mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-30 00:27:04 +09:00
Myasnikov Daniil
76ad921fdd
Raise the OpenSSF Scorecard Token-Permissions and Pinned-Dependencies checks (both currently 0/10) ahead of CNCF Incubation due diligence: - Declare a top-level read-only default (permissions: contents: read) in every workflow, plus an explicit per-job permissions: block that grants only the writes that job actually needs. Workflows that previously held write scopes at the workflow level (backport, pr-labeler, pr-size, stale) now hold them at job level instead. - Pin every GitHub-owned and third-party action to a full commit SHA with a version comment. scorecard.yml was already pinned in #2721. No triggers, job graph, or step logic change; only token scopes and action refs. Self-hosted release jobs keep the exact write scopes they already declared. Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com> Assisted-By: Claude <noreply@anthropic.com>
68 lines
2.1 KiB
YAML
68 lines
2.1 KiB
YAML
name: Codegen Drift Check
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
paths:
|
|
- 'api/**'
|
|
- 'pkg/apis/**'
|
|
- 'pkg/generated/**'
|
|
- 'internal/crdinstall/manifests/**'
|
|
- 'packages/system/cozystack-controller/definitions/**'
|
|
- 'packages/system/application-definition-crd/definition/**'
|
|
- 'packages/system/backup-controller/definitions/**'
|
|
- 'packages/system/backupstrategy-controller/definitions/**'
|
|
- 'hack/update-codegen.sh'
|
|
- 'hack/boilerplate.go.txt'
|
|
- 'Makefile'
|
|
- 'go.mod'
|
|
- 'go.sum'
|
|
- '.github/workflows/codegen-drift.yml'
|
|
|
|
concurrency:
|
|
group: codegen-drift-${{ github.workflow }}-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
# Top-level token defaults to read-only; jobs request the minimum extra scopes.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
codegen-drift:
|
|
name: Verify generated code is up to date
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: Pre-fetch k8s.io/code-generator module
|
|
# hack/update-codegen.sh sources kube_codegen.sh from the Go module cache.
|
|
# The module is not declared in go.mod, so fetch it explicitly at the
|
|
# version pinned in the script.
|
|
run: |
|
|
version=$(grep -oP 'code-generator@\Kv[0-9.]+' hack/update-codegen.sh)
|
|
tmpdir=$(mktemp -d)
|
|
cd "$tmpdir"
|
|
go mod init codegen-fetch
|
|
go get "k8s.io/code-generator@${version}"
|
|
|
|
- name: Run make generate
|
|
run: make generate
|
|
|
|
- name: Fail on drift
|
|
run: |
|
|
if [ -n "$(git status --porcelain)" ]; then
|
|
echo "::error::'make generate' produced changes. Run 'make generate' locally and commit the result."
|
|
git status --short
|
|
git diff --color=always
|
|
exit 1
|
|
fi
|