From 40a63de4da2cdf2d8367a30de11e399b054297ec Mon Sep 17 00:00:00 2001 From: Nuru Date: Tue, 18 Jun 2024 14:58:31 -0700 Subject: [PATCH 1/2] Use cloudsmith action 0.5.4 -> 0.6.10, new builder hosted by ghcr.io --- .github/package-template.yml | 43 +++++++++++-------- .../amazon-ecr-credential-helper.yml | 43 +++++++++++-------- .github/workflows/amtool.yml | 43 +++++++++++-------- .github/workflows/argocd.yml | 43 +++++++++++-------- .github/workflows/assume-role.yml | 43 +++++++++++-------- .github/workflows/atlantis.yml | 43 +++++++++++-------- .github/workflows/atmos.yml | 43 +++++++++++-------- .github/workflows/awless.yml | 43 +++++++++++-------- .github/workflows/aws-copilot-cli.yml | 43 +++++++++++-------- .github/workflows/aws-iam-authenticator.yml | 43 +++++++++++-------- .github/workflows/aws-nuke.yml | 43 +++++++++++-------- .github/workflows/aws-vault.yml | 43 +++++++++++-------- .github/workflows/cfssl.yml | 43 +++++++++++-------- .github/workflows/cfssljson.yml | 43 +++++++++++-------- .github/workflows/chamber.yml | 43 +++++++++++-------- .github/workflows/cilium-cli.yml | 43 +++++++++++-------- .github/workflows/cli53.yml | 43 +++++++++++-------- .github/workflows/cloud-nuke.yml | 43 +++++++++++-------- .github/workflows/cloudflared.yml | 43 +++++++++++-------- .github/workflows/codefresh.yml | 43 +++++++++++-------- .github/workflows/conftest.yml | 43 +++++++++++-------- .github/workflows/consul.yml | 43 +++++++++++-------- .github/workflows/ctop.yml | 43 +++++++++++-------- .github/workflows/direnv.yml | 43 +++++++++++-------- .github/workflows/doctl.yml | 43 +++++++++++-------- .github/workflows/ec2-instance-selector.yml | 43 +++++++++++-------- .github/workflows/ecspresso.yml | 43 +++++++++++-------- .github/workflows/emailcli.yml | 43 +++++++++++-------- .github/workflows/envcli.yml | 43 +++++++++++-------- .github/workflows/fetch.yml | 43 +++++++++++-------- .github/workflows/figurine.yml | 43 +++++++++++-------- .github/workflows/fzf.yml | 43 +++++++++++-------- .github/workflows/gh.yml | 43 +++++++++++-------- .github/workflows/ghr.yml | 43 +++++++++++-------- .github/workflows/github-commenter.yml | 43 +++++++++++-------- .github/workflows/github-release.yml | 43 +++++++++++-------- .github/workflows/github-status-updater.yml | 43 +++++++++++-------- .github/workflows/gitleaks.yml | 43 +++++++++++-------- .github/workflows/go-jsonnet.yml | 43 +++++++++++-------- .github/workflows/gomplate.yml | 43 +++++++++++-------- .github/workflows/gonsul.yml | 43 +++++++++++-------- .github/workflows/goofys.yml | 43 +++++++++++-------- .github/workflows/gosu.yml | 43 +++++++++++-------- .github/workflows/gotop.yml | 43 +++++++++++-------- .github/workflows/grpcurl.yml | 43 +++++++++++-------- .github/workflows/hcledit.yml | 43 +++++++++++-------- .github/workflows/helm.yml | 43 +++++++++++-------- .github/workflows/helm2.yml | 43 +++++++++++-------- .github/workflows/helm3.yml | 43 +++++++++++-------- .github/workflows/helmfile.yml | 43 +++++++++++-------- .github/workflows/htmltest.yml | 43 +++++++++++-------- .github/workflows/hugo.yml | 43 +++++++++++-------- .github/workflows/infracost.yml | 43 +++++++++++-------- .github/workflows/jp.yml | 43 +++++++++++-------- .github/workflows/json2hcl.yml | 43 +++++++++++-------- .github/workflows/jx.yml | 43 +++++++++++-------- .github/workflows/k3d.yml | 43 +++++++++++-------- .github/workflows/k6.yml | 43 +++++++++++-------- .github/workflows/k9s.yml | 43 +++++++++++-------- .github/workflows/katafygio.yml | 43 +++++++++++-------- .github/workflows/kfctl.yml | 43 +++++++++++-------- .github/workflows/kind.yml | 43 +++++++++++-------- .github/workflows/kops.yml | 43 +++++++++++-------- .github/workflows/krew.yml | 43 +++++++++++-------- .github/workflows/kubecron.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.13.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.14.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.15.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.16.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.17.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.18.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.19.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.20.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.21.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.22.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.23.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.24.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.25.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.26.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.27.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.28.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.29.yml | 43 +++++++++++-------- .github/workflows/kubectl-1.30.yml | 43 +++++++++++-------- .github/workflows/kubectl.yml | 43 +++++++++++-------- .github/workflows/kubectx.yml | 43 +++++++++++-------- .github/workflows/kubens.yml | 43 +++++++++++-------- .github/workflows/kubeval.yml | 43 +++++++++++-------- .github/workflows/lazydocker.yml | 43 +++++++++++-------- .github/workflows/lectl.yml | 43 +++++++++++-------- .github/workflows/minikube.yml | 43 +++++++++++-------- .github/workflows/misspell.yml | 43 +++++++++++-------- .github/workflows/opa.yml | 43 +++++++++++-------- .github/workflows/pack.yml | 43 +++++++++++-------- .github/workflows/packer.yml | 43 +++++++++++-------- .github/workflows/pandoc.yml | 43 +++++++++++-------- .github/workflows/pgmetrics.yml | 43 +++++++++++-------- .github/workflows/pluto.yml | 43 +++++++++++-------- .github/workflows/popeye.yml | 43 +++++++++++-------- .github/workflows/promtool.yml | 43 +++++++++++-------- .github/workflows/rainbow-text.yml | 43 +++++++++++-------- .github/workflows/rakkess.yml | 43 +++++++++++-------- .github/workflows/rancher.yml | 43 +++++++++++-------- .github/workflows/rbac-lookup.yml | 43 +++++++++++-------- .github/workflows/saml2aws.yml | 43 +++++++++++-------- .github/workflows/sentry-cli.yml | 43 +++++++++++-------- .github/workflows/shellcheck.yml | 43 +++++++++++-------- .github/workflows/shfmt.yml | 43 +++++++++++-------- .github/workflows/slack-notifier.yml | 43 +++++++++++-------- .github/workflows/sops.yml | 43 +++++++++++-------- .github/workflows/spacectl.yml | 43 +++++++++++-------- .github/workflows/spotctl.yml | 43 +++++++++++-------- .github/workflows/sshm.yml | 43 +++++++++++-------- .github/workflows/stern.yml | 43 +++++++++++-------- .github/workflows/sudosh.yml | 43 +++++++++++-------- .github/workflows/teleport-4.3.yml | 43 +++++++++++-------- .github/workflows/teleport-4.4.yml | 43 +++++++++++-------- .github/workflows/teleport-5.0.yml | 43 +++++++++++-------- .github/workflows/teleport.yml | 43 +++++++++++-------- .github/workflows/terraform-0.11.yml | 43 +++++++++++-------- .github/workflows/terraform-0.12.yml | 43 +++++++++++-------- .github/workflows/terraform-0.13.yml | 43 +++++++++++-------- .github/workflows/terraform-0.14.yml | 43 +++++++++++-------- .github/workflows/terraform-0.15.yml | 43 +++++++++++-------- .github/workflows/terraform-1.yml | 43 +++++++++++-------- .../workflows/terraform-config-inspect.yml | 43 +++++++++++-------- .github/workflows/terraform-docs.yml | 43 +++++++++++-------- .../workflows/terraform-module-versions.yml | 43 +++++++++++-------- .github/workflows/terraform.yml | 43 +++++++++++-------- .github/workflows/terraform_0.11.yml | 43 +++++++++++-------- .github/workflows/terraform_0.12.yml | 43 +++++++++++-------- .github/workflows/terraform_0.13.yml | 43 +++++++++++-------- .github/workflows/terragrunt.yml | 43 +++++++++++-------- .github/workflows/terrahelp.yml | 43 +++++++++++-------- .github/workflows/tflint.yml | 43 +++++++++++-------- .github/workflows/tfschema.yml | 43 +++++++++++-------- .github/workflows/tfsec.yml | 43 +++++++++++-------- .github/workflows/thanos.yml | 43 +++++++++++-------- .github/workflows/trivy.yml | 43 +++++++++++-------- .github/workflows/variant.yml | 43 +++++++++++-------- .github/workflows/variant2.yml | 43 +++++++++++-------- .github/workflows/vault.yml | 43 +++++++++++-------- .github/workflows/velero.yml | 43 +++++++++++-------- .github/workflows/vendir.yml | 43 +++++++++++-------- .github/workflows/venona.yml | 43 +++++++++++-------- .github/workflows/vert.yml | 43 +++++++++++-------- .github/workflows/yajsv.yml | 43 +++++++++++-------- .github/workflows/yq.yml | 43 +++++++++++-------- 147 files changed, 3528 insertions(+), 2793 deletions(-) diff --git a/.github/package-template.yml b/.github/package-template.yml index 406617dbc1..28f99449d8 100644 --- a/.github/package-template.yml +++ b/.github/package-template.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/%PACKAGE_NAME%/** - - .github/workflows/%PACKAGE_NAME%.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/%PACKAGE_NAME%.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/%PACKAGE_NAME%/** - .github/workflows/%PACKAGE_NAME%.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: %PACKAGE_NAME%_VERSION: ${{ inputs.package_version_override }} %PACKAGE_NAME%_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-%PACKAGE_JSON_NAME%: needs: matrix-%PACKAGE_JSON_NAME% if: github.event_name != 'schedule' && needs.matrix-%PACKAGE_JSON_NAME%.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/amazon-ecr-credential-helper.yml b/.github/workflows/amazon-ecr-credential-helper.yml index 79e5352388..1b215d3f65 100644 --- a/.github/workflows/amazon-ecr-credential-helper.yml +++ b/.github/workflows/amazon-ecr-credential-helper.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/amazon-ecr-credential-helper/** - - .github/workflows/amazon-ecr-credential-helper.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/amazon-ecr-credential-helper.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/amazon-ecr-credential-helper/** - .github/workflows/amazon-ecr-credential-helper.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: amazon-ecr-credential-helper_VERSION: ${{ inputs.package_version_override }} amazon-ecr-credential-helper_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-amazon-ecr-credential-helper: needs: matrix-amazon-ecr-credential-helper if: github.event_name != 'schedule' && needs.matrix-amazon-ecr-credential-helper.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/amtool.yml b/.github/workflows/amtool.yml index ea1aa8ac4c..3a53922e74 100644 --- a/.github/workflows/amtool.yml +++ b/.github/workflows/amtool.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/amtool/** - - .github/workflows/amtool.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/amtool.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/amtool/** - .github/workflows/amtool.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: amtool_VERSION: ${{ inputs.package_version_override }} amtool_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-amtool: needs: matrix-amtool if: github.event_name != 'schedule' && needs.matrix-amtool.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/argocd.yml b/.github/workflows/argocd.yml index 74f0f65b2a..5955a06745 100644 --- a/.github/workflows/argocd.yml +++ b/.github/workflows/argocd.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/argocd/** - - .github/workflows/argocd.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/argocd.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/argocd/** - .github/workflows/argocd.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: argocd_VERSION: ${{ inputs.package_version_override }} argocd_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-argocd: needs: matrix-argocd if: github.event_name != 'schedule' && needs.matrix-argocd.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/assume-role.yml b/.github/workflows/assume-role.yml index 2829944318..4ab28c085f 100644 --- a/.github/workflows/assume-role.yml +++ b/.github/workflows/assume-role.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/assume-role/** - - .github/workflows/assume-role.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/assume-role.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/assume-role/** - .github/workflows/assume-role.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: assume-role_VERSION: ${{ inputs.package_version_override }} assume-role_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-assume-role: needs: matrix-assume-role if: github.event_name != 'schedule' && needs.matrix-assume-role.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/atlantis.yml b/.github/workflows/atlantis.yml index f9070e6a75..b4c33330ee 100644 --- a/.github/workflows/atlantis.yml +++ b/.github/workflows/atlantis.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/atlantis/** - - .github/workflows/atlantis.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/atlantis.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/atlantis/** - .github/workflows/atlantis.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: atlantis_VERSION: ${{ inputs.package_version_override }} atlantis_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-atlantis: needs: matrix-atlantis if: github.event_name != 'schedule' && needs.matrix-atlantis.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/atmos.yml b/.github/workflows/atmos.yml index dda3eec72f..5b78d8e903 100644 --- a/.github/workflows/atmos.yml +++ b/.github/workflows/atmos.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/atmos/** - - .github/workflows/atmos.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/atmos.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/atmos/** - .github/workflows/atmos.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: atmos_VERSION: ${{ inputs.package_version_override }} atmos_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-atmos: needs: matrix-atmos if: github.event_name != 'schedule' && needs.matrix-atmos.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/awless.yml b/.github/workflows/awless.yml index 86634a44f6..68287e4d32 100644 --- a/.github/workflows/awless.yml +++ b/.github/workflows/awless.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/awless/** - - .github/workflows/awless.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/awless.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/awless/** - .github/workflows/awless.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: awless_VERSION: ${{ inputs.package_version_override }} awless_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-awless: needs: matrix-awless if: github.event_name != 'schedule' && needs.matrix-awless.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/aws-copilot-cli.yml b/.github/workflows/aws-copilot-cli.yml index 0f01820527..0d42ee9f26 100644 --- a/.github/workflows/aws-copilot-cli.yml +++ b/.github/workflows/aws-copilot-cli.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/aws-copilot-cli/** - - .github/workflows/aws-copilot-cli.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/aws-copilot-cli.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/aws-copilot-cli/** - .github/workflows/aws-copilot-cli.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: aws-copilot-cli_VERSION: ${{ inputs.package_version_override }} aws-copilot-cli_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-aws-copilot-cli: needs: matrix-aws-copilot-cli if: github.event_name != 'schedule' && needs.matrix-aws-copilot-cli.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/aws-iam-authenticator.yml b/.github/workflows/aws-iam-authenticator.yml index ff8fcc626f..8d6028d34d 100644 --- a/.github/workflows/aws-iam-authenticator.yml +++ b/.github/workflows/aws-iam-authenticator.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/aws-iam-authenticator/** - - .github/workflows/aws-iam-authenticator.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/aws-iam-authenticator.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/aws-iam-authenticator/** - .github/workflows/aws-iam-authenticator.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: aws-iam-authenticator_VERSION: ${{ inputs.package_version_override }} aws-iam-authenticator_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-aws-iam-authenticator: needs: matrix-aws-iam-authenticator if: github.event_name != 'schedule' && needs.matrix-aws-iam-authenticator.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/aws-nuke.yml b/.github/workflows/aws-nuke.yml index d77b9d2ed8..4a94746f21 100644 --- a/.github/workflows/aws-nuke.yml +++ b/.github/workflows/aws-nuke.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/aws-nuke/** - - .github/workflows/aws-nuke.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/aws-nuke.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/aws-nuke/** - .github/workflows/aws-nuke.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: aws-nuke_VERSION: ${{ inputs.package_version_override }} aws-nuke_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-aws-nuke: needs: matrix-aws-nuke if: github.event_name != 'schedule' && needs.matrix-aws-nuke.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/aws-vault.yml b/.github/workflows/aws-vault.yml index b9d7391b2d..33a05c9994 100644 --- a/.github/workflows/aws-vault.yml +++ b/.github/workflows/aws-vault.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/aws-vault/** - - .github/workflows/aws-vault.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/aws-vault.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/aws-vault/** - .github/workflows/aws-vault.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: aws-vault_VERSION: ${{ inputs.package_version_override }} aws-vault_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-aws-vault: needs: matrix-aws-vault if: github.event_name != 'schedule' && needs.matrix-aws-vault.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/cfssl.yml b/.github/workflows/cfssl.yml index db9d9ff78d..ffb5829260 100644 --- a/.github/workflows/cfssl.yml +++ b/.github/workflows/cfssl.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/cfssl/** - - .github/workflows/cfssl.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/cfssl.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/cfssl/** - .github/workflows/cfssl.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: cfssl_VERSION: ${{ inputs.package_version_override }} cfssl_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-cfssl: needs: matrix-cfssl if: github.event_name != 'schedule' && needs.matrix-cfssl.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/cfssljson.yml b/.github/workflows/cfssljson.yml index c2641b4869..a3e30df864 100644 --- a/.github/workflows/cfssljson.yml +++ b/.github/workflows/cfssljson.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/cfssljson/** - - .github/workflows/cfssljson.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/cfssljson.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/cfssljson/** - .github/workflows/cfssljson.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: cfssljson_VERSION: ${{ inputs.package_version_override }} cfssljson_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-cfssljson: needs: matrix-cfssljson if: github.event_name != 'schedule' && needs.matrix-cfssljson.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/chamber.yml b/.github/workflows/chamber.yml index af94ecf828..622112e4f7 100644 --- a/.github/workflows/chamber.yml +++ b/.github/workflows/chamber.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/chamber/** - - .github/workflows/chamber.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/chamber.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/chamber/** - .github/workflows/chamber.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: chamber_VERSION: ${{ inputs.package_version_override }} chamber_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-chamber: needs: matrix-chamber if: github.event_name != 'schedule' && needs.matrix-chamber.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/cilium-cli.yml b/.github/workflows/cilium-cli.yml index e90a8505fa..56be18c931 100644 --- a/.github/workflows/cilium-cli.yml +++ b/.github/workflows/cilium-cli.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/cilium-cli/** - - .github/workflows/cilium-cli.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/cilium-cli.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/cilium-cli/** - .github/workflows/cilium-cli.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: cilium-cli_VERSION: ${{ inputs.package_version_override }} cilium-cli_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-cilium-cli: needs: matrix-cilium-cli if: github.event_name != 'schedule' && needs.matrix-cilium-cli.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/cli53.yml b/.github/workflows/cli53.yml index 44f6ce2f75..832d34b496 100644 --- a/.github/workflows/cli53.yml +++ b/.github/workflows/cli53.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/cli53/** - - .github/workflows/cli53.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/cli53.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/cli53/** - .github/workflows/cli53.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: cli53_VERSION: ${{ inputs.package_version_override }} cli53_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-cli53: needs: matrix-cli53 if: github.event_name != 'schedule' && needs.matrix-cli53.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/cloud-nuke.yml b/.github/workflows/cloud-nuke.yml index 0b260d59c8..62aae50a40 100644 --- a/.github/workflows/cloud-nuke.yml +++ b/.github/workflows/cloud-nuke.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/cloud-nuke/** - - .github/workflows/cloud-nuke.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/cloud-nuke.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/cloud-nuke/** - .github/workflows/cloud-nuke.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: cloud-nuke_VERSION: ${{ inputs.package_version_override }} cloud-nuke_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-cloud-nuke: needs: matrix-cloud-nuke if: github.event_name != 'schedule' && needs.matrix-cloud-nuke.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/cloudflared.yml b/.github/workflows/cloudflared.yml index e6b9f371ac..cb44742c6e 100644 --- a/.github/workflows/cloudflared.yml +++ b/.github/workflows/cloudflared.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/cloudflared/** - - .github/workflows/cloudflared.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/cloudflared.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/cloudflared/** - .github/workflows/cloudflared.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: cloudflared_VERSION: ${{ inputs.package_version_override }} cloudflared_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-cloudflared: needs: matrix-cloudflared if: github.event_name != 'schedule' && needs.matrix-cloudflared.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/codefresh.yml b/.github/workflows/codefresh.yml index 9d62dcb144..73ceda9ab9 100644 --- a/.github/workflows/codefresh.yml +++ b/.github/workflows/codefresh.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/codefresh/** - - .github/workflows/codefresh.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/codefresh.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/codefresh/** - .github/workflows/codefresh.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: codefresh_VERSION: ${{ inputs.package_version_override }} codefresh_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-codefresh: needs: matrix-codefresh if: github.event_name != 'schedule' && needs.matrix-codefresh.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/conftest.yml b/.github/workflows/conftest.yml index 2ae67b22b3..d6a5153317 100644 --- a/.github/workflows/conftest.yml +++ b/.github/workflows/conftest.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/conftest/** - - .github/workflows/conftest.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/conftest.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/conftest/** - .github/workflows/conftest.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: conftest_VERSION: ${{ inputs.package_version_override }} conftest_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-conftest: needs: matrix-conftest if: github.event_name != 'schedule' && needs.matrix-conftest.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/consul.yml b/.github/workflows/consul.yml index decb82380f..5849da5fed 100644 --- a/.github/workflows/consul.yml +++ b/.github/workflows/consul.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/consul/** - - .github/workflows/consul.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/consul.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/consul/** - .github/workflows/consul.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: consul_VERSION: ${{ inputs.package_version_override }} consul_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-consul: needs: matrix-consul if: github.event_name != 'schedule' && needs.matrix-consul.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/ctop.yml b/.github/workflows/ctop.yml index b5d295277d..000ea43360 100644 --- a/.github/workflows/ctop.yml +++ b/.github/workflows/ctop.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/ctop/** - - .github/workflows/ctop.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/ctop.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/ctop/** - .github/workflows/ctop.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: ctop_VERSION: ${{ inputs.package_version_override }} ctop_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-ctop: needs: matrix-ctop if: github.event_name != 'schedule' && needs.matrix-ctop.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/direnv.yml b/.github/workflows/direnv.yml index 70d31705db..244cac80c3 100644 --- a/.github/workflows/direnv.yml +++ b/.github/workflows/direnv.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/direnv/** - - .github/workflows/direnv.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/direnv.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/direnv/** - .github/workflows/direnv.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: direnv_VERSION: ${{ inputs.package_version_override }} direnv_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-direnv: needs: matrix-direnv if: github.event_name != 'schedule' && needs.matrix-direnv.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/doctl.yml b/.github/workflows/doctl.yml index 8f508941a7..5be8485ef1 100644 --- a/.github/workflows/doctl.yml +++ b/.github/workflows/doctl.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/doctl/** - - .github/workflows/doctl.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/doctl.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/doctl/** - .github/workflows/doctl.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: doctl_VERSION: ${{ inputs.package_version_override }} doctl_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-doctl: needs: matrix-doctl if: github.event_name != 'schedule' && needs.matrix-doctl.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/ec2-instance-selector.yml b/.github/workflows/ec2-instance-selector.yml index 4f4173ad21..90dfecfd52 100644 --- a/.github/workflows/ec2-instance-selector.yml +++ b/.github/workflows/ec2-instance-selector.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/ec2-instance-selector/** - - .github/workflows/ec2-instance-selector.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/ec2-instance-selector.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/ec2-instance-selector/** - .github/workflows/ec2-instance-selector.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: ec2-instance-selector_VERSION: ${{ inputs.package_version_override }} ec2-instance-selector_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-ec2-instance-selector: needs: matrix-ec2-instance-selector if: github.event_name != 'schedule' && needs.matrix-ec2-instance-selector.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/ecspresso.yml b/.github/workflows/ecspresso.yml index 483216c7ec..7979a76778 100644 --- a/.github/workflows/ecspresso.yml +++ b/.github/workflows/ecspresso.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/ecspresso/** - - .github/workflows/ecspresso.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/ecspresso.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/ecspresso/** - .github/workflows/ecspresso.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: ecspresso_VERSION: ${{ inputs.package_version_override }} ecspresso_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-ecspresso: needs: matrix-ecspresso if: github.event_name != 'schedule' && needs.matrix-ecspresso.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/emailcli.yml b/.github/workflows/emailcli.yml index 3adcf91f48..95f0303840 100644 --- a/.github/workflows/emailcli.yml +++ b/.github/workflows/emailcli.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/emailcli/** - - .github/workflows/emailcli.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/emailcli.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/emailcli/** - .github/workflows/emailcli.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: emailcli_VERSION: ${{ inputs.package_version_override }} emailcli_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-emailcli: needs: matrix-emailcli if: github.event_name != 'schedule' && needs.matrix-emailcli.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/envcli.yml b/.github/workflows/envcli.yml index 4e34f3a1ca..86d903316a 100644 --- a/.github/workflows/envcli.yml +++ b/.github/workflows/envcli.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/envcli/** - - .github/workflows/envcli.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/envcli.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/envcli/** - .github/workflows/envcli.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: envcli_VERSION: ${{ inputs.package_version_override }} envcli_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-envcli: needs: matrix-envcli if: github.event_name != 'schedule' && needs.matrix-envcli.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/fetch.yml b/.github/workflows/fetch.yml index aa9d3acc08..8b1f5ee03f 100644 --- a/.github/workflows/fetch.yml +++ b/.github/workflows/fetch.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/fetch/** - - .github/workflows/fetch.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/fetch.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/fetch/** - .github/workflows/fetch.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: fetch_VERSION: ${{ inputs.package_version_override }} fetch_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-fetch: needs: matrix-fetch if: github.event_name != 'schedule' && needs.matrix-fetch.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/figurine.yml b/.github/workflows/figurine.yml index 72d820747c..f7c58f06cf 100644 --- a/.github/workflows/figurine.yml +++ b/.github/workflows/figurine.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/figurine/** - - .github/workflows/figurine.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/figurine.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/figurine/** - .github/workflows/figurine.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: figurine_VERSION: ${{ inputs.package_version_override }} figurine_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-figurine: needs: matrix-figurine if: github.event_name != 'schedule' && needs.matrix-figurine.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/fzf.yml b/.github/workflows/fzf.yml index 95258ddd84..a0d0f056b6 100644 --- a/.github/workflows/fzf.yml +++ b/.github/workflows/fzf.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/fzf/** - - .github/workflows/fzf.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/fzf.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/fzf/** - .github/workflows/fzf.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: fzf_VERSION: ${{ inputs.package_version_override }} fzf_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-fzf: needs: matrix-fzf if: github.event_name != 'schedule' && needs.matrix-fzf.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/gh.yml b/.github/workflows/gh.yml index 72b08f6cfb..9b13f47124 100644 --- a/.github/workflows/gh.yml +++ b/.github/workflows/gh.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/gh/** - - .github/workflows/gh.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/gh.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/gh/** - .github/workflows/gh.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: gh_VERSION: ${{ inputs.package_version_override }} gh_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-gh: needs: matrix-gh if: github.event_name != 'schedule' && needs.matrix-gh.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/ghr.yml b/.github/workflows/ghr.yml index 5416fe3abc..7ef760a330 100644 --- a/.github/workflows/ghr.yml +++ b/.github/workflows/ghr.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/ghr/** - - .github/workflows/ghr.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/ghr.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/ghr/** - .github/workflows/ghr.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: ghr_VERSION: ${{ inputs.package_version_override }} ghr_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-ghr: needs: matrix-ghr if: github.event_name != 'schedule' && needs.matrix-ghr.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/github-commenter.yml b/.github/workflows/github-commenter.yml index 4188db9eb8..f7a9ba911b 100644 --- a/.github/workflows/github-commenter.yml +++ b/.github/workflows/github-commenter.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/github-commenter/** - - .github/workflows/github-commenter.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/github-commenter.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/github-commenter/** - .github/workflows/github-commenter.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: github-commenter_VERSION: ${{ inputs.package_version_override }} github-commenter_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-github-commenter: needs: matrix-github-commenter if: github.event_name != 'schedule' && needs.matrix-github-commenter.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/github-release.yml b/.github/workflows/github-release.yml index 7d49dac6ab..7640462c4c 100644 --- a/.github/workflows/github-release.yml +++ b/.github/workflows/github-release.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/github-release/** - - .github/workflows/github-release.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/github-release.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/github-release/** - .github/workflows/github-release.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: github-release_VERSION: ${{ inputs.package_version_override }} github-release_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-github-release: needs: matrix-github-release if: github.event_name != 'schedule' && needs.matrix-github-release.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/github-status-updater.yml b/.github/workflows/github-status-updater.yml index c224d99b3b..1cf76b0dad 100644 --- a/.github/workflows/github-status-updater.yml +++ b/.github/workflows/github-status-updater.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/github-status-updater/** - - .github/workflows/github-status-updater.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/github-status-updater.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/github-status-updater/** - .github/workflows/github-status-updater.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: github-status-updater_VERSION: ${{ inputs.package_version_override }} github-status-updater_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-github-status-updater: needs: matrix-github-status-updater if: github.event_name != 'schedule' && needs.matrix-github-status-updater.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml index c80d831ccc..08f879b500 100644 --- a/.github/workflows/gitleaks.yml +++ b/.github/workflows/gitleaks.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/gitleaks/** - - .github/workflows/gitleaks.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/gitleaks.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/gitleaks/** - .github/workflows/gitleaks.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: gitleaks_VERSION: ${{ inputs.package_version_override }} gitleaks_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-gitleaks: needs: matrix-gitleaks if: github.event_name != 'schedule' && needs.matrix-gitleaks.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/go-jsonnet.yml b/.github/workflows/go-jsonnet.yml index faa7154773..170e2e3d8b 100644 --- a/.github/workflows/go-jsonnet.yml +++ b/.github/workflows/go-jsonnet.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/go-jsonnet/** - - .github/workflows/go-jsonnet.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/go-jsonnet.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/go-jsonnet/** - .github/workflows/go-jsonnet.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: go-jsonnet_VERSION: ${{ inputs.package_version_override }} go-jsonnet_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-go-jsonnet: needs: matrix-go-jsonnet if: github.event_name != 'schedule' && needs.matrix-go-jsonnet.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/gomplate.yml b/.github/workflows/gomplate.yml index 1993a30162..de22f13eba 100644 --- a/.github/workflows/gomplate.yml +++ b/.github/workflows/gomplate.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/gomplate/** - - .github/workflows/gomplate.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/gomplate.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/gomplate/** - .github/workflows/gomplate.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: gomplate_VERSION: ${{ inputs.package_version_override }} gomplate_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-gomplate: needs: matrix-gomplate if: github.event_name != 'schedule' && needs.matrix-gomplate.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/gonsul.yml b/.github/workflows/gonsul.yml index 1b396fce3c..12fefb5e1e 100644 --- a/.github/workflows/gonsul.yml +++ b/.github/workflows/gonsul.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/gonsul/** - - .github/workflows/gonsul.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/gonsul.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/gonsul/** - .github/workflows/gonsul.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: gonsul_VERSION: ${{ inputs.package_version_override }} gonsul_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-gonsul: needs: matrix-gonsul if: github.event_name != 'schedule' && needs.matrix-gonsul.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/goofys.yml b/.github/workflows/goofys.yml index fd25716638..73164338d6 100644 --- a/.github/workflows/goofys.yml +++ b/.github/workflows/goofys.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/goofys/** - - .github/workflows/goofys.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/goofys.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/goofys/** - .github/workflows/goofys.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: goofys_VERSION: ${{ inputs.package_version_override }} goofys_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-goofys: needs: matrix-goofys if: github.event_name != 'schedule' && needs.matrix-goofys.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/gosu.yml b/.github/workflows/gosu.yml index be83d797e8..fda5f32d2d 100644 --- a/.github/workflows/gosu.yml +++ b/.github/workflows/gosu.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/gosu/** - - .github/workflows/gosu.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/gosu.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/gosu/** - .github/workflows/gosu.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: gosu_VERSION: ${{ inputs.package_version_override }} gosu_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-gosu: needs: matrix-gosu if: github.event_name != 'schedule' && needs.matrix-gosu.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/gotop.yml b/.github/workflows/gotop.yml index 731e71eb15..5d559e27bc 100644 --- a/.github/workflows/gotop.yml +++ b/.github/workflows/gotop.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/gotop/** - - .github/workflows/gotop.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/gotop.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/gotop/** - .github/workflows/gotop.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: gotop_VERSION: ${{ inputs.package_version_override }} gotop_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-gotop: needs: matrix-gotop if: github.event_name != 'schedule' && needs.matrix-gotop.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/grpcurl.yml b/.github/workflows/grpcurl.yml index 44b07d338d..6d5f08d096 100644 --- a/.github/workflows/grpcurl.yml +++ b/.github/workflows/grpcurl.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/grpcurl/** - - .github/workflows/grpcurl.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/grpcurl.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/grpcurl/** - .github/workflows/grpcurl.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: grpcurl_VERSION: ${{ inputs.package_version_override }} grpcurl_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-grpcurl: needs: matrix-grpcurl if: github.event_name != 'schedule' && needs.matrix-grpcurl.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/hcledit.yml b/.github/workflows/hcledit.yml index 8f19780946..be548d6f0d 100644 --- a/.github/workflows/hcledit.yml +++ b/.github/workflows/hcledit.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/hcledit/** - - .github/workflows/hcledit.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/hcledit.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/hcledit/** - .github/workflows/hcledit.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: hcledit_VERSION: ${{ inputs.package_version_override }} hcledit_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-hcledit: needs: matrix-hcledit if: github.event_name != 'schedule' && needs.matrix-hcledit.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml index f6ec1d892a..19f92b74e4 100644 --- a/.github/workflows/helm.yml +++ b/.github/workflows/helm.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/helm/** - - .github/workflows/helm.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/helm.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/helm/** - .github/workflows/helm.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: helm_VERSION: ${{ inputs.package_version_override }} helm_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-helm: needs: matrix-helm if: github.event_name != 'schedule' && needs.matrix-helm.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/helm2.yml b/.github/workflows/helm2.yml index 813bd7678d..05a951816c 100644 --- a/.github/workflows/helm2.yml +++ b/.github/workflows/helm2.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/helm2/** - - .github/workflows/helm2.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/helm2.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/helm2/** - .github/workflows/helm2.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: helm2_VERSION: ${{ inputs.package_version_override }} helm2_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-helm2: needs: matrix-helm2 if: github.event_name != 'schedule' && needs.matrix-helm2.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/helm3.yml b/.github/workflows/helm3.yml index 937ef09f3d..a2983e5f4c 100644 --- a/.github/workflows/helm3.yml +++ b/.github/workflows/helm3.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/helm3/** - - .github/workflows/helm3.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/helm3.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/helm3/** - .github/workflows/helm3.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: helm3_VERSION: ${{ inputs.package_version_override }} helm3_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-helm3: needs: matrix-helm3 if: github.event_name != 'schedule' && needs.matrix-helm3.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/helmfile.yml b/.github/workflows/helmfile.yml index ac34c51468..3739f1b807 100644 --- a/.github/workflows/helmfile.yml +++ b/.github/workflows/helmfile.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/helmfile/** - - .github/workflows/helmfile.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/helmfile.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/helmfile/** - .github/workflows/helmfile.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: helmfile_VERSION: ${{ inputs.package_version_override }} helmfile_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-helmfile: needs: matrix-helmfile if: github.event_name != 'schedule' && needs.matrix-helmfile.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/htmltest.yml b/.github/workflows/htmltest.yml index 55c1bfb2d9..4e68dff55d 100644 --- a/.github/workflows/htmltest.yml +++ b/.github/workflows/htmltest.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/htmltest/** - - .github/workflows/htmltest.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/htmltest.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/htmltest/** - .github/workflows/htmltest.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: htmltest_VERSION: ${{ inputs.package_version_override }} htmltest_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-htmltest: needs: matrix-htmltest if: github.event_name != 'schedule' && needs.matrix-htmltest.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/hugo.yml b/.github/workflows/hugo.yml index c9715f62d4..f2e425388f 100644 --- a/.github/workflows/hugo.yml +++ b/.github/workflows/hugo.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/hugo/** - - .github/workflows/hugo.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/hugo.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/hugo/** - .github/workflows/hugo.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: hugo_VERSION: ${{ inputs.package_version_override }} hugo_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-hugo: needs: matrix-hugo if: github.event_name != 'schedule' && needs.matrix-hugo.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/infracost.yml b/.github/workflows/infracost.yml index 1633aaab80..704521f986 100644 --- a/.github/workflows/infracost.yml +++ b/.github/workflows/infracost.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/infracost/** - - .github/workflows/infracost.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/infracost.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/infracost/** - .github/workflows/infracost.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: infracost_VERSION: ${{ inputs.package_version_override }} infracost_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-infracost: needs: matrix-infracost if: github.event_name != 'schedule' && needs.matrix-infracost.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/jp.yml b/.github/workflows/jp.yml index d69d186476..8e6d1180c1 100644 --- a/.github/workflows/jp.yml +++ b/.github/workflows/jp.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/jp/** - - .github/workflows/jp.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/jp.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/jp/** - .github/workflows/jp.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: jp_VERSION: ${{ inputs.package_version_override }} jp_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-jp: needs: matrix-jp if: github.event_name != 'schedule' && needs.matrix-jp.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/json2hcl.yml b/.github/workflows/json2hcl.yml index c537cda767..53eef649d6 100644 --- a/.github/workflows/json2hcl.yml +++ b/.github/workflows/json2hcl.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/json2hcl/** - - .github/workflows/json2hcl.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/json2hcl.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/json2hcl/** - .github/workflows/json2hcl.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: json2hcl_VERSION: ${{ inputs.package_version_override }} json2hcl_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-json2hcl: needs: matrix-json2hcl if: github.event_name != 'schedule' && needs.matrix-json2hcl.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/jx.yml b/.github/workflows/jx.yml index b6f0b8f449..8c414efc82 100644 --- a/.github/workflows/jx.yml +++ b/.github/workflows/jx.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/jx/** - - .github/workflows/jx.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/jx.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/jx/** - .github/workflows/jx.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: jx_VERSION: ${{ inputs.package_version_override }} jx_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-jx: needs: matrix-jx if: github.event_name != 'schedule' && needs.matrix-jx.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/k3d.yml b/.github/workflows/k3d.yml index 361770e2b3..f01777a065 100644 --- a/.github/workflows/k3d.yml +++ b/.github/workflows/k3d.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/k3d/** - - .github/workflows/k3d.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/k3d.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/k3d/** - .github/workflows/k3d.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: k3d_VERSION: ${{ inputs.package_version_override }} k3d_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-k3d: needs: matrix-k3d if: github.event_name != 'schedule' && needs.matrix-k3d.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/k6.yml b/.github/workflows/k6.yml index cb663e3a46..52aea93e14 100644 --- a/.github/workflows/k6.yml +++ b/.github/workflows/k6.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/k6/** - - .github/workflows/k6.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/k6.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/k6/** - .github/workflows/k6.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: k6_VERSION: ${{ inputs.package_version_override }} k6_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-k6: needs: matrix-k6 if: github.event_name != 'schedule' && needs.matrix-k6.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/k9s.yml b/.github/workflows/k9s.yml index 11b2a6b47c..2ccd18c48b 100644 --- a/.github/workflows/k9s.yml +++ b/.github/workflows/k9s.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/k9s/** - - .github/workflows/k9s.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/k9s.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/k9s/** - .github/workflows/k9s.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: k9s_VERSION: ${{ inputs.package_version_override }} k9s_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-k9s: needs: matrix-k9s if: github.event_name != 'schedule' && needs.matrix-k9s.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/katafygio.yml b/.github/workflows/katafygio.yml index 7c04077ebb..e70795bcfc 100644 --- a/.github/workflows/katafygio.yml +++ b/.github/workflows/katafygio.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/katafygio/** - - .github/workflows/katafygio.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/katafygio.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/katafygio/** - .github/workflows/katafygio.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: katafygio_VERSION: ${{ inputs.package_version_override }} katafygio_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-katafygio: needs: matrix-katafygio if: github.event_name != 'schedule' && needs.matrix-katafygio.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kfctl.yml b/.github/workflows/kfctl.yml index fe2e8c406f..5d7bcb87ac 100644 --- a/.github/workflows/kfctl.yml +++ b/.github/workflows/kfctl.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kfctl/** - - .github/workflows/kfctl.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kfctl.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kfctl/** - .github/workflows/kfctl.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kfctl_VERSION: ${{ inputs.package_version_override }} kfctl_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kfctl: needs: matrix-kfctl if: github.event_name != 'schedule' && needs.matrix-kfctl.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kind.yml b/.github/workflows/kind.yml index f86db10388..03867f0568 100644 --- a/.github/workflows/kind.yml +++ b/.github/workflows/kind.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kind/** - - .github/workflows/kind.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kind.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kind/** - .github/workflows/kind.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kind_VERSION: ${{ inputs.package_version_override }} kind_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kind: needs: matrix-kind if: github.event_name != 'schedule' && needs.matrix-kind.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kops.yml b/.github/workflows/kops.yml index 77b9ebb1f7..a874183fbf 100644 --- a/.github/workflows/kops.yml +++ b/.github/workflows/kops.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kops/** - - .github/workflows/kops.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kops.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kops/** - .github/workflows/kops.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kops_VERSION: ${{ inputs.package_version_override }} kops_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kops: needs: matrix-kops if: github.event_name != 'schedule' && needs.matrix-kops.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/krew.yml b/.github/workflows/krew.yml index 148b267214..57ecc418d5 100644 --- a/.github/workflows/krew.yml +++ b/.github/workflows/krew.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/krew/** - - .github/workflows/krew.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/krew.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/krew/** - .github/workflows/krew.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: krew_VERSION: ${{ inputs.package_version_override }} krew_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-krew: needs: matrix-krew if: github.event_name != 'schedule' && needs.matrix-krew.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubecron.yml b/.github/workflows/kubecron.yml index 9c1738982d..699afe18a9 100644 --- a/.github/workflows/kubecron.yml +++ b/.github/workflows/kubecron.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubecron/** - - .github/workflows/kubecron.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubecron.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubecron/** - .github/workflows/kubecron.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubecron_VERSION: ${{ inputs.package_version_override }} kubecron_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubecron: needs: matrix-kubecron if: github.event_name != 'schedule' && needs.matrix-kubecron.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.13.yml b/.github/workflows/kubectl-1.13.yml index 40490d2d1d..13df010f02 100644 --- a/.github/workflows/kubectl-1.13.yml +++ b/.github/workflows/kubectl-1.13.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.13/** - - .github/workflows/kubectl-1.13.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.13.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.13/** - .github/workflows/kubectl-1.13.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.13_VERSION: ${{ inputs.package_version_override }} kubectl-1.13_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_13: needs: matrix-kubectl-1_13 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_13.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.14.yml b/.github/workflows/kubectl-1.14.yml index ee064401e5..16b8eae1f6 100644 --- a/.github/workflows/kubectl-1.14.yml +++ b/.github/workflows/kubectl-1.14.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.14/** - - .github/workflows/kubectl-1.14.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.14.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.14/** - .github/workflows/kubectl-1.14.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.14_VERSION: ${{ inputs.package_version_override }} kubectl-1.14_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_14: needs: matrix-kubectl-1_14 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_14.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.15.yml b/.github/workflows/kubectl-1.15.yml index da522b853a..0932ec4222 100644 --- a/.github/workflows/kubectl-1.15.yml +++ b/.github/workflows/kubectl-1.15.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.15/** - - .github/workflows/kubectl-1.15.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.15.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.15/** - .github/workflows/kubectl-1.15.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.15_VERSION: ${{ inputs.package_version_override }} kubectl-1.15_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_15: needs: matrix-kubectl-1_15 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_15.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.16.yml b/.github/workflows/kubectl-1.16.yml index 6130180701..fb8960d8a6 100644 --- a/.github/workflows/kubectl-1.16.yml +++ b/.github/workflows/kubectl-1.16.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.16/** - - .github/workflows/kubectl-1.16.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.16.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.16/** - .github/workflows/kubectl-1.16.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.16_VERSION: ${{ inputs.package_version_override }} kubectl-1.16_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_16: needs: matrix-kubectl-1_16 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_16.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.17.yml b/.github/workflows/kubectl-1.17.yml index 2ec13f5159..9b878ac093 100644 --- a/.github/workflows/kubectl-1.17.yml +++ b/.github/workflows/kubectl-1.17.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.17/** - - .github/workflows/kubectl-1.17.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.17.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.17/** - .github/workflows/kubectl-1.17.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.17_VERSION: ${{ inputs.package_version_override }} kubectl-1.17_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_17: needs: matrix-kubectl-1_17 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_17.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.18.yml b/.github/workflows/kubectl-1.18.yml index 9e9391f047..269e96091a 100644 --- a/.github/workflows/kubectl-1.18.yml +++ b/.github/workflows/kubectl-1.18.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.18/** - - .github/workflows/kubectl-1.18.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.18.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.18/** - .github/workflows/kubectl-1.18.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.18_VERSION: ${{ inputs.package_version_override }} kubectl-1.18_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_18: needs: matrix-kubectl-1_18 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_18.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.19.yml b/.github/workflows/kubectl-1.19.yml index b794b48062..6734432af5 100644 --- a/.github/workflows/kubectl-1.19.yml +++ b/.github/workflows/kubectl-1.19.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.19/** - - .github/workflows/kubectl-1.19.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.19.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.19/** - .github/workflows/kubectl-1.19.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.19_VERSION: ${{ inputs.package_version_override }} kubectl-1.19_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_19: needs: matrix-kubectl-1_19 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_19.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.20.yml b/.github/workflows/kubectl-1.20.yml index ef3bffe44c..8ca7a7ecf3 100644 --- a/.github/workflows/kubectl-1.20.yml +++ b/.github/workflows/kubectl-1.20.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.20/** - - .github/workflows/kubectl-1.20.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.20.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.20/** - .github/workflows/kubectl-1.20.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.20_VERSION: ${{ inputs.package_version_override }} kubectl-1.20_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_20: needs: matrix-kubectl-1_20 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_20.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.21.yml b/.github/workflows/kubectl-1.21.yml index 1ad2e46b39..501e4679d2 100644 --- a/.github/workflows/kubectl-1.21.yml +++ b/.github/workflows/kubectl-1.21.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.21/** - - .github/workflows/kubectl-1.21.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.21.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.21/** - .github/workflows/kubectl-1.21.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.21_VERSION: ${{ inputs.package_version_override }} kubectl-1.21_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_21: needs: matrix-kubectl-1_21 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_21.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.22.yml b/.github/workflows/kubectl-1.22.yml index 36a7e75cac..427987d0b6 100644 --- a/.github/workflows/kubectl-1.22.yml +++ b/.github/workflows/kubectl-1.22.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.22/** - - .github/workflows/kubectl-1.22.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.22.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.22/** - .github/workflows/kubectl-1.22.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.22_VERSION: ${{ inputs.package_version_override }} kubectl-1.22_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_22: needs: matrix-kubectl-1_22 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_22.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.23.yml b/.github/workflows/kubectl-1.23.yml index c82e738059..0c7b57da2a 100644 --- a/.github/workflows/kubectl-1.23.yml +++ b/.github/workflows/kubectl-1.23.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.23/** - - .github/workflows/kubectl-1.23.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.23.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.23/** - .github/workflows/kubectl-1.23.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.23_VERSION: ${{ inputs.package_version_override }} kubectl-1.23_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_23: needs: matrix-kubectl-1_23 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_23.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.24.yml b/.github/workflows/kubectl-1.24.yml index 54e1a9b078..cb5770830f 100644 --- a/.github/workflows/kubectl-1.24.yml +++ b/.github/workflows/kubectl-1.24.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.24/** - - .github/workflows/kubectl-1.24.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.24.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.24/** - .github/workflows/kubectl-1.24.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.24_VERSION: ${{ inputs.package_version_override }} kubectl-1.24_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_24: needs: matrix-kubectl-1_24 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_24.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.25.yml b/.github/workflows/kubectl-1.25.yml index 04a245a40c..2af6c8c6f1 100644 --- a/.github/workflows/kubectl-1.25.yml +++ b/.github/workflows/kubectl-1.25.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.25/** - - .github/workflows/kubectl-1.25.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.25.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.25/** - .github/workflows/kubectl-1.25.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.25_VERSION: ${{ inputs.package_version_override }} kubectl-1.25_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_25: needs: matrix-kubectl-1_25 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_25.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.26.yml b/.github/workflows/kubectl-1.26.yml index 3a22e5c19a..cdc8b37a46 100644 --- a/.github/workflows/kubectl-1.26.yml +++ b/.github/workflows/kubectl-1.26.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.26/** - - .github/workflows/kubectl-1.26.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.26.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.26/** - .github/workflows/kubectl-1.26.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.26_VERSION: ${{ inputs.package_version_override }} kubectl-1.26_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_26: needs: matrix-kubectl-1_26 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_26.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.27.yml b/.github/workflows/kubectl-1.27.yml index aa3d657dd8..b6db32d80d 100644 --- a/.github/workflows/kubectl-1.27.yml +++ b/.github/workflows/kubectl-1.27.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.27/** - - .github/workflows/kubectl-1.27.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.27.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.27/** - .github/workflows/kubectl-1.27.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.27_VERSION: ${{ inputs.package_version_override }} kubectl-1.27_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_27: needs: matrix-kubectl-1_27 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_27.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.28.yml b/.github/workflows/kubectl-1.28.yml index 83a464a385..e060ef6723 100644 --- a/.github/workflows/kubectl-1.28.yml +++ b/.github/workflows/kubectl-1.28.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.28/** - - .github/workflows/kubectl-1.28.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.28.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.28/** - .github/workflows/kubectl-1.28.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.28_VERSION: ${{ inputs.package_version_override }} kubectl-1.28_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_28: needs: matrix-kubectl-1_28 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_28.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.29.yml b/.github/workflows/kubectl-1.29.yml index 8b04cab6b5..7695506db5 100644 --- a/.github/workflows/kubectl-1.29.yml +++ b/.github/workflows/kubectl-1.29.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.29/** - - .github/workflows/kubectl-1.29.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.29.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.29/** - .github/workflows/kubectl-1.29.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.29_VERSION: ${{ inputs.package_version_override }} kubectl-1.29_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_29: needs: matrix-kubectl-1_29 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_29.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl-1.30.yml b/.github/workflows/kubectl-1.30.yml index 47bda28c7f..011bc73c94 100644 --- a/.github/workflows/kubectl-1.30.yml +++ b/.github/workflows/kubectl-1.30.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl-1.30/** - - .github/workflows/kubectl-1.30.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl-1.30.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl-1.30/** - .github/workflows/kubectl-1.30.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl-1.30_VERSION: ${{ inputs.package_version_override }} kubectl-1.30_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl-1_30: needs: matrix-kubectl-1_30 if: github.event_name != 'schedule' && needs.matrix-kubectl-1_30.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectl.yml b/.github/workflows/kubectl.yml index 185b080842..6ecc4a17f0 100644 --- a/.github/workflows/kubectl.yml +++ b/.github/workflows/kubectl.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectl/** - - .github/workflows/kubectl.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectl.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectl/** - .github/workflows/kubectl.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectl_VERSION: ${{ inputs.package_version_override }} kubectl_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectl: needs: matrix-kubectl if: github.event_name != 'schedule' && needs.matrix-kubectl.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubectx.yml b/.github/workflows/kubectx.yml index 571aa09e8d..28827a957a 100644 --- a/.github/workflows/kubectx.yml +++ b/.github/workflows/kubectx.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubectx/** - - .github/workflows/kubectx.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubectx.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubectx/** - .github/workflows/kubectx.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubectx_VERSION: ${{ inputs.package_version_override }} kubectx_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubectx: needs: matrix-kubectx if: github.event_name != 'schedule' && needs.matrix-kubectx.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubens.yml b/.github/workflows/kubens.yml index a7569e5638..221a80c528 100644 --- a/.github/workflows/kubens.yml +++ b/.github/workflows/kubens.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubens/** - - .github/workflows/kubens.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubens.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubens/** - .github/workflows/kubens.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubens_VERSION: ${{ inputs.package_version_override }} kubens_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubens: needs: matrix-kubens if: github.event_name != 'schedule' && needs.matrix-kubens.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/kubeval.yml b/.github/workflows/kubeval.yml index 82da031d4f..8d3b66aef6 100644 --- a/.github/workflows/kubeval.yml +++ b/.github/workflows/kubeval.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/kubeval/** - - .github/workflows/kubeval.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/kubeval.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/kubeval/** - .github/workflows/kubeval.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: kubeval_VERSION: ${{ inputs.package_version_override }} kubeval_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-kubeval: needs: matrix-kubeval if: github.event_name != 'schedule' && needs.matrix-kubeval.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/lazydocker.yml b/.github/workflows/lazydocker.yml index 1230a20124..5b31f46c6d 100644 --- a/.github/workflows/lazydocker.yml +++ b/.github/workflows/lazydocker.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/lazydocker/** - - .github/workflows/lazydocker.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/lazydocker.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/lazydocker/** - .github/workflows/lazydocker.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: lazydocker_VERSION: ${{ inputs.package_version_override }} lazydocker_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-lazydocker: needs: matrix-lazydocker if: github.event_name != 'schedule' && needs.matrix-lazydocker.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/lectl.yml b/.github/workflows/lectl.yml index 9760c7cf22..df151b14e2 100644 --- a/.github/workflows/lectl.yml +++ b/.github/workflows/lectl.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/lectl/** - - .github/workflows/lectl.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/lectl.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/lectl/** - .github/workflows/lectl.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: lectl_VERSION: ${{ inputs.package_version_override }} lectl_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-lectl: needs: matrix-lectl if: github.event_name != 'schedule' && needs.matrix-lectl.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/minikube.yml b/.github/workflows/minikube.yml index a824f082c0..8a5709363e 100644 --- a/.github/workflows/minikube.yml +++ b/.github/workflows/minikube.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/minikube/** - - .github/workflows/minikube.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/minikube.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/minikube/** - .github/workflows/minikube.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: minikube_VERSION: ${{ inputs.package_version_override }} minikube_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-minikube: needs: matrix-minikube if: github.event_name != 'schedule' && needs.matrix-minikube.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/misspell.yml b/.github/workflows/misspell.yml index e762fc355c..1d263cd0ee 100644 --- a/.github/workflows/misspell.yml +++ b/.github/workflows/misspell.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/misspell/** - - .github/workflows/misspell.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/misspell.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/misspell/** - .github/workflows/misspell.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: misspell_VERSION: ${{ inputs.package_version_override }} misspell_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-misspell: needs: matrix-misspell if: github.event_name != 'schedule' && needs.matrix-misspell.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/opa.yml b/.github/workflows/opa.yml index 6f944753d9..bda2ba196b 100644 --- a/.github/workflows/opa.yml +++ b/.github/workflows/opa.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/opa/** - - .github/workflows/opa.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/opa.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/opa/** - .github/workflows/opa.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: opa_VERSION: ${{ inputs.package_version_override }} opa_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-opa: needs: matrix-opa if: github.event_name != 'schedule' && needs.matrix-opa.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/pack.yml b/.github/workflows/pack.yml index bc64bb1fb9..1bc773ebea 100644 --- a/.github/workflows/pack.yml +++ b/.github/workflows/pack.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/pack/** - - .github/workflows/pack.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/pack.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/pack/** - .github/workflows/pack.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: pack_VERSION: ${{ inputs.package_version_override }} pack_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-pack: needs: matrix-pack if: github.event_name != 'schedule' && needs.matrix-pack.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/packer.yml b/.github/workflows/packer.yml index a748ba4580..1b1bce1c08 100644 --- a/.github/workflows/packer.yml +++ b/.github/workflows/packer.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/packer/** - - .github/workflows/packer.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/packer.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/packer/** - .github/workflows/packer.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: packer_VERSION: ${{ inputs.package_version_override }} packer_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-packer: needs: matrix-packer if: github.event_name != 'schedule' && needs.matrix-packer.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/pandoc.yml b/.github/workflows/pandoc.yml index 6055a314f9..34e36e4514 100644 --- a/.github/workflows/pandoc.yml +++ b/.github/workflows/pandoc.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/pandoc/** - - .github/workflows/pandoc.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/pandoc.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/pandoc/** - .github/workflows/pandoc.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: pandoc_VERSION: ${{ inputs.package_version_override }} pandoc_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-pandoc: needs: matrix-pandoc if: github.event_name != 'schedule' && needs.matrix-pandoc.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/pgmetrics.yml b/.github/workflows/pgmetrics.yml index 44d5675709..494a5ef2a5 100644 --- a/.github/workflows/pgmetrics.yml +++ b/.github/workflows/pgmetrics.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/pgmetrics/** - - .github/workflows/pgmetrics.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/pgmetrics.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/pgmetrics/** - .github/workflows/pgmetrics.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: pgmetrics_VERSION: ${{ inputs.package_version_override }} pgmetrics_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-pgmetrics: needs: matrix-pgmetrics if: github.event_name != 'schedule' && needs.matrix-pgmetrics.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/pluto.yml b/.github/workflows/pluto.yml index ba6d8c5af4..70019602d3 100644 --- a/.github/workflows/pluto.yml +++ b/.github/workflows/pluto.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/pluto/** - - .github/workflows/pluto.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/pluto.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/pluto/** - .github/workflows/pluto.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: pluto_VERSION: ${{ inputs.package_version_override }} pluto_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-pluto: needs: matrix-pluto if: github.event_name != 'schedule' && needs.matrix-pluto.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/popeye.yml b/.github/workflows/popeye.yml index d1905feee1..f6d3b2a48f 100644 --- a/.github/workflows/popeye.yml +++ b/.github/workflows/popeye.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/popeye/** - - .github/workflows/popeye.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/popeye.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/popeye/** - .github/workflows/popeye.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: popeye_VERSION: ${{ inputs.package_version_override }} popeye_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-popeye: needs: matrix-popeye if: github.event_name != 'schedule' && needs.matrix-popeye.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/promtool.yml b/.github/workflows/promtool.yml index a50b565d87..1d40ab1817 100644 --- a/.github/workflows/promtool.yml +++ b/.github/workflows/promtool.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/promtool/** - - .github/workflows/promtool.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/promtool.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/promtool/** - .github/workflows/promtool.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: promtool_VERSION: ${{ inputs.package_version_override }} promtool_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-promtool: needs: matrix-promtool if: github.event_name != 'schedule' && needs.matrix-promtool.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/rainbow-text.yml b/.github/workflows/rainbow-text.yml index 9d033ce589..62d2650c67 100644 --- a/.github/workflows/rainbow-text.yml +++ b/.github/workflows/rainbow-text.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/rainbow-text/** - - .github/workflows/rainbow-text.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/rainbow-text.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/rainbow-text/** - .github/workflows/rainbow-text.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: rainbow-text_VERSION: ${{ inputs.package_version_override }} rainbow-text_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-rainbow-text: needs: matrix-rainbow-text if: github.event_name != 'schedule' && needs.matrix-rainbow-text.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/rakkess.yml b/.github/workflows/rakkess.yml index 9554782375..e1a296c186 100644 --- a/.github/workflows/rakkess.yml +++ b/.github/workflows/rakkess.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/rakkess/** - - .github/workflows/rakkess.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/rakkess.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/rakkess/** - .github/workflows/rakkess.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: rakkess_VERSION: ${{ inputs.package_version_override }} rakkess_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-rakkess: needs: matrix-rakkess if: github.event_name != 'schedule' && needs.matrix-rakkess.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/rancher.yml b/.github/workflows/rancher.yml index fd5d48002b..5760e47e41 100644 --- a/.github/workflows/rancher.yml +++ b/.github/workflows/rancher.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/rancher/** - - .github/workflows/rancher.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/rancher.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/rancher/** - .github/workflows/rancher.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: rancher_VERSION: ${{ inputs.package_version_override }} rancher_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-rancher: needs: matrix-rancher if: github.event_name != 'schedule' && needs.matrix-rancher.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/rbac-lookup.yml b/.github/workflows/rbac-lookup.yml index 822b2f1cab..980ddd0808 100644 --- a/.github/workflows/rbac-lookup.yml +++ b/.github/workflows/rbac-lookup.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/rbac-lookup/** - - .github/workflows/rbac-lookup.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/rbac-lookup.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/rbac-lookup/** - .github/workflows/rbac-lookup.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: rbac-lookup_VERSION: ${{ inputs.package_version_override }} rbac-lookup_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-rbac-lookup: needs: matrix-rbac-lookup if: github.event_name != 'schedule' && needs.matrix-rbac-lookup.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/saml2aws.yml b/.github/workflows/saml2aws.yml index 15bfadc5ae..c6784820d2 100644 --- a/.github/workflows/saml2aws.yml +++ b/.github/workflows/saml2aws.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/saml2aws/** - - .github/workflows/saml2aws.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/saml2aws.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/saml2aws/** - .github/workflows/saml2aws.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: saml2aws_VERSION: ${{ inputs.package_version_override }} saml2aws_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-saml2aws: needs: matrix-saml2aws if: github.event_name != 'schedule' && needs.matrix-saml2aws.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/sentry-cli.yml b/.github/workflows/sentry-cli.yml index 1424b6a904..ebf39ff357 100644 --- a/.github/workflows/sentry-cli.yml +++ b/.github/workflows/sentry-cli.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/sentry-cli/** - - .github/workflows/sentry-cli.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/sentry-cli.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/sentry-cli/** - .github/workflows/sentry-cli.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: sentry-cli_VERSION: ${{ inputs.package_version_override }} sentry-cli_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-sentry-cli: needs: matrix-sentry-cli if: github.event_name != 'schedule' && needs.matrix-sentry-cli.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml index 18f561c8e7..e66e5df69b 100644 --- a/.github/workflows/shellcheck.yml +++ b/.github/workflows/shellcheck.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/shellcheck/** - - .github/workflows/shellcheck.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/shellcheck.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/shellcheck/** - .github/workflows/shellcheck.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: shellcheck_VERSION: ${{ inputs.package_version_override }} shellcheck_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-shellcheck: needs: matrix-shellcheck if: github.event_name != 'schedule' && needs.matrix-shellcheck.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/shfmt.yml b/.github/workflows/shfmt.yml index f4009e67e0..b791b2b247 100644 --- a/.github/workflows/shfmt.yml +++ b/.github/workflows/shfmt.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/shfmt/** - - .github/workflows/shfmt.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/shfmt.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/shfmt/** - .github/workflows/shfmt.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: shfmt_VERSION: ${{ inputs.package_version_override }} shfmt_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-shfmt: needs: matrix-shfmt if: github.event_name != 'schedule' && needs.matrix-shfmt.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/slack-notifier.yml b/.github/workflows/slack-notifier.yml index 7cb3d5eab6..b08114c3de 100644 --- a/.github/workflows/slack-notifier.yml +++ b/.github/workflows/slack-notifier.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/slack-notifier/** - - .github/workflows/slack-notifier.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/slack-notifier.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/slack-notifier/** - .github/workflows/slack-notifier.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: slack-notifier_VERSION: ${{ inputs.package_version_override }} slack-notifier_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-slack-notifier: needs: matrix-slack-notifier if: github.event_name != 'schedule' && needs.matrix-slack-notifier.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/sops.yml b/.github/workflows/sops.yml index 19cb3613ea..ff5a027d55 100644 --- a/.github/workflows/sops.yml +++ b/.github/workflows/sops.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/sops/** - - .github/workflows/sops.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/sops.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/sops/** - .github/workflows/sops.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: sops_VERSION: ${{ inputs.package_version_override }} sops_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-sops: needs: matrix-sops if: github.event_name != 'schedule' && needs.matrix-sops.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/spacectl.yml b/.github/workflows/spacectl.yml index d9e945c8bb..a353441a9b 100644 --- a/.github/workflows/spacectl.yml +++ b/.github/workflows/spacectl.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/spacectl/** - - .github/workflows/spacectl.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/spacectl.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/spacectl/** - .github/workflows/spacectl.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: spacectl_VERSION: ${{ inputs.package_version_override }} spacectl_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-spacectl: needs: matrix-spacectl if: github.event_name != 'schedule' && needs.matrix-spacectl.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/spotctl.yml b/.github/workflows/spotctl.yml index 90e51d6c92..f87ef1de92 100644 --- a/.github/workflows/spotctl.yml +++ b/.github/workflows/spotctl.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/spotctl/** - - .github/workflows/spotctl.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/spotctl.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/spotctl/** - .github/workflows/spotctl.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: spotctl_VERSION: ${{ inputs.package_version_override }} spotctl_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-spotctl: needs: matrix-spotctl if: github.event_name != 'schedule' && needs.matrix-spotctl.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/sshm.yml b/.github/workflows/sshm.yml index 5b5095903d..254e275e7f 100644 --- a/.github/workflows/sshm.yml +++ b/.github/workflows/sshm.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/sshm/** - - .github/workflows/sshm.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/sshm.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/sshm/** - .github/workflows/sshm.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: sshm_VERSION: ${{ inputs.package_version_override }} sshm_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-sshm: needs: matrix-sshm if: github.event_name != 'schedule' && needs.matrix-sshm.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/stern.yml b/.github/workflows/stern.yml index 22bc058eee..612a4ce1be 100644 --- a/.github/workflows/stern.yml +++ b/.github/workflows/stern.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/stern/** - - .github/workflows/stern.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/stern.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/stern/** - .github/workflows/stern.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: stern_VERSION: ${{ inputs.package_version_override }} stern_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-stern: needs: matrix-stern if: github.event_name != 'schedule' && needs.matrix-stern.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/sudosh.yml b/.github/workflows/sudosh.yml index 564a178340..342eede781 100644 --- a/.github/workflows/sudosh.yml +++ b/.github/workflows/sudosh.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/sudosh/** - - .github/workflows/sudosh.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/sudosh.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/sudosh/** - .github/workflows/sudosh.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: sudosh_VERSION: ${{ inputs.package_version_override }} sudosh_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-sudosh: needs: matrix-sudosh if: github.event_name != 'schedule' && needs.matrix-sudosh.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/teleport-4.3.yml b/.github/workflows/teleport-4.3.yml index e4286a357d..5a7b4e8eb7 100644 --- a/.github/workflows/teleport-4.3.yml +++ b/.github/workflows/teleport-4.3.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/teleport-4.3/** - - .github/workflows/teleport-4.3.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/teleport-4.3.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/teleport-4.3/** - .github/workflows/teleport-4.3.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: teleport-4.3_VERSION: ${{ inputs.package_version_override }} teleport-4.3_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-teleport-4_3: needs: matrix-teleport-4_3 if: github.event_name != 'schedule' && needs.matrix-teleport-4_3.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/teleport-4.4.yml b/.github/workflows/teleport-4.4.yml index 6e0bd06ca7..b384e59658 100644 --- a/.github/workflows/teleport-4.4.yml +++ b/.github/workflows/teleport-4.4.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/teleport-4.4/** - - .github/workflows/teleport-4.4.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/teleport-4.4.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/teleport-4.4/** - .github/workflows/teleport-4.4.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: teleport-4.4_VERSION: ${{ inputs.package_version_override }} teleport-4.4_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-teleport-4_4: needs: matrix-teleport-4_4 if: github.event_name != 'schedule' && needs.matrix-teleport-4_4.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/teleport-5.0.yml b/.github/workflows/teleport-5.0.yml index 55112e3a88..6aa4be30a0 100644 --- a/.github/workflows/teleport-5.0.yml +++ b/.github/workflows/teleport-5.0.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/teleport-5.0/** - - .github/workflows/teleport-5.0.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/teleport-5.0.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/teleport-5.0/** - .github/workflows/teleport-5.0.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: teleport-5.0_VERSION: ${{ inputs.package_version_override }} teleport-5.0_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-teleport-5_0: needs: matrix-teleport-5_0 if: github.event_name != 'schedule' && needs.matrix-teleport-5_0.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/teleport.yml b/.github/workflows/teleport.yml index fd4c84568c..71ad5447ff 100644 --- a/.github/workflows/teleport.yml +++ b/.github/workflows/teleport.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/teleport/** - - .github/workflows/teleport.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/teleport.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/teleport/** - .github/workflows/teleport.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: teleport_VERSION: ${{ inputs.package_version_override }} teleport_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-teleport: needs: matrix-teleport if: github.event_name != 'schedule' && needs.matrix-teleport.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terraform-0.11.yml b/.github/workflows/terraform-0.11.yml index e74c0bc08c..a307ca2c40 100644 --- a/.github/workflows/terraform-0.11.yml +++ b/.github/workflows/terraform-0.11.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terraform-0.11/** - - .github/workflows/terraform-0.11.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terraform-0.11.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terraform-0.11/** - .github/workflows/terraform-0.11.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terraform-0.11_VERSION: ${{ inputs.package_version_override }} terraform-0.11_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terraform-0_11: needs: matrix-terraform-0_11 if: github.event_name != 'schedule' && needs.matrix-terraform-0_11.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terraform-0.12.yml b/.github/workflows/terraform-0.12.yml index 0714edc47b..90ebf10af8 100644 --- a/.github/workflows/terraform-0.12.yml +++ b/.github/workflows/terraform-0.12.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terraform-0.12/** - - .github/workflows/terraform-0.12.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terraform-0.12.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terraform-0.12/** - .github/workflows/terraform-0.12.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terraform-0.12_VERSION: ${{ inputs.package_version_override }} terraform-0.12_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terraform-0_12: needs: matrix-terraform-0_12 if: github.event_name != 'schedule' && needs.matrix-terraform-0_12.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terraform-0.13.yml b/.github/workflows/terraform-0.13.yml index c4a247662b..552380185f 100644 --- a/.github/workflows/terraform-0.13.yml +++ b/.github/workflows/terraform-0.13.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terraform-0.13/** - - .github/workflows/terraform-0.13.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terraform-0.13.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terraform-0.13/** - .github/workflows/terraform-0.13.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terraform-0.13_VERSION: ${{ inputs.package_version_override }} terraform-0.13_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terraform-0_13: needs: matrix-terraform-0_13 if: github.event_name != 'schedule' && needs.matrix-terraform-0_13.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terraform-0.14.yml b/.github/workflows/terraform-0.14.yml index dcc3b9efd3..e7a285bc18 100644 --- a/.github/workflows/terraform-0.14.yml +++ b/.github/workflows/terraform-0.14.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terraform-0.14/** - - .github/workflows/terraform-0.14.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terraform-0.14.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terraform-0.14/** - .github/workflows/terraform-0.14.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terraform-0.14_VERSION: ${{ inputs.package_version_override }} terraform-0.14_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terraform-0_14: needs: matrix-terraform-0_14 if: github.event_name != 'schedule' && needs.matrix-terraform-0_14.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terraform-0.15.yml b/.github/workflows/terraform-0.15.yml index c37023c6b5..2208085016 100644 --- a/.github/workflows/terraform-0.15.yml +++ b/.github/workflows/terraform-0.15.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terraform-0.15/** - - .github/workflows/terraform-0.15.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terraform-0.15.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terraform-0.15/** - .github/workflows/terraform-0.15.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terraform-0.15_VERSION: ${{ inputs.package_version_override }} terraform-0.15_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terraform-0_15: needs: matrix-terraform-0_15 if: github.event_name != 'schedule' && needs.matrix-terraform-0_15.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terraform-1.yml b/.github/workflows/terraform-1.yml index 8ed83157c8..b14f677ad3 100644 --- a/.github/workflows/terraform-1.yml +++ b/.github/workflows/terraform-1.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terraform-1/** - - .github/workflows/terraform-1.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terraform-1.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terraform-1/** - .github/workflows/terraform-1.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terraform-1_VERSION: ${{ inputs.package_version_override }} terraform-1_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terraform-1: needs: matrix-terraform-1 if: github.event_name != 'schedule' && needs.matrix-terraform-1.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terraform-config-inspect.yml b/.github/workflows/terraform-config-inspect.yml index 7dce1ce0e4..46a0f4f870 100644 --- a/.github/workflows/terraform-config-inspect.yml +++ b/.github/workflows/terraform-config-inspect.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terraform-config-inspect/** - - .github/workflows/terraform-config-inspect.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terraform-config-inspect.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terraform-config-inspect/** - .github/workflows/terraform-config-inspect.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terraform-config-inspect_VERSION: ${{ inputs.package_version_override }} terraform-config-inspect_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terraform-config-inspect: needs: matrix-terraform-config-inspect if: github.event_name != 'schedule' && needs.matrix-terraform-config-inspect.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terraform-docs.yml b/.github/workflows/terraform-docs.yml index 9d4dd12bb4..c2637d36ba 100644 --- a/.github/workflows/terraform-docs.yml +++ b/.github/workflows/terraform-docs.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terraform-docs/** - - .github/workflows/terraform-docs.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terraform-docs.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terraform-docs/** - .github/workflows/terraform-docs.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terraform-docs_VERSION: ${{ inputs.package_version_override }} terraform-docs_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terraform-docs: needs: matrix-terraform-docs if: github.event_name != 'schedule' && needs.matrix-terraform-docs.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terraform-module-versions.yml b/.github/workflows/terraform-module-versions.yml index 65b4f527c0..949ca1cf43 100644 --- a/.github/workflows/terraform-module-versions.yml +++ b/.github/workflows/terraform-module-versions.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terraform-module-versions/** - - .github/workflows/terraform-module-versions.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terraform-module-versions.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terraform-module-versions/** - .github/workflows/terraform-module-versions.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terraform-module-versions_VERSION: ${{ inputs.package_version_override }} terraform-module-versions_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terraform-module-versions: needs: matrix-terraform-module-versions if: github.event_name != 'schedule' && needs.matrix-terraform-module-versions.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml index c133e59cfe..044265ce5e 100644 --- a/.github/workflows/terraform.yml +++ b/.github/workflows/terraform.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terraform/** - - .github/workflows/terraform.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terraform.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terraform/** - .github/workflows/terraform.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terraform_VERSION: ${{ inputs.package_version_override }} terraform_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terraform: needs: matrix-terraform if: github.event_name != 'schedule' && needs.matrix-terraform.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terraform_0.11.yml b/.github/workflows/terraform_0.11.yml index 52140b7b26..8e1cbbf20e 100644 --- a/.github/workflows/terraform_0.11.yml +++ b/.github/workflows/terraform_0.11.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terraform_0.11/** - - .github/workflows/terraform_0.11.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terraform_0.11.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terraform_0.11/** - .github/workflows/terraform_0.11.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terraform_0.11_VERSION: ${{ inputs.package_version_override }} terraform_0.11_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terraform_0_11: needs: matrix-terraform_0_11 if: github.event_name != 'schedule' && needs.matrix-terraform_0_11.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terraform_0.12.yml b/.github/workflows/terraform_0.12.yml index 3ecc245645..c88ad5295b 100644 --- a/.github/workflows/terraform_0.12.yml +++ b/.github/workflows/terraform_0.12.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terraform_0.12/** - - .github/workflows/terraform_0.12.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terraform_0.12.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terraform_0.12/** - .github/workflows/terraform_0.12.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terraform_0.12_VERSION: ${{ inputs.package_version_override }} terraform_0.12_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terraform_0_12: needs: matrix-terraform_0_12 if: github.event_name != 'schedule' && needs.matrix-terraform_0_12.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terraform_0.13.yml b/.github/workflows/terraform_0.13.yml index 17c678ef05..4d36ffdee9 100644 --- a/.github/workflows/terraform_0.13.yml +++ b/.github/workflows/terraform_0.13.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terraform_0.13/** - - .github/workflows/terraform_0.13.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terraform_0.13.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terraform_0.13/** - .github/workflows/terraform_0.13.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terraform_0.13_VERSION: ${{ inputs.package_version_override }} terraform_0.13_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terraform_0_13: needs: matrix-terraform_0_13 if: github.event_name != 'schedule' && needs.matrix-terraform_0_13.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terragrunt.yml b/.github/workflows/terragrunt.yml index 65f0ac53f7..db8382d4f2 100644 --- a/.github/workflows/terragrunt.yml +++ b/.github/workflows/terragrunt.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terragrunt/** - - .github/workflows/terragrunt.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terragrunt.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terragrunt/** - .github/workflows/terragrunt.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terragrunt_VERSION: ${{ inputs.package_version_override }} terragrunt_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terragrunt: needs: matrix-terragrunt if: github.event_name != 'schedule' && needs.matrix-terragrunt.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/terrahelp.yml b/.github/workflows/terrahelp.yml index 72e50a5652..d0829097b1 100644 --- a/.github/workflows/terrahelp.yml +++ b/.github/workflows/terrahelp.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/terrahelp/** - - .github/workflows/terrahelp.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/terrahelp.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/terrahelp/** - .github/workflows/terrahelp.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: terrahelp_VERSION: ${{ inputs.package_version_override }} terrahelp_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-terrahelp: needs: matrix-terrahelp if: github.event_name != 'schedule' && needs.matrix-terrahelp.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/tflint.yml b/.github/workflows/tflint.yml index 16161d6d04..ce0572f377 100644 --- a/.github/workflows/tflint.yml +++ b/.github/workflows/tflint.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/tflint/** - - .github/workflows/tflint.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/tflint.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/tflint/** - .github/workflows/tflint.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: tflint_VERSION: ${{ inputs.package_version_override }} tflint_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-tflint: needs: matrix-tflint if: github.event_name != 'schedule' && needs.matrix-tflint.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/tfschema.yml b/.github/workflows/tfschema.yml index 3c7e4bb4d9..8a46285903 100644 --- a/.github/workflows/tfschema.yml +++ b/.github/workflows/tfschema.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/tfschema/** - - .github/workflows/tfschema.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/tfschema.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/tfschema/** - .github/workflows/tfschema.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: tfschema_VERSION: ${{ inputs.package_version_override }} tfschema_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-tfschema: needs: matrix-tfschema if: github.event_name != 'schedule' && needs.matrix-tfschema.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/tfsec.yml b/.github/workflows/tfsec.yml index 0cf4f499d5..13b594e31e 100644 --- a/.github/workflows/tfsec.yml +++ b/.github/workflows/tfsec.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/tfsec/** - - .github/workflows/tfsec.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/tfsec.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/tfsec/** - .github/workflows/tfsec.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: tfsec_VERSION: ${{ inputs.package_version_override }} tfsec_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-tfsec: needs: matrix-tfsec if: github.event_name != 'schedule' && needs.matrix-tfsec.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/thanos.yml b/.github/workflows/thanos.yml index 8c1c0c2b2b..7ab9e8f23b 100644 --- a/.github/workflows/thanos.yml +++ b/.github/workflows/thanos.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/thanos/** - - .github/workflows/thanos.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/thanos.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/thanos/** - .github/workflows/thanos.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: thanos_VERSION: ${{ inputs.package_version_override }} thanos_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-thanos: needs: matrix-thanos if: github.event_name != 'schedule' && needs.matrix-thanos.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 2b29ba8628..569314a491 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/trivy/** - - .github/workflows/trivy.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/trivy.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/trivy/** - .github/workflows/trivy.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: trivy_VERSION: ${{ inputs.package_version_override }} trivy_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-trivy: needs: matrix-trivy if: github.event_name != 'schedule' && needs.matrix-trivy.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/variant.yml b/.github/workflows/variant.yml index 5dd0fa9581..537bee8c96 100644 --- a/.github/workflows/variant.yml +++ b/.github/workflows/variant.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/variant/** - - .github/workflows/variant.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/variant.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/variant/** - .github/workflows/variant.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: variant_VERSION: ${{ inputs.package_version_override }} variant_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-variant: needs: matrix-variant if: github.event_name != 'schedule' && needs.matrix-variant.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/variant2.yml b/.github/workflows/variant2.yml index 4872222677..c5cdd7a8ec 100644 --- a/.github/workflows/variant2.yml +++ b/.github/workflows/variant2.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/variant2/** - - .github/workflows/variant2.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/variant2.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/variant2/** - .github/workflows/variant2.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: variant2_VERSION: ${{ inputs.package_version_override }} variant2_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-variant2: needs: matrix-variant2 if: github.event_name != 'schedule' && needs.matrix-variant2.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/vault.yml b/.github/workflows/vault.yml index e65ef12118..8332da6ea6 100644 --- a/.github/workflows/vault.yml +++ b/.github/workflows/vault.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/vault/** - - .github/workflows/vault.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/vault.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/vault/** - .github/workflows/vault.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: vault_VERSION: ${{ inputs.package_version_override }} vault_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-vault: needs: matrix-vault if: github.event_name != 'schedule' && needs.matrix-vault.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/velero.yml b/.github/workflows/velero.yml index d281f65f68..c86881c4ff 100644 --- a/.github/workflows/velero.yml +++ b/.github/workflows/velero.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/velero/** - - .github/workflows/velero.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/velero.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/velero/** - .github/workflows/velero.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: velero_VERSION: ${{ inputs.package_version_override }} velero_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-velero: needs: matrix-velero if: github.event_name != 'schedule' && needs.matrix-velero.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/vendir.yml b/.github/workflows/vendir.yml index 996eb8753c..4fd65f42f3 100644 --- a/.github/workflows/vendir.yml +++ b/.github/workflows/vendir.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/vendir/** - - .github/workflows/vendir.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/vendir.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/vendir/** - .github/workflows/vendir.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: vendir_VERSION: ${{ inputs.package_version_override }} vendir_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-vendir: needs: matrix-vendir if: github.event_name != 'schedule' && needs.matrix-vendir.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/venona.yml b/.github/workflows/venona.yml index ca1f24e874..d58168abca 100644 --- a/.github/workflows/venona.yml +++ b/.github/workflows/venona.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/venona/** - - .github/workflows/venona.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/venona.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/venona/** - .github/workflows/venona.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: venona_VERSION: ${{ inputs.package_version_override }} venona_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-venona: needs: matrix-venona if: github.event_name != 'schedule' && needs.matrix-venona.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/vert.yml b/.github/workflows/vert.yml index f478b30e51..3486210d7c 100644 --- a/.github/workflows/vert.yml +++ b/.github/workflows/vert.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/vert/** - - .github/workflows/vert.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/vert.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/vert/** - .github/workflows/vert.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: vert_VERSION: ${{ inputs.package_version_override }} vert_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-vert: needs: matrix-vert if: github.event_name != 'schedule' && needs.matrix-vert.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/yajsv.yml b/.github/workflows/yajsv.yml index 4561cd8db3..49f4598b49 100644 --- a/.github/workflows/yajsv.yml +++ b/.github/workflows/yajsv.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/yajsv/** - - .github/workflows/yajsv.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/yajsv.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/yajsv/** - .github/workflows/yajsv.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: yajsv_VERSION: ${{ inputs.package_version_override }} yajsv_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-yajsv: needs: matrix-yajsv if: github.event_name != 'schedule' && needs.matrix-yajsv.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' diff --git a/.github/workflows/yq.yml b/.github/workflows/yq.yml index 144c7a4421..bb7b400da5 100644 --- a/.github/workflows/yq.yml +++ b/.github/workflows/yq.yml @@ -18,11 +18,17 @@ on: - rpm/** - tasks/** - vendor/yq/** - - .github/workflows/yq.yml + # Do not automatically trigger a build when the workflow file is changed, because we often make mass updates. + # If we need to run all the workflows, we can just uncomment the line below and make new workflows. + # - .github/workflows/yq.yml pull_request: types: [opened, synchronize, reopened] + # Ignore pulls on branches that start with "mass-update/" + # for when we make changes that do not require a new package build, like updating the action + branches-ignore: + - 'mass-update/**' paths: - apk/** - deb/** @@ -31,7 +37,6 @@ on: - vendor/yq/** - .github/workflows/yq.yml - #bridgecrew:skip=BC_REPO_GITHUB_ACTION_7:The whole point of the workflow dispatch is to feed in a version workflow_dispatch: inputs: package_version_override: @@ -47,6 +52,12 @@ env: yq_VERSION: ${{ inputs.package_version_override }} yq_RELEASE: ${{ inputs.release_number_override }} +permissions: + contents: read + packages: write + attestations: write + id-token: write + jobs: # Mergify cannot distinguish between 2 jobs with the same name run from different workflows, # so each job must have a unique name for the rules to work properly. @@ -76,7 +87,7 @@ jobs: # Build for alpine linux - # Kept separate because it is old and slightly different than the other package builds + # Kept separate because it is old and slightly different from the other package builds alpine-yq: needs: matrix-yq if: github.event_name != 'schedule' && needs.matrix-yq.outputs.apk-enabled != 'false' @@ -96,10 +107,10 @@ jobs: PACKAGER_PUBKEY: ${{github.workspace}}/artifacts/ops@cloudposse.com.rsa.pub container: - image: cloudposse/packages-apkbuild:${{matrix.alpine}} + image: ghcr.io/cloudposse/packages-apkbuild:${{matrix.alpine}} credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: ${{ github.actor }} + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -118,17 +129,14 @@ jobs: - name: "List packages" run: 'find ${APK_PACKAGES_PATH} -type f -name \*.apk | xargs --no-run-if-empty ls -l | grep .' - # Export the artifact filename including path - # Path must be relative to workdir for Cloudsmith action to be able to find it + # Export the artifact filename including path. + # Path must be relative to workdir for Cloudsmith action to be able to find it. - name: "Set output path to artifact" id: artifact shell: bash run: | artifact=$(find artifacts/${{matrix.alpine}} -type f -name \*.apk) echo "path=$artifact" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" @@ -145,7 +153,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' @@ -199,10 +207,10 @@ jobs: # Unfortunately, there is no reasonable way to configure the docker image tag based on the package-type container: - image: cloudposse/packages-${{matrix.package-type}}build:latest + image: ghcr.io/cloudposse/packages-${{matrix.package-type}}build:latest credentials: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" steps: # Checkout the packages repo so we can build the packages as a monorepo @@ -232,9 +240,6 @@ jobs: echo "setting output" echo "path=$packages" | tee -a $GITHUB_OUTPUT - echo creating '"pip"' cache directory for Cloudsmith - mkdir -p $HOME/.cache/pip && chmod -R 777 $HOME/.cache || echo Ignoring error creating '"pip"' cache directory - # Determine which package organization we should use (e.g. dev or prod) - name: "Determine package repo" shell: bash @@ -250,7 +255,7 @@ jobs: # Publish the artifacts - name: "Push artifact to package repository" - uses: cloudsmith-io/action@v0.5.4 + uses: cloudsmith-io/action@v0.6.10 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} command: 'push' From 2322e89798cef3af41df3b5774b9de7cf6d77116 Mon Sep 17 00:00:00 2001 From: Nuru Date: Tue, 18 Jun 2024 15:18:50 -0700 Subject: [PATCH 2/2] [no ci] Remove erroneous branch-ignore --- .github/package-template.yml | 5 +---- .github/workflows/amazon-ecr-credential-helper.yml | 5 +---- .github/workflows/amtool.yml | 5 +---- .github/workflows/argocd.yml | 5 +---- .github/workflows/assume-role.yml | 5 +---- .github/workflows/atlantis.yml | 5 +---- .github/workflows/atmos.yml | 5 +---- .github/workflows/awless.yml | 5 +---- .github/workflows/aws-copilot-cli.yml | 5 +---- .github/workflows/aws-iam-authenticator.yml | 5 +---- .github/workflows/aws-nuke.yml | 5 +---- .github/workflows/aws-vault.yml | 5 +---- .github/workflows/cfssl.yml | 5 +---- .github/workflows/cfssljson.yml | 5 +---- .github/workflows/chamber.yml | 5 +---- .github/workflows/cilium-cli.yml | 5 +---- .github/workflows/cli53.yml | 5 +---- .github/workflows/cloud-nuke.yml | 5 +---- .github/workflows/cloudflared.yml | 5 +---- .github/workflows/codefresh.yml | 5 +---- .github/workflows/conftest.yml | 5 +---- .github/workflows/consul.yml | 5 +---- .github/workflows/ctop.yml | 5 +---- .github/workflows/direnv.yml | 5 +---- .github/workflows/doctl.yml | 5 +---- .github/workflows/ec2-instance-selector.yml | 5 +---- .github/workflows/ecspresso.yml | 5 +---- .github/workflows/emailcli.yml | 5 +---- .github/workflows/envcli.yml | 5 +---- .github/workflows/fetch.yml | 5 +---- .github/workflows/figurine.yml | 5 +---- .github/workflows/fzf.yml | 5 +---- .github/workflows/gh.yml | 5 +---- .github/workflows/ghr.yml | 5 +---- .github/workflows/github-commenter.yml | 5 +---- .github/workflows/github-release.yml | 5 +---- .github/workflows/github-status-updater.yml | 5 +---- .github/workflows/gitleaks.yml | 5 +---- .github/workflows/go-jsonnet.yml | 5 +---- .github/workflows/gomplate.yml | 5 +---- .github/workflows/gonsul.yml | 5 +---- .github/workflows/goofys.yml | 5 +---- .github/workflows/gosu.yml | 5 +---- .github/workflows/gotop.yml | 5 +---- .github/workflows/grpcurl.yml | 5 +---- .github/workflows/hcledit.yml | 5 +---- .github/workflows/helm.yml | 5 +---- .github/workflows/helm2.yml | 5 +---- .github/workflows/helm3.yml | 5 +---- .github/workflows/helmfile.yml | 5 +---- .github/workflows/htmltest.yml | 5 +---- .github/workflows/hugo.yml | 5 +---- .github/workflows/infracost.yml | 5 +---- .github/workflows/jp.yml | 5 +---- .github/workflows/json2hcl.yml | 5 +---- .github/workflows/jx.yml | 5 +---- .github/workflows/k3d.yml | 5 +---- .github/workflows/k6.yml | 5 +---- .github/workflows/k9s.yml | 5 +---- .github/workflows/katafygio.yml | 5 +---- .github/workflows/kfctl.yml | 5 +---- .github/workflows/kind.yml | 5 +---- .github/workflows/kops.yml | 5 +---- .github/workflows/krew.yml | 5 +---- .github/workflows/kubecron.yml | 5 +---- .github/workflows/kubectl-1.13.yml | 5 +---- .github/workflows/kubectl-1.14.yml | 5 +---- .github/workflows/kubectl-1.15.yml | 5 +---- .github/workflows/kubectl-1.16.yml | 5 +---- .github/workflows/kubectl-1.17.yml | 5 +---- .github/workflows/kubectl-1.18.yml | 5 +---- .github/workflows/kubectl-1.19.yml | 5 +---- .github/workflows/kubectl-1.20.yml | 5 +---- .github/workflows/kubectl-1.21.yml | 5 +---- .github/workflows/kubectl-1.22.yml | 5 +---- .github/workflows/kubectl-1.23.yml | 5 +---- .github/workflows/kubectl-1.24.yml | 5 +---- .github/workflows/kubectl-1.25.yml | 5 +---- .github/workflows/kubectl-1.26.yml | 5 +---- .github/workflows/kubectl-1.27.yml | 5 +---- .github/workflows/kubectl-1.28.yml | 5 +---- .github/workflows/kubectl-1.29.yml | 5 +---- .github/workflows/kubectl-1.30.yml | 5 +---- .github/workflows/kubectl.yml | 5 +---- .github/workflows/kubectx.yml | 5 +---- .github/workflows/kubens.yml | 5 +---- .github/workflows/kubeval.yml | 5 +---- .github/workflows/lazydocker.yml | 5 +---- .github/workflows/lectl.yml | 5 +---- .github/workflows/minikube.yml | 5 +---- .github/workflows/misspell.yml | 5 +---- .github/workflows/opa.yml | 5 +---- .github/workflows/pack.yml | 5 +---- .github/workflows/packer.yml | 5 +---- .github/workflows/pandoc.yml | 5 +---- .github/workflows/pgmetrics.yml | 5 +---- .github/workflows/pluto.yml | 5 +---- .github/workflows/popeye.yml | 5 +---- .github/workflows/promtool.yml | 5 +---- .github/workflows/rainbow-text.yml | 5 +---- .github/workflows/rakkess.yml | 5 +---- .github/workflows/rancher.yml | 5 +---- .github/workflows/rbac-lookup.yml | 5 +---- .github/workflows/saml2aws.yml | 5 +---- .github/workflows/sentry-cli.yml | 5 +---- .github/workflows/shellcheck.yml | 5 +---- .github/workflows/shfmt.yml | 5 +---- .github/workflows/slack-notifier.yml | 5 +---- .github/workflows/sops.yml | 5 +---- .github/workflows/spacectl.yml | 5 +---- .github/workflows/spotctl.yml | 5 +---- .github/workflows/sshm.yml | 5 +---- .github/workflows/stern.yml | 5 +---- .github/workflows/sudosh.yml | 5 +---- .github/workflows/teleport-4.3.yml | 5 +---- .github/workflows/teleport-4.4.yml | 5 +---- .github/workflows/teleport-5.0.yml | 5 +---- .github/workflows/teleport.yml | 5 +---- .github/workflows/terraform-0.11.yml | 5 +---- .github/workflows/terraform-0.12.yml | 5 +---- .github/workflows/terraform-0.13.yml | 5 +---- .github/workflows/terraform-0.14.yml | 5 +---- .github/workflows/terraform-0.15.yml | 5 +---- .github/workflows/terraform-1.yml | 5 +---- .github/workflows/terraform-config-inspect.yml | 5 +---- .github/workflows/terraform-docs.yml | 5 +---- .github/workflows/terraform-module-versions.yml | 5 +---- .github/workflows/terraform.yml | 5 +---- .github/workflows/terraform_0.11.yml | 5 +---- .github/workflows/terraform_0.12.yml | 5 +---- .github/workflows/terraform_0.13.yml | 5 +---- .github/workflows/terragrunt.yml | 5 +---- .github/workflows/terrahelp.yml | 5 +---- .github/workflows/tflint.yml | 5 +---- .github/workflows/tfschema.yml | 5 +---- .github/workflows/tfsec.yml | 5 +---- .github/workflows/thanos.yml | 5 +---- .github/workflows/trivy.yml | 5 +---- .github/workflows/variant.yml | 5 +---- .github/workflows/variant2.yml | 5 +---- .github/workflows/vault.yml | 5 +---- .github/workflows/velero.yml | 5 +---- .github/workflows/vendir.yml | 5 +---- .github/workflows/venona.yml | 5 +---- .github/workflows/vert.yml | 5 +---- .github/workflows/yajsv.yml | 5 +---- .github/workflows/yq.yml | 5 +---- 147 files changed, 147 insertions(+), 588 deletions(-) diff --git a/.github/package-template.yml b/.github/package-template.yml index 28f99449d8..47583fc385 100644 --- a/.github/package-template.yml +++ b/.github/package-template.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/amazon-ecr-credential-helper.yml b/.github/workflows/amazon-ecr-credential-helper.yml index 1b215d3f65..9040a6f2f0 100644 --- a/.github/workflows/amazon-ecr-credential-helper.yml +++ b/.github/workflows/amazon-ecr-credential-helper.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/amtool.yml b/.github/workflows/amtool.yml index 3a53922e74..cfb9800e19 100644 --- a/.github/workflows/amtool.yml +++ b/.github/workflows/amtool.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/argocd.yml b/.github/workflows/argocd.yml index 5955a06745..505ec6b806 100644 --- a/.github/workflows/argocd.yml +++ b/.github/workflows/argocd.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/assume-role.yml b/.github/workflows/assume-role.yml index 4ab28c085f..a276e9516d 100644 --- a/.github/workflows/assume-role.yml +++ b/.github/workflows/assume-role.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/atlantis.yml b/.github/workflows/atlantis.yml index b4c33330ee..48865f0ce6 100644 --- a/.github/workflows/atlantis.yml +++ b/.github/workflows/atlantis.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/atmos.yml b/.github/workflows/atmos.yml index 5b78d8e903..a256e93557 100644 --- a/.github/workflows/atmos.yml +++ b/.github/workflows/atmos.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/awless.yml b/.github/workflows/awless.yml index 68287e4d32..45b6060055 100644 --- a/.github/workflows/awless.yml +++ b/.github/workflows/awless.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/aws-copilot-cli.yml b/.github/workflows/aws-copilot-cli.yml index 0d42ee9f26..a9cd8f51fd 100644 --- a/.github/workflows/aws-copilot-cli.yml +++ b/.github/workflows/aws-copilot-cli.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/aws-iam-authenticator.yml b/.github/workflows/aws-iam-authenticator.yml index 8d6028d34d..86014b1689 100644 --- a/.github/workflows/aws-iam-authenticator.yml +++ b/.github/workflows/aws-iam-authenticator.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/aws-nuke.yml b/.github/workflows/aws-nuke.yml index 4a94746f21..67fa57c049 100644 --- a/.github/workflows/aws-nuke.yml +++ b/.github/workflows/aws-nuke.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/aws-vault.yml b/.github/workflows/aws-vault.yml index 33a05c9994..8c12b6353e 100644 --- a/.github/workflows/aws-vault.yml +++ b/.github/workflows/aws-vault.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/cfssl.yml b/.github/workflows/cfssl.yml index ffb5829260..2378b5642a 100644 --- a/.github/workflows/cfssl.yml +++ b/.github/workflows/cfssl.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/cfssljson.yml b/.github/workflows/cfssljson.yml index a3e30df864..60c04ba6f9 100644 --- a/.github/workflows/cfssljson.yml +++ b/.github/workflows/cfssljson.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/chamber.yml b/.github/workflows/chamber.yml index 622112e4f7..678b06bf25 100644 --- a/.github/workflows/chamber.yml +++ b/.github/workflows/chamber.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/cilium-cli.yml b/.github/workflows/cilium-cli.yml index 56be18c931..a4dc3acfc8 100644 --- a/.github/workflows/cilium-cli.yml +++ b/.github/workflows/cilium-cli.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/cli53.yml b/.github/workflows/cli53.yml index 832d34b496..4936d3964a 100644 --- a/.github/workflows/cli53.yml +++ b/.github/workflows/cli53.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/cloud-nuke.yml b/.github/workflows/cloud-nuke.yml index 62aae50a40..00dae988b8 100644 --- a/.github/workflows/cloud-nuke.yml +++ b/.github/workflows/cloud-nuke.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/cloudflared.yml b/.github/workflows/cloudflared.yml index cb44742c6e..ebf770364b 100644 --- a/.github/workflows/cloudflared.yml +++ b/.github/workflows/cloudflared.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/codefresh.yml b/.github/workflows/codefresh.yml index 73ceda9ab9..680039fd06 100644 --- a/.github/workflows/codefresh.yml +++ b/.github/workflows/codefresh.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/conftest.yml b/.github/workflows/conftest.yml index d6a5153317..18e3be22e5 100644 --- a/.github/workflows/conftest.yml +++ b/.github/workflows/conftest.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/consul.yml b/.github/workflows/consul.yml index 5849da5fed..d2bbc6e926 100644 --- a/.github/workflows/consul.yml +++ b/.github/workflows/consul.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/ctop.yml b/.github/workflows/ctop.yml index 000ea43360..c716f1cedf 100644 --- a/.github/workflows/ctop.yml +++ b/.github/workflows/ctop.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/direnv.yml b/.github/workflows/direnv.yml index 244cac80c3..671dca8ab0 100644 --- a/.github/workflows/direnv.yml +++ b/.github/workflows/direnv.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/doctl.yml b/.github/workflows/doctl.yml index 5be8485ef1..33332e1013 100644 --- a/.github/workflows/doctl.yml +++ b/.github/workflows/doctl.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/ec2-instance-selector.yml b/.github/workflows/ec2-instance-selector.yml index 90dfecfd52..7ce1f3206c 100644 --- a/.github/workflows/ec2-instance-selector.yml +++ b/.github/workflows/ec2-instance-selector.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/ecspresso.yml b/.github/workflows/ecspresso.yml index 7979a76778..244dfc219e 100644 --- a/.github/workflows/ecspresso.yml +++ b/.github/workflows/ecspresso.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/emailcli.yml b/.github/workflows/emailcli.yml index 95f0303840..12523a9339 100644 --- a/.github/workflows/emailcli.yml +++ b/.github/workflows/emailcli.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/envcli.yml b/.github/workflows/envcli.yml index 86d903316a..acda721c62 100644 --- a/.github/workflows/envcli.yml +++ b/.github/workflows/envcli.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/fetch.yml b/.github/workflows/fetch.yml index 8b1f5ee03f..5c0fb6cf9e 100644 --- a/.github/workflows/fetch.yml +++ b/.github/workflows/fetch.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/figurine.yml b/.github/workflows/figurine.yml index f7c58f06cf..7c36973891 100644 --- a/.github/workflows/figurine.yml +++ b/.github/workflows/figurine.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/fzf.yml b/.github/workflows/fzf.yml index a0d0f056b6..fc5175d9a0 100644 --- a/.github/workflows/fzf.yml +++ b/.github/workflows/fzf.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/gh.yml b/.github/workflows/gh.yml index 9b13f47124..6938e5f046 100644 --- a/.github/workflows/gh.yml +++ b/.github/workflows/gh.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/ghr.yml b/.github/workflows/ghr.yml index 7ef760a330..cc33f04edc 100644 --- a/.github/workflows/ghr.yml +++ b/.github/workflows/ghr.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/github-commenter.yml b/.github/workflows/github-commenter.yml index f7a9ba911b..667d6c6835 100644 --- a/.github/workflows/github-commenter.yml +++ b/.github/workflows/github-commenter.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/github-release.yml b/.github/workflows/github-release.yml index 7640462c4c..7550954fb0 100644 --- a/.github/workflows/github-release.yml +++ b/.github/workflows/github-release.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/github-status-updater.yml b/.github/workflows/github-status-updater.yml index 1cf76b0dad..4d1dce542f 100644 --- a/.github/workflows/github-status-updater.yml +++ b/.github/workflows/github-status-updater.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml index 08f879b500..969fe4b2a0 100644 --- a/.github/workflows/gitleaks.yml +++ b/.github/workflows/gitleaks.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/go-jsonnet.yml b/.github/workflows/go-jsonnet.yml index 170e2e3d8b..320230a149 100644 --- a/.github/workflows/go-jsonnet.yml +++ b/.github/workflows/go-jsonnet.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/gomplate.yml b/.github/workflows/gomplate.yml index de22f13eba..e4fc88804e 100644 --- a/.github/workflows/gomplate.yml +++ b/.github/workflows/gomplate.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/gonsul.yml b/.github/workflows/gonsul.yml index 12fefb5e1e..b9d9ecdd6e 100644 --- a/.github/workflows/gonsul.yml +++ b/.github/workflows/gonsul.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/goofys.yml b/.github/workflows/goofys.yml index 73164338d6..76f494c4b8 100644 --- a/.github/workflows/goofys.yml +++ b/.github/workflows/goofys.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/gosu.yml b/.github/workflows/gosu.yml index fda5f32d2d..e90c1a4fdd 100644 --- a/.github/workflows/gosu.yml +++ b/.github/workflows/gosu.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/gotop.yml b/.github/workflows/gotop.yml index 5d559e27bc..351be716c7 100644 --- a/.github/workflows/gotop.yml +++ b/.github/workflows/gotop.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/grpcurl.yml b/.github/workflows/grpcurl.yml index 6d5f08d096..ed0b54b024 100644 --- a/.github/workflows/grpcurl.yml +++ b/.github/workflows/grpcurl.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/hcledit.yml b/.github/workflows/hcledit.yml index be548d6f0d..8827aabc38 100644 --- a/.github/workflows/hcledit.yml +++ b/.github/workflows/hcledit.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml index 19f92b74e4..c10fac9b6f 100644 --- a/.github/workflows/helm.yml +++ b/.github/workflows/helm.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/helm2.yml b/.github/workflows/helm2.yml index 05a951816c..e1e1b2e349 100644 --- a/.github/workflows/helm2.yml +++ b/.github/workflows/helm2.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/helm3.yml b/.github/workflows/helm3.yml index a2983e5f4c..204574905b 100644 --- a/.github/workflows/helm3.yml +++ b/.github/workflows/helm3.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/helmfile.yml b/.github/workflows/helmfile.yml index 3739f1b807..d1d5f506a3 100644 --- a/.github/workflows/helmfile.yml +++ b/.github/workflows/helmfile.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/htmltest.yml b/.github/workflows/htmltest.yml index 4e68dff55d..698f1554f1 100644 --- a/.github/workflows/htmltest.yml +++ b/.github/workflows/htmltest.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/hugo.yml b/.github/workflows/hugo.yml index f2e425388f..14410151f1 100644 --- a/.github/workflows/hugo.yml +++ b/.github/workflows/hugo.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/infracost.yml b/.github/workflows/infracost.yml index 704521f986..95928745cb 100644 --- a/.github/workflows/infracost.yml +++ b/.github/workflows/infracost.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/jp.yml b/.github/workflows/jp.yml index 8e6d1180c1..57d0e94116 100644 --- a/.github/workflows/jp.yml +++ b/.github/workflows/jp.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/json2hcl.yml b/.github/workflows/json2hcl.yml index 53eef649d6..2e19511126 100644 --- a/.github/workflows/json2hcl.yml +++ b/.github/workflows/json2hcl.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/jx.yml b/.github/workflows/jx.yml index 8c414efc82..75518bcb65 100644 --- a/.github/workflows/jx.yml +++ b/.github/workflows/jx.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/k3d.yml b/.github/workflows/k3d.yml index f01777a065..0ba8f79644 100644 --- a/.github/workflows/k3d.yml +++ b/.github/workflows/k3d.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/k6.yml b/.github/workflows/k6.yml index 52aea93e14..f8ad207fb6 100644 --- a/.github/workflows/k6.yml +++ b/.github/workflows/k6.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/k9s.yml b/.github/workflows/k9s.yml index 2ccd18c48b..5e52bb8de4 100644 --- a/.github/workflows/k9s.yml +++ b/.github/workflows/k9s.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/katafygio.yml b/.github/workflows/katafygio.yml index e70795bcfc..f0d70d8b66 100644 --- a/.github/workflows/katafygio.yml +++ b/.github/workflows/katafygio.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kfctl.yml b/.github/workflows/kfctl.yml index 5d7bcb87ac..3e7e61a42b 100644 --- a/.github/workflows/kfctl.yml +++ b/.github/workflows/kfctl.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kind.yml b/.github/workflows/kind.yml index 03867f0568..5f6c12c5b4 100644 --- a/.github/workflows/kind.yml +++ b/.github/workflows/kind.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kops.yml b/.github/workflows/kops.yml index a874183fbf..37478ef12a 100644 --- a/.github/workflows/kops.yml +++ b/.github/workflows/kops.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/krew.yml b/.github/workflows/krew.yml index 57ecc418d5..b69b4ebb64 100644 --- a/.github/workflows/krew.yml +++ b/.github/workflows/krew.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubecron.yml b/.github/workflows/kubecron.yml index 699afe18a9..ba57ebe970 100644 --- a/.github/workflows/kubecron.yml +++ b/.github/workflows/kubecron.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.13.yml b/.github/workflows/kubectl-1.13.yml index 13df010f02..dfbe125f79 100644 --- a/.github/workflows/kubectl-1.13.yml +++ b/.github/workflows/kubectl-1.13.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.14.yml b/.github/workflows/kubectl-1.14.yml index 16b8eae1f6..6d3763b5c8 100644 --- a/.github/workflows/kubectl-1.14.yml +++ b/.github/workflows/kubectl-1.14.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.15.yml b/.github/workflows/kubectl-1.15.yml index 0932ec4222..52f8e458f7 100644 --- a/.github/workflows/kubectl-1.15.yml +++ b/.github/workflows/kubectl-1.15.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.16.yml b/.github/workflows/kubectl-1.16.yml index fb8960d8a6..c9a226fb75 100644 --- a/.github/workflows/kubectl-1.16.yml +++ b/.github/workflows/kubectl-1.16.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.17.yml b/.github/workflows/kubectl-1.17.yml index 9b878ac093..5cb8533052 100644 --- a/.github/workflows/kubectl-1.17.yml +++ b/.github/workflows/kubectl-1.17.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.18.yml b/.github/workflows/kubectl-1.18.yml index 269e96091a..aa8c3d260e 100644 --- a/.github/workflows/kubectl-1.18.yml +++ b/.github/workflows/kubectl-1.18.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.19.yml b/.github/workflows/kubectl-1.19.yml index 6734432af5..0011288957 100644 --- a/.github/workflows/kubectl-1.19.yml +++ b/.github/workflows/kubectl-1.19.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.20.yml b/.github/workflows/kubectl-1.20.yml index 8ca7a7ecf3..18128f5009 100644 --- a/.github/workflows/kubectl-1.20.yml +++ b/.github/workflows/kubectl-1.20.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.21.yml b/.github/workflows/kubectl-1.21.yml index 501e4679d2..19b1dd13d0 100644 --- a/.github/workflows/kubectl-1.21.yml +++ b/.github/workflows/kubectl-1.21.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.22.yml b/.github/workflows/kubectl-1.22.yml index 427987d0b6..2c4751298a 100644 --- a/.github/workflows/kubectl-1.22.yml +++ b/.github/workflows/kubectl-1.22.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.23.yml b/.github/workflows/kubectl-1.23.yml index 0c7b57da2a..e91aa2cb1f 100644 --- a/.github/workflows/kubectl-1.23.yml +++ b/.github/workflows/kubectl-1.23.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.24.yml b/.github/workflows/kubectl-1.24.yml index cb5770830f..ae0bb05001 100644 --- a/.github/workflows/kubectl-1.24.yml +++ b/.github/workflows/kubectl-1.24.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.25.yml b/.github/workflows/kubectl-1.25.yml index 2af6c8c6f1..97a4ffb01d 100644 --- a/.github/workflows/kubectl-1.25.yml +++ b/.github/workflows/kubectl-1.25.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.26.yml b/.github/workflows/kubectl-1.26.yml index cdc8b37a46..cf38ff0706 100644 --- a/.github/workflows/kubectl-1.26.yml +++ b/.github/workflows/kubectl-1.26.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.27.yml b/.github/workflows/kubectl-1.27.yml index b6db32d80d..ce92353ded 100644 --- a/.github/workflows/kubectl-1.27.yml +++ b/.github/workflows/kubectl-1.27.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.28.yml b/.github/workflows/kubectl-1.28.yml index e060ef6723..68fd9a2535 100644 --- a/.github/workflows/kubectl-1.28.yml +++ b/.github/workflows/kubectl-1.28.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.29.yml b/.github/workflows/kubectl-1.29.yml index 7695506db5..810a1f7c60 100644 --- a/.github/workflows/kubectl-1.29.yml +++ b/.github/workflows/kubectl-1.29.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl-1.30.yml b/.github/workflows/kubectl-1.30.yml index 011bc73c94..931ff93d33 100644 --- a/.github/workflows/kubectl-1.30.yml +++ b/.github/workflows/kubectl-1.30.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectl.yml b/.github/workflows/kubectl.yml index 6ecc4a17f0..53d539f1df 100644 --- a/.github/workflows/kubectl.yml +++ b/.github/workflows/kubectl.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubectx.yml b/.github/workflows/kubectx.yml index 28827a957a..fc9103b52f 100644 --- a/.github/workflows/kubectx.yml +++ b/.github/workflows/kubectx.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubens.yml b/.github/workflows/kubens.yml index 221a80c528..b130e2068e 100644 --- a/.github/workflows/kubens.yml +++ b/.github/workflows/kubens.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/kubeval.yml b/.github/workflows/kubeval.yml index 8d3b66aef6..11215537b3 100644 --- a/.github/workflows/kubeval.yml +++ b/.github/workflows/kubeval.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/lazydocker.yml b/.github/workflows/lazydocker.yml index 5b31f46c6d..9c4f0204aa 100644 --- a/.github/workflows/lazydocker.yml +++ b/.github/workflows/lazydocker.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/lectl.yml b/.github/workflows/lectl.yml index df151b14e2..f5fb9b3d4a 100644 --- a/.github/workflows/lectl.yml +++ b/.github/workflows/lectl.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/minikube.yml b/.github/workflows/minikube.yml index 8a5709363e..7212c17c32 100644 --- a/.github/workflows/minikube.yml +++ b/.github/workflows/minikube.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/misspell.yml b/.github/workflows/misspell.yml index 1d263cd0ee..0ef339300a 100644 --- a/.github/workflows/misspell.yml +++ b/.github/workflows/misspell.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/opa.yml b/.github/workflows/opa.yml index bda2ba196b..4c5d30d787 100644 --- a/.github/workflows/opa.yml +++ b/.github/workflows/opa.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/pack.yml b/.github/workflows/pack.yml index 1bc773ebea..e5872400d7 100644 --- a/.github/workflows/pack.yml +++ b/.github/workflows/pack.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/packer.yml b/.github/workflows/packer.yml index 1b1bce1c08..fd298bf8f9 100644 --- a/.github/workflows/packer.yml +++ b/.github/workflows/packer.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/pandoc.yml b/.github/workflows/pandoc.yml index 34e36e4514..a5bf6b6a95 100644 --- a/.github/workflows/pandoc.yml +++ b/.github/workflows/pandoc.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/pgmetrics.yml b/.github/workflows/pgmetrics.yml index 494a5ef2a5..831aed1736 100644 --- a/.github/workflows/pgmetrics.yml +++ b/.github/workflows/pgmetrics.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/pluto.yml b/.github/workflows/pluto.yml index 70019602d3..0d7be9e65d 100644 --- a/.github/workflows/pluto.yml +++ b/.github/workflows/pluto.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/popeye.yml b/.github/workflows/popeye.yml index f6d3b2a48f..e83f5a03b5 100644 --- a/.github/workflows/popeye.yml +++ b/.github/workflows/popeye.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/promtool.yml b/.github/workflows/promtool.yml index 1d40ab1817..0f9d50fd63 100644 --- a/.github/workflows/promtool.yml +++ b/.github/workflows/promtool.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/rainbow-text.yml b/.github/workflows/rainbow-text.yml index 62d2650c67..c0db8730df 100644 --- a/.github/workflows/rainbow-text.yml +++ b/.github/workflows/rainbow-text.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/rakkess.yml b/.github/workflows/rakkess.yml index e1a296c186..409e52c432 100644 --- a/.github/workflows/rakkess.yml +++ b/.github/workflows/rakkess.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/rancher.yml b/.github/workflows/rancher.yml index 5760e47e41..e689a7070b 100644 --- a/.github/workflows/rancher.yml +++ b/.github/workflows/rancher.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/rbac-lookup.yml b/.github/workflows/rbac-lookup.yml index 980ddd0808..c35a3437fb 100644 --- a/.github/workflows/rbac-lookup.yml +++ b/.github/workflows/rbac-lookup.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/saml2aws.yml b/.github/workflows/saml2aws.yml index c6784820d2..c7028e3ab1 100644 --- a/.github/workflows/saml2aws.yml +++ b/.github/workflows/saml2aws.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/sentry-cli.yml b/.github/workflows/sentry-cli.yml index ebf39ff357..a74a056f9f 100644 --- a/.github/workflows/sentry-cli.yml +++ b/.github/workflows/sentry-cli.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml index e66e5df69b..eda65183b7 100644 --- a/.github/workflows/shellcheck.yml +++ b/.github/workflows/shellcheck.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/shfmt.yml b/.github/workflows/shfmt.yml index b791b2b247..58ce88dbeb 100644 --- a/.github/workflows/shfmt.yml +++ b/.github/workflows/shfmt.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/slack-notifier.yml b/.github/workflows/slack-notifier.yml index b08114c3de..2ba53e334c 100644 --- a/.github/workflows/slack-notifier.yml +++ b/.github/workflows/slack-notifier.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/sops.yml b/.github/workflows/sops.yml index ff5a027d55..74ec96ee4d 100644 --- a/.github/workflows/sops.yml +++ b/.github/workflows/sops.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/spacectl.yml b/.github/workflows/spacectl.yml index a353441a9b..f14e33a881 100644 --- a/.github/workflows/spacectl.yml +++ b/.github/workflows/spacectl.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/spotctl.yml b/.github/workflows/spotctl.yml index f87ef1de92..910e88cb38 100644 --- a/.github/workflows/spotctl.yml +++ b/.github/workflows/spotctl.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/sshm.yml b/.github/workflows/sshm.yml index 254e275e7f..25b9ff420a 100644 --- a/.github/workflows/sshm.yml +++ b/.github/workflows/sshm.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/stern.yml b/.github/workflows/stern.yml index 612a4ce1be..c37a6ff3f3 100644 --- a/.github/workflows/stern.yml +++ b/.github/workflows/stern.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/sudosh.yml b/.github/workflows/sudosh.yml index 342eede781..d8e1fff72f 100644 --- a/.github/workflows/sudosh.yml +++ b/.github/workflows/sudosh.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/teleport-4.3.yml b/.github/workflows/teleport-4.3.yml index 5a7b4e8eb7..d4ff82da24 100644 --- a/.github/workflows/teleport-4.3.yml +++ b/.github/workflows/teleport-4.3.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/teleport-4.4.yml b/.github/workflows/teleport-4.4.yml index b384e59658..a32275012f 100644 --- a/.github/workflows/teleport-4.4.yml +++ b/.github/workflows/teleport-4.4.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/teleport-5.0.yml b/.github/workflows/teleport-5.0.yml index 6aa4be30a0..db7f4fc12c 100644 --- a/.github/workflows/teleport-5.0.yml +++ b/.github/workflows/teleport-5.0.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/teleport.yml b/.github/workflows/teleport.yml index 71ad5447ff..8eb197a4d1 100644 --- a/.github/workflows/teleport.yml +++ b/.github/workflows/teleport.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terraform-0.11.yml b/.github/workflows/terraform-0.11.yml index a307ca2c40..d6e8afbc83 100644 --- a/.github/workflows/terraform-0.11.yml +++ b/.github/workflows/terraform-0.11.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terraform-0.12.yml b/.github/workflows/terraform-0.12.yml index 90ebf10af8..9d136f3a5d 100644 --- a/.github/workflows/terraform-0.12.yml +++ b/.github/workflows/terraform-0.12.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terraform-0.13.yml b/.github/workflows/terraform-0.13.yml index 552380185f..756f85d7bf 100644 --- a/.github/workflows/terraform-0.13.yml +++ b/.github/workflows/terraform-0.13.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terraform-0.14.yml b/.github/workflows/terraform-0.14.yml index e7a285bc18..a9076851cf 100644 --- a/.github/workflows/terraform-0.14.yml +++ b/.github/workflows/terraform-0.14.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terraform-0.15.yml b/.github/workflows/terraform-0.15.yml index 2208085016..1854e60ca8 100644 --- a/.github/workflows/terraform-0.15.yml +++ b/.github/workflows/terraform-0.15.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terraform-1.yml b/.github/workflows/terraform-1.yml index b14f677ad3..4bad8be01f 100644 --- a/.github/workflows/terraform-1.yml +++ b/.github/workflows/terraform-1.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terraform-config-inspect.yml b/.github/workflows/terraform-config-inspect.yml index 46a0f4f870..5455055f36 100644 --- a/.github/workflows/terraform-config-inspect.yml +++ b/.github/workflows/terraform-config-inspect.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terraform-docs.yml b/.github/workflows/terraform-docs.yml index c2637d36ba..9ac944f77e 100644 --- a/.github/workflows/terraform-docs.yml +++ b/.github/workflows/terraform-docs.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terraform-module-versions.yml b/.github/workflows/terraform-module-versions.yml index 949ca1cf43..8ebda7bbeb 100644 --- a/.github/workflows/terraform-module-versions.yml +++ b/.github/workflows/terraform-module-versions.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml index 044265ce5e..db5a5413b1 100644 --- a/.github/workflows/terraform.yml +++ b/.github/workflows/terraform.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terraform_0.11.yml b/.github/workflows/terraform_0.11.yml index 8e1cbbf20e..e6df455c8e 100644 --- a/.github/workflows/terraform_0.11.yml +++ b/.github/workflows/terraform_0.11.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terraform_0.12.yml b/.github/workflows/terraform_0.12.yml index c88ad5295b..9852a41bf5 100644 --- a/.github/workflows/terraform_0.12.yml +++ b/.github/workflows/terraform_0.12.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terraform_0.13.yml b/.github/workflows/terraform_0.13.yml index 4d36ffdee9..eb5693250b 100644 --- a/.github/workflows/terraform_0.13.yml +++ b/.github/workflows/terraform_0.13.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terragrunt.yml b/.github/workflows/terragrunt.yml index db8382d4f2..c1881f14d5 100644 --- a/.github/workflows/terragrunt.yml +++ b/.github/workflows/terragrunt.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/terrahelp.yml b/.github/workflows/terrahelp.yml index d0829097b1..bf6d1014e1 100644 --- a/.github/workflows/terrahelp.yml +++ b/.github/workflows/terrahelp.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/tflint.yml b/.github/workflows/tflint.yml index ce0572f377..8bb303cc55 100644 --- a/.github/workflows/tflint.yml +++ b/.github/workflows/tflint.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/tfschema.yml b/.github/workflows/tfschema.yml index 8a46285903..dc23c7331c 100644 --- a/.github/workflows/tfschema.yml +++ b/.github/workflows/tfschema.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/tfsec.yml b/.github/workflows/tfsec.yml index 13b594e31e..7fe1a5dd82 100644 --- a/.github/workflows/tfsec.yml +++ b/.github/workflows/tfsec.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/thanos.yml b/.github/workflows/thanos.yml index 7ab9e8f23b..0f67b2eb7a 100644 --- a/.github/workflows/thanos.yml +++ b/.github/workflows/thanos.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 569314a491..87dc7c57fd 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/variant.yml b/.github/workflows/variant.yml index 537bee8c96..2781b3e815 100644 --- a/.github/workflows/variant.yml +++ b/.github/workflows/variant.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/variant2.yml b/.github/workflows/variant2.yml index c5cdd7a8ec..78f4720e67 100644 --- a/.github/workflows/variant2.yml +++ b/.github/workflows/variant2.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/vault.yml b/.github/workflows/vault.yml index 8332da6ea6..55b695ce73 100644 --- a/.github/workflows/vault.yml +++ b/.github/workflows/vault.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/velero.yml b/.github/workflows/velero.yml index c86881c4ff..371d8ed185 100644 --- a/.github/workflows/velero.yml +++ b/.github/workflows/velero.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/vendir.yml b/.github/workflows/vendir.yml index 4fd65f42f3..f6b20a857a 100644 --- a/.github/workflows/vendir.yml +++ b/.github/workflows/vendir.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/venona.yml b/.github/workflows/venona.yml index d58168abca..f4919dbbaf 100644 --- a/.github/workflows/venona.yml +++ b/.github/workflows/venona.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/vert.yml b/.github/workflows/vert.yml index 3486210d7c..5b5a36d858 100644 --- a/.github/workflows/vert.yml +++ b/.github/workflows/vert.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/yajsv.yml b/.github/workflows/yajsv.yml index 49f4598b49..9f856c14d0 100644 --- a/.github/workflows/yajsv.yml +++ b/.github/workflows/yajsv.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/** diff --git a/.github/workflows/yq.yml b/.github/workflows/yq.yml index bb7b400da5..f9a196883e 100644 --- a/.github/workflows/yq.yml +++ b/.github/workflows/yq.yml @@ -25,10 +25,7 @@ on: pull_request: types: [opened, synchronize, reopened] - # Ignore pulls on branches that start with "mass-update/" - # for when we make changes that do not require a new package build, like updating the action - branches-ignore: - - 'mass-update/**' + # Include '[no ci]' in the commit message to keep the workflow from running on that commit in the PR. paths: - apk/** - deb/**