From 844be716041b44f191ec3c2918edd83a3e41e26c Mon Sep 17 00:00:00 2001 From: "bootc-bot[bot]" <225049296+bootc-bot[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 01:05:16 +0000 Subject: [PATCH 1/2] chore(deps): update github actions Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com> Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com> --- .github/workflows/build-bink.yaml | 2 +- .github/workflows/build-operator.yaml | 2 +- .github/workflows/ci.yaml | 8 +- .github/workflows/helm.yaml | 111 ++++++++++++++++++++++++++ .github/workflows/release.yaml | 2 +- .github/workflows/zizmor.yml | 4 +- 6 files changed, 120 insertions(+), 9 deletions(-) create mode 100644 .github/workflows/helm.yaml diff --git a/.github/workflows/build-bink.yaml b/.github/workflows/build-bink.yaml index f85e4cb4..4802b963 100644 --- a/.github/workflows/build-bink.yaml +++ b/.github/workflows/build-bink.yaml @@ -42,7 +42,7 @@ jobs: run: make build-bink - name: Upload bink binary - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: bink path: bink diff --git a/.github/workflows/build-operator.yaml b/.github/workflows/build-operator.yaml index 1b4728af..b58aa84d 100644 --- a/.github/workflows/build-operator.yaml +++ b/.github/workflows/build-operator.yaml @@ -24,7 +24,7 @@ jobs: run: podman save -o operator-image.tar bootc-operator:dev - name: Upload operator image - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: operator-image path: operator-image.tar diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index d68dd1fc..4fb6460f 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -84,7 +84,7 @@ jobs: persist-credentials: false - name: Download bink binary - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: bink path: /usr/local/bin @@ -102,7 +102,7 @@ jobs: uses: $/.github/actions/setup-bink-env - name: Download operator image - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: operator-image @@ -124,7 +124,7 @@ jobs: - name: Upload logs if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: e2e-logs-${{ matrix.kube-minor }} path: _output/logs/ @@ -141,7 +141,7 @@ jobs: IMAGE: ghcr.io/${{ github.repository }} steps: - name: Download operator image - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: operator-image diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml new file mode 100644 index 00000000..5fc3003c --- /dev/null +++ b/.github/workflows/helm.yaml @@ -0,0 +1,111 @@ +name: Helm + +on: + push: + branches: [main, release-*] + pull_request: + branches: [main, release-*] + +env: + BINK_COMMIT: c7c4013e1275f07fe6ee90be92b61d256117460f + +permissions: + contents: read + +concurrency: + group: helm-${{ github.head_ref || github.ref }} + cancel-in-progress: true + +jobs: + build-bink: + uses: $/.github/workflows/build-bink.yaml + with: + bink-commit: c7c4013e1275f07fe6ee90be92b61d256117460f + + build-operator: + uses: $/.github/workflows/build-operator.yaml + + helm-e2e: + runs-on: ubuntu-latest + needs: [build-bink, build-operator] + timeout-minutes: 30 + permissions: + contents: read + env: + BINK_NODE_DISK_IMAGE: ghcr.io/bootc-dev/bink/node@sha256:d3077c99027db0c196d5c6531ef07b8955be827651b9e3d2bc4b8e7c6ebf5612 + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Download bink binary + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: bink + path: /usr/local/bin + + - name: Make bink executable + run: chmod +x /usr/local/bin/bink + + - name: Set up Go + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + with: + go-version-file: go.mod + cache: true # zizmor: ignore[cache-poisoning] + + - name: Set up bink environment + uses: $/.github/actions/setup-bink-env + + - name: Download operator image + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: operator-image + + - name: Load operator image + run: podman load -i operator-image.tar + + - name: Start bink cluster + run: make start-bink + + - name: Build update images + run: make build-update-image + + - name: Push operator image to bink registry + run: podman push --tls-verify=false bootc-operator:dev localhost:5000/bootc-operator:dev + + - name: Generate Helm chart + run: make helm + + - name: Install Helm charts + run: | + helm dependency build ./chart/bootc-operator + helm install bootc-operator ./chart/bootc-operator \ + --kubeconfig $(pwd)/kubeconfig-e2e \ + --create-namespace --namespace bootc-operator \ + --set image.repository=registry.cluster.local:5000/bootc-operator \ + --set image.tag=dev \ + --set image.pullPolicy=Always \ + --set-json 'controller.extraArgs=["--allow-insecure-registry"]' + + - name: Verify controller is running + run: | + kubectl --kubeconfig $(pwd)/kubeconfig-e2e -n bootc-operator \ + rollout status deployment/bootc-operator-controller --timeout=3m + kubectl --kubeconfig $(pwd)/kubeconfig-e2e -n bootc-operator \ + get pods + + - name: Run e2e smoke tests + run: make e2e RUN='TestCRDSmoke|TestControllerMembership' V=1 + + - name: Gather logs on failure + if: failure() + run: make gather-bink + + - name: Upload logs + if: always() + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + with: + name: helm-e2e-logs + path: _output/logs/ + if-no-files-found: ignore diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index dc127490..b4b0fb78 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -49,7 +49,7 @@ jobs: IMAGE: ghcr.io/${{ github.repository }} steps: - name: Create GitHub App token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 id: app-token with: client-id: ${{ secrets.APP_ID }} diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index bb221978..6b80c642 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -11,7 +11,7 @@ permissions: {} jobs: zizmor: name: Scan GHA workflows - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 permissions: security-events: write # Required to upload SARIF files steps: @@ -21,4 +21,4 @@ jobs: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 From d7f87d7ff8bffe53ec4bbf02a149b6589175914b Mon Sep 17 00:00:00 2001 From: Alice Frosi Date: Mon, 19 Oct 2026 07:47:22 +0000 Subject: [PATCH 2/2] ci: fix zizmor findings in release workflow Scope the GitHub App token to contents:write only, instead of inheriting all installation permissions (github-app finding). Set persist-credentials: false on checkout so the token is not left in .git/config for the rest of the job (artipacked finding). Re-inject the token via the remote URL right before git push, keeping push functional without persisting credentials on disk. Assisted-by: AI Signed-off-by: Alice Frosi --- .github/workflows/release.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index b4b0fb78..c8556aca 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -54,11 +54,13 @@ jobs: with: client-id: ${{ secrets.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} + permission-contents: write - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + persist-credentials: false token: ${{ steps.app-token.outputs.token }} - name: Import GPG key @@ -84,12 +86,14 @@ jobs: - name: Create and push tag env: TAG: ${{ steps.version.outputs.tag }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | if git rev-parse "${TAG}" >/dev/null 2>&1; then echo "::error::Tag ${TAG} already exists" exit 1 fi git tag -s -m "Release ${TAG}" "${TAG}" + git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" git push origin "${TAG}" - name: Create release branch