diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 729dd7f..4049fdd 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -422,7 +422,7 @@ jobs: tools: go,gon,syft,goreleaser - name: Checkout caller repo - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 with: path: _caller repository: ${{ github.event.repository.full_name }} @@ -496,13 +496,13 @@ jobs: envsubst < templates/.slsa-provenance-predicate-template.json.tmpl | tee "${GENERATED_DIR}/predicate.json" - name: Import Keychain Certs - uses: apple-actions/import-codesign-certs@v1 + uses: apple-actions/import-codesign-certs@253ddeeac23f2bdad1646faac5c8c2832e800071 # v1 with: p12-file-base64: ${{ secrets.APPLE_SIGNING_KEY_P12 }} p12-password: ${{ secrets.APPLE_SIGNING_KEY_P12_PASSWORD }} - name: Configure AWS credentials via OIDC - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5 with: role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }} aws-region: us-west-2 @@ -745,7 +745,7 @@ jobs: run: git config --system core.longpaths true - name: Checkout caller repo - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 with: path: _caller repository: ${{ github.event.repository.full_name }} @@ -942,7 +942,7 @@ jobs: ls "${CALLER_DIST}"/*.sbom.sigstore.json - name: Configure AWS credentials via OIDC - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5 with: role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }} aws-region: us-west-2 @@ -1024,7 +1024,7 @@ jobs: tools: go,goreleaser - name: Checkout caller repo - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 with: path: _caller repository: ${{ github.event.repository.full_name }} @@ -1146,7 +1146,7 @@ jobs: - name: Set up QEMU if: inputs.docker == true || inputs.lambda == true - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 with: platforms: linux/arm64 image: tonistiigi/binfmt@sha256:400a4873b838d1b89194d982c45e5fb3cda4593fbfd7e08a02e76b03b21166f0 @@ -1157,14 +1157,14 @@ jobs: - name: Configure Public ECR AWS credentials via OIDC if: inputs.docker == true - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5 with: role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }} aws-region: us-east-1 - name: Login to Public ECR if: inputs.docker == true - uses: aws-actions/amazon-ecr-login@v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2 with: registry-type: public @@ -1196,14 +1196,14 @@ jobs: - name: Configure Lambda ECR AWS credentials via OIDC if: inputs.lambda == true - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5 with: role-to-assume: "arn:aws:iam::168442440833:role/${{ steps.role-names.outputs.ecr_push_role_name }}" aws-region: us-west-2 - name: Login to Lambda ECR if: inputs.lambda == true - uses: aws-actions/amazon-ecr-login@v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2 - name: Run GoReleaser for Lambda if: inputs.lambda == true @@ -1361,7 +1361,7 @@ jobs: cosign-release: v2.5.2 - name: Configure AWS credentials via OIDC - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5 with: role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }} aws-region: us-west-2 @@ -1582,7 +1582,7 @@ jobs: tools: go - name: Checkout connector repo - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 with: path: _connector repository: ${{ github.event.repository.full_name }} @@ -1618,7 +1618,7 @@ jobs: - name: Get GitHub OIDC token for registry API id: registry-oidc - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 with: script: | const token = await core.getIDToken('connector-registry') @@ -1752,14 +1752,14 @@ jobs: # anonymous rate limit, which shared runner addresses exhaust. - name: Configure Public ECR AWS credentials via OIDC if: inputs.docker == true - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5 with: role-to-assume: arn:aws:iam::025044153841:role/GHA-PublicECRPull aws-region: us-east-1 - name: Login to Public ECR if: inputs.docker == true - uses: aws-actions/amazon-ecr-login@v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2 with: registry-type: public @@ -1789,6 +1789,7 @@ jobs: actions: read contents: read runs-on: ubuntu-latest + timeout-minutes: 5 steps: - name: Collect failure annotations id: collect-ann @@ -1849,6 +1850,7 @@ jobs: } >> "$GITHUB_OUTPUT" - name: Send Datadog event on failure + continue-on-error: true # best-effort reporting: a Datadog failure does not fail this job (the workflow is already failed) uses: masci/datadog@93a16378298f4e1980f13f6b412c0b8e66b96185 # v1 with: api-key: ${{ secrets.DATADOG_API_KEY }} diff --git a/docs/release-workflow.md b/docs/release-workflow.md index 2d60455..61d5188 100644 --- a/docs/release-workflow.md +++ b/docs/release-workflow.md @@ -276,6 +276,22 @@ Tool-using jobs set `GOTOOLCHAIN=local` at job scope. The binaries job also sets `GOSUMDB=sum.golang.org` at job scope. Cosign and bundled-buildx/QEMU setup run after trust/tool bootstrap and before their signing or AWS credentials. +### Pinned Release Action Custody + +Review and organization Actions policy own action drift. Custody below describes +explicit inputs; job-scoped credentials remain available according to permissions. + +| Action | SHA | Which job | Custody | +| --- | --- | --- | --- | +| actions/checkout | `fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` | All jobs except notify-release-failure; locked-tools gon checkout | Job-scoped `GITHUB_TOKEN`; `persist-credentials: false`. | +| actions/github-script | `f28e40c7f34bde8b3046d885e986cb6290c5673b` | record-registry-api | Job OIDC credentials; masked registry-audience token output. | +| sigstore/cosign-installer | `398d4b0eeef1380460a10c8013a76f728fb906ac` | goreleaser-binaries, goreleaser-windows, goreleaser-docker, publish-release-manifest, verify-release | Tool bootstrap in OIDC-enabled jobs; no explicit secret input. | +| apple-actions/import-codesign-certs | `253ddeeac23f2bdad1646faac5c8c2832e800071` | goreleaser-binaries | Step inputs `APPLE_SIGNING_KEY_P12` and `APPLE_SIGNING_KEY_P12_PASSWORD`. | +| aws-actions/configure-aws-credentials | `61815dcd50bd041e203e49132bacad1fd04d2708` | goreleaser-binaries, goreleaser-windows, goreleaser-docker, publish-release-manifest, verify-release | Exchanges job OIDC for scoped AWS role credentials. | +| aws-actions/amazon-ecr-login | `03f1aad4c6c7ffd436567f42f9384779290529bd` | goreleaser-docker, verify-release | Job AWS credentials; registry authentication for publishing or pulling. | +| docker/setup-qemu-action | `c7c53464625b32c7a7e944ae62b3e17d2b600130` | goreleaser-docker | Digest-pinned binfmt setup in an OIDC-enabled job; no explicit secret input. | +| masci/datadog | `93a16378298f4e1980f13f6b412c0b8e66b96185` | notify-release-failure | `DATADOG_API_KEY` (Datadog org write key), only step `with: api-key`; non-signing, notification only. Best-effort (`continue-on-error: true`), five-minute job; event-only. Re-pin review: diff the action's tag-to-SHA source; re-pinning is manual (no Renovate tracking exists for workflow SHAs). | + ### Locked Release Tools `.github/actions/locked-tools/tool-locks.txt` identifies tool versions, artifact