[StepSecurity] ci: Harden GitHub Actions
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
This commit is contained in:
StepSecurity Bot
36
.github/workflows/ci.yml
vendored
36
.github/workflows/ci.yml
vendored
@@ -29,9 +29,9 @@ jobs:
|
||||
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
||||
- uses: ./.github/actions/install-go
|
||||
- uses: golangci/golangci-lint-action@v6
|
||||
- uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
|
||||
with:
|
||||
version: v1.60.1
|
||||
skip-cache: true
|
||||
@@ -46,14 +46,14 @@ jobs:
|
||||
timeout-minutes: 5
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
||||
with:
|
||||
path: src/github.com/containerd/containerd
|
||||
fetch-depth: 100
|
||||
|
||||
- uses: ./src/github.com/containerd/containerd/.github/actions/install-go
|
||||
|
||||
- uses: containerd/project-checks@v1.1.0
|
||||
- uses: containerd/project-checks@434a07157608eeaa1d5c8d4dd506154204cd9401 # v1.1.0
|
||||
if: github.repository == 'containerd/containerd'
|
||||
with:
|
||||
working-directory: src/github.com/containerd/containerd
|
||||
@@ -78,7 +78,7 @@ jobs:
|
||||
working-directory: src/github.com/containerd/containerd
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
||||
with:
|
||||
path: src/github.com/containerd/containerd
|
||||
|
||||
@@ -108,7 +108,7 @@ jobs:
|
||||
timeout-minutes: 5
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
||||
- uses: ./.github/actions/install-go
|
||||
- run: go install github.com/cpuguy83/go-md2man/v2@v2.0.2
|
||||
- run: make man
|
||||
@@ -139,7 +139,7 @@ jobs:
|
||||
goarm: "7"
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
||||
- uses: ./.github/actions/install-go
|
||||
- run: |
|
||||
set -e -x
|
||||
@@ -195,7 +195,7 @@ jobs:
|
||||
exclude:
|
||||
- os: ${{ github.repository != 'containerd/containerd' && 'arm64-8core-32gb' }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
||||
- uses: ./.github/actions/install-go
|
||||
with:
|
||||
go-version: ${{ matrix.go-version }}
|
||||
@@ -227,13 +227,13 @@ jobs:
|
||||
working-directory: src/github.com/containerd/containerd
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
||||
with:
|
||||
path: src/github.com/containerd/containerd
|
||||
|
||||
- uses: ./src/github.com/containerd/containerd/.github/actions/install-go
|
||||
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
||||
with:
|
||||
repository: kubernetes-sigs/cri-tools
|
||||
path: src/github.com/kubernetes-sigs/cri-tools
|
||||
@@ -367,7 +367,7 @@ jobs:
|
||||
}
|
||||
critest.exe --runtime-endpoint=npipe://.//pipe//containerd-containerd --test-images-file='${{env.CRI_TEST_IMAGES}}' --report-dir='${{github.workspace}}/critestreport' $skip
|
||||
|
||||
- uses: actions/upload-artifact@v4
|
||||
- uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
|
||||
if: always()
|
||||
with:
|
||||
name: TestResults ${{ matrix.os }} ${{ matrix.cgroup_driver }}
|
||||
@@ -396,7 +396,7 @@ jobs:
|
||||
env:
|
||||
GOTEST: gotestsum --
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
||||
- uses: ./.github/actions/install-go
|
||||
|
||||
- name: Install containerd dependencies
|
||||
@@ -514,7 +514,7 @@ jobs:
|
||||
sudo lsmod
|
||||
sudo dmesg -T -f kern
|
||||
|
||||
- uses: actions/upload-artifact@v4
|
||||
- uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
|
||||
if: always()
|
||||
with:
|
||||
name: TestResults ${{ matrix.runtime }} ${{matrix.runc}} ${{ matrix.os }} ${{ matrix.cgroup_driver }}
|
||||
@@ -553,8 +553,8 @@ jobs:
|
||||
cat /etc/os-release
|
||||
cat /proc/cpuinfo
|
||||
free -mt
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/cache@v4
|
||||
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
||||
- uses: actions/cache@3624ceb22c1c5a301c8db4169662070a689d9ea8 # v4.1.1
|
||||
with:
|
||||
path: /root/.vagrant.d
|
||||
key: vagrant-${{ matrix.box }}
|
||||
@@ -595,7 +595,7 @@ jobs:
|
||||
cgroup_driver: [cgroupfs, systemd]
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
||||
- name: Set up cgroup v2 delegation
|
||||
run: |
|
||||
sudo mkdir -p /etc/systemd/system/user@.service.d
|
||||
@@ -644,7 +644,7 @@ jobs:
|
||||
GOTEST: gotestsum --
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
||||
- uses: ./.github/actions/install-go
|
||||
- run: script/setup/install-gotestsum
|
||||
- run: script/setup/install-teststat
|
||||
@@ -657,7 +657,7 @@ jobs:
|
||||
if: always()
|
||||
- run: script/test/test2annotation.sh *-gotest.json
|
||||
if: always()
|
||||
- uses: actions/upload-artifact@v4
|
||||
- uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
|
||||
if: always()
|
||||
with:
|
||||
name: TestResults MacOS
|
||||
|
||||
Reference in New Issue
Block a user