Skip to content

Harden CI workflows #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
tamalsaha wants to merge 5 commits into from
Closed

Harden CI workflows #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f97e056
Harden GitHub Actions workflows
tamalsaha May 11, 2026
12025cd
Restrict /ok-to-test to org members
tamalsaha May 12, 2026
3ca9e3d
Pin GitHub Actions to commit SHAs
tamalsaha May 12, 2026
7613329
Pin docker/login-action to v4.1.0
tamalsaha May 14, 2026
58c58c9
Pin actions to commit SHAs
tamalsaha May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 15 additions & 11 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,9 @@ jobs:
outputs:
skip: ${{ steps.check_docs_only.outputs.skip }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-tags: true
fetch-depth: 0
- id: check_docs_only
# Since PR's are squashed prior to merging to the branch checked out (default branch),
Expand All @@ -39,12 +40,13 @@ jobs:
environment: deploy
steps:
- name: checkout
uses: actions/checkout@v6
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-tags: true
fetch-depth: 0

- name: install
uses: actions/setup-go@v6
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
with:
go-version-file: "go.mod"

Expand Down Expand Up @@ -77,23 +79,24 @@ jobs:
steps:

- name: set up qemu
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

- name: set up buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

- name: quay.io login
if: ${{ github.event_name != 'pull_request' }}
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
username: ${{ secrets.QUAY_USERNAME }}
password: ${{ secrets.QUAY_PASSWORD }}
registry: quay.io

# Check out repo before tag step for script.
- name: checkout
uses: actions/checkout@v6
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-tags: true
fetch-depth: 0

- name: create tags
Expand Down Expand Up @@ -123,23 +126,24 @@ jobs:
steps:

- name: set up qemu
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

- name: set up buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

- name: quay.io login
if: ${{ github.event_name != 'pull_request' }}
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
username: ${{ secrets.QUAY_USERNAME }}
password: ${{ secrets.QUAY_PASSWORD }}
registry: quay.io

# Check out repo before tag step for script.
- name: checkout
uses: actions/checkout@v6
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-tags: true
fetch-depth: 0

- name: create tags
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/freshen-images.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
git_tags: ${{ steps.tags.outputs.git_tags }}
steps:
- name: checkout
uses: actions/checkout@v6
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 0
- id: tags
Expand All @@ -35,17 +35,17 @@ jobs:
id: ["operator-sdk", "helm-operator", "scorecard-test"]
steps:
- name: set up qemu
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
- name: set up buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
- name: quay.io login
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
username: ${{ secrets.QUAY_USERNAME }}
password: ${{ secrets.QUAY_PASSWORD }}
registry: quay.io
- name: checkout
uses: actions/checkout@v6
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 1
- name: build and push
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/integration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ jobs:
outputs:
skip: ${{ steps.check_docs_only.outputs.skip }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 0
- id: check_docs_only
Expand All @@ -26,15 +26,15 @@ jobs:
needs: check_docs_only
if: needs.check_docs_only.outputs.skip != 'true'
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 0

- name: Cleanup Unused Disk Space
run: |
.github/workflows/clean-unused-disk-space.sh

- uses: actions/setup-go@v6
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
with:
go-version-file: "go.mod"
- run: make test-e2e-integration
2 changes: 1 addition & 1 deletion .github/workflows/olm-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
name: check-olm-minor-releases
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- id: run-check-olm
run: ./hack/check-olm.sh

Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/rerun.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,12 @@ on:
jobs:
rerun_tests:
name: rerun_pr_tests
if: ${{ github.event.issue.pull_request }}
if: |
github.event.issue.pull_request &&
(github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER')
runs-on: ubuntu-24.04
steps:
- uses: operator-framework/rerun-actions@v0.4.0
- uses: operator-framework/rerun-actions@6660c16a6581b198ac59545c06531a6077bf7be6 # v0.4.0
with:
repo_token: ${{ secrets.GITHUB_TOKEN }}
comment_id: ${{ github.event.comment.id }}
10 changes: 5 additions & 5 deletions .github/workflows/test-go.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
outputs:
skip: ${{ steps.check_docs_only.outputs.skip }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 0
- id: check_docs_only
Expand All @@ -29,15 +29,15 @@ jobs:
needs: check_docs_only
if: needs.check_docs_only.outputs.skip != 'true'
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 0

- name: Cleanup Unused Disk Space
run: |
.github/workflows/clean-unused-disk-space.sh

- uses: actions/setup-go@v6
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
with:
go-version-file: "go.mod"
- run: sudo rm -rf /usr/local/bin/kustomize
Expand All @@ -49,15 +49,15 @@ jobs:
needs: check_docs_only
if: needs.check_docs_only.outputs.skip != 'true'
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 0

- name: Cleanup Unused Disk Space
run: |
.github/workflows/clean-unused-disk-space.sh

- uses: actions/setup-go@v6
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
with:
go-version-file: "go.mod"
- run: make test-unit
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test-helm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ jobs:
outputs:
skip: ${{ steps.check_docs_only.outputs.skip }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 0
- id: check_docs_only
Expand All @@ -26,15 +26,15 @@ jobs:
needs: check_docs_only
if: needs.check_docs_only.outputs.skip != 'true'
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 0

- name: Cleanup Unused Disk Space
run: |
.github/workflows/clean-unused-disk-space.sh

- uses: actions/setup-go@v6
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
with:
go-version-file: "go.mod"
- run: sudo rm -rf /usr/local/bin/kustomize
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test-sample-go.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ jobs:
outputs:
skip: ${{ steps.check_docs_only.outputs.skip }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 0
- id: check_docs_only
Expand All @@ -26,15 +26,15 @@ jobs:
needs: check_docs_only
if: needs.check_docs_only.outputs.skip != 'true'
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 0

- name: Cleanup Unused Disk Space
run: |
.github/workflows/clean-unused-disk-space.sh

- uses: actions/setup-go@v6
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
with:
go-version-file: "go.mod"
- run: sudo rm -rf /usr/local/bin/kustomize
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/test-sanity.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ jobs:
outputs:
skip: ${{ steps.check_docs_only.outputs.skip }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 0
- id: check_docs_only
Expand All @@ -26,15 +26,15 @@ jobs:
needs: check_docs_only
if: needs.check_docs_only.outputs.skip != 'true'
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 0

- name: Cleanup Unused Disk Space
run: |
.github/workflows/clean-unused-disk-space.sh

- uses: actions/setup-go@v6
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
with:
go-version-file: "go.mod"
id: go
Expand All @@ -45,7 +45,7 @@ jobs:
name: docs
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
fetch-depth: 0
submodules: recursive
Expand Down
Loading