0
|
|
run: go install "github.com/cozystack/cozystack/cmd/cozypkg@${COZYPKG_VERSION}"
|
|
|
|
- name: Install yq
|
|
env:
|
|
YQ_VERSION: v4.44.6
|
|
run: |
|
|
sudo curl --fail --silent --show-error --location \
|
|
--output /usr/local/bin/yq \
|
|
"https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64"
|
|
sudo chmod +x /usr/local/bin/yq
|
|
|
|
# Pin the verifier too: cosign is what the auto-merge decision rests on.
|
|
- uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
|
|
with:
|
|
cosign-release: v2.4.3
|
|
|
|
# helm is needed for `cozypkg validate --helm-lint` in the gate.
|
|
- uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
|
|
with:
|
|
version: v3.16.4
|
|
|
|
- name: Validate changed entries
|
|
id: gate
|
|
env:
|
|
BASE_REF: origin/${{ github.base_ref }}
|
|
run: bash scripts/validate-entry.sh
|
|
|
|
# NOTE: for a pull request from a fork (the common case for a community
|
|
# index), GITHUB_TOKEN is read-only regardless of the permissions above,
|
|
# so the two steps below fail with 403. Before enabling this in the real
|
|
# packages-index repo, move the merge/label actions into a separate
|
|
# `workflow_run` job that checks out no untrusted code (do NOT switch the
|
|
# validation job to pull_request_target, which would run the contributor's
|
|
# gate script with a write token). The validation job above is safe on
|
|
# pull_request as-is.
|
|
- name: Enable auto-merge (owner version bump, signed by recorded identity)
|
|
if: steps.gate.outputs.lane == 'auto'
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: gh pr merge --squash --auto "${{ github.event.pull_request.number }}"
|
|
|
|
- name: Route to maintainer review (new entry or security-relevant edit)
|
|
if: steps.gate.outputs.lane == 'review'
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: gh pr edit "${{ github.event.pull_request.number }}" --add-label needs-maintainer-review
|