Skip to content

Commit 9fdea3b

Browse files
simonswinesimonswine
authored
chore: Revisit github action workflows (#4150)
* Move all but essetinals workflows to workflows_disabled * Pin github actions to hash * Make workflows pass the zizmor checks * Remove deploy to dev-001
1 parent 21a7700 commit 9fdea3b

16 files changed

+52
-52
lines changed

‎.github/workflows/test.yml

Lines changed: 36 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
- r[0-9]+ # Trigger builds after a push to weekly branches
77
pull_request:
88

9+
permissions:
10+
contents: read
11+
912
concurrency:
1013
# Cancel any running workflow for the same branch when new commits are pushed.
1114
# We group both by ref_name (available when CI is triggered by a push to a branch/tag)
@@ -18,9 +21,11 @@ jobs:
1821
runs-on: ubuntu-latest
1922
steps:
2023
- name: Checkout code
21-
uses: actions/checkout@v4
24+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
25+
with:
26+
persist-credentials: false
2227
- name: Install Go
23-
uses: actions/setup-go@v5
28+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
2429
with:
2530
go-version: 1.23.8
2631
- name: Format
@@ -29,9 +34,11 @@ jobs:
2934
runs-on: ubuntu-latest
3035
steps:
3136
- name: Checkout code
32-
uses: actions/checkout@v4
37+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
38+
with:
39+
persist-credentials: false
3340
- name: Install Go
34-
uses: actions/setup-go@v5
41+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
3542
with:
3643
go-version: 1.23.8
3744
- name: Check generated files
@@ -47,9 +54,11 @@ jobs:
4754
runs-on: ${{ matrix.runner }}
4855
steps:
4956
- name: Checkout code
50-
uses: actions/checkout@v4
57+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
58+
with:
59+
persist-credentials: false
5160
- name: Install Go
52-
uses: actions/setup-go@v5
61+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
5362
with:
5463
go-version: 1.23.8
5564
- name: Go Mod
@@ -60,9 +69,11 @@ jobs:
6069
runs-on: ubuntu-latest
6170
steps:
6271
- name: Checkout code
63-
uses: actions/checkout@v4
72+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
73+
with:
74+
persist-credentials: false
6475
- name: Install Go
65-
uses: actions/setup-go@v5
76+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
6677
with:
6778
go-version: 1.23.8
6879
- name: Run linter
@@ -74,7 +85,9 @@ jobs:
7485
runs-on: ubuntu-latest
7586
steps:
7687
- name: "Check out code"
77-
uses: "actions/checkout@v4"
88+
uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683" # v4
89+
with:
90+
persist-credentials: false
7891
- name: "Test docs"
7992
run: make docs/test
8093

@@ -83,16 +96,18 @@ jobs:
8396
runs-on: ubuntu-latest
8497
steps:
8598
- name: Checkout Repo
86-
uses: actions/checkout@v4
99+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
100+
with:
101+
persist-credentials: false
87102
- name: Set up QEMU
88-
uses: docker/setup-qemu-action@v2
103+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
89104
- name: Set up Docker Buildx
90-
uses: docker/setup-buildx-action@v2
105+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
91106
- name: Set up go
92-
uses: actions/setup-go@v5
107+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
93108
with:
94109
go-version: 1.23.8
95-
- uses: actions/setup-node@v3
110+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
96111
with:
97112
node-version: 20
98113
cache: yarn
@@ -104,42 +119,23 @@ jobs:
104119
runs-on: ubuntu-latest
105120
steps:
106121
- name: Checkout Repo
107-
uses: actions/checkout@v4
122+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
123+
with:
124+
persist-credentials: false
108125
- name: Set up QEMU
109-
uses: docker/setup-qemu-action@v2
126+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
110127
- name: Set up Docker Buildx
111-
uses: docker/setup-buildx-action@v2
128+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
112129
- name: Set up go
113-
uses: actions/setup-go@v5
130+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
114131
with:
115132
go-version: 1.23.8
116133
- name: Login to Docker Hub
117-
uses: docker/login-action@v2
134+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
118135
with:
119136
username: ${{ secrets.DOCKERHUB_USERNAME }}
120137
password: ${{ secrets.DOCKERHUB_TOKEN }}
121138
- name: Pyroscope Build & push multi-arch image
122139
id: build-push
123140
run: |
124141
make docker-image/pyroscope/push-multiarch "BUILDX_ARGS=--cache-from=type=gha --cache-to=type=gha"
125-
126-
deploy-dev-001:
127-
if: github.event_name == 'push' && github.repository == 'grafana/pyroscope' && github.ref == 'refs/heads/main'
128-
runs-on: ubuntu-latest
129-
needs: [build-push]
130-
steps:
131-
- name: Checkout Repo
132-
uses: actions/checkout@v4
133-
- name: Get github app token (valid for an hour)
134-
id: app-release
135-
uses: tibdex/github-app-token@v1
136-
with:
137-
app_id: ${{ secrets.APP_ID }}
138-
private_key: ${{ secrets.APP_PRIVATE_KEY }}
139-
repository: grafana/deployment_tools
140-
- name: Deploy to fire-dev-001
141-
run: |
142-
git config --global url."https://x-access-token:$(echo "${GITHUB_TOKEN}" | xargs)@github.com/grafana/deployment_tools".insteadOf "https://github.com/grafana/deployment_tools"
143-
make docker-image/pyroscope/deploy-dev-001
144-
env:
145-
GITHUB_TOKEN: ${{ steps.app-release.outputs.token }}

‎.github/workflows/weekly-release.yml

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,18 @@ on:
44
push:
55
branches:
66
- 'weekly/f*'
7+
8+
permissions:
9+
contents: read
10+
711
jobs:
812
goreleaser-weekly:
913
runs-on: ubuntu-24.04
1014
steps:
11-
- uses: actions/checkout@v4
15+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
1216
with:
1317
fetch-depth: 0
18+
persist-credentials: false
1419
- name: Set GORELEASER_CURRENT_TAG
1520
run: echo "GORELEASER_CURRENT_TAG=v0.0.0-$(./tools/image-tag)" >> $GITHUB_ENV
1621
- name: Set WEEKLY_IMAGE_TAG
@@ -25,33 +30,32 @@ jobs:
2530
run: |
2631
git tag "$GORELEASER_CURRENT_TAG"
2732
git tag "$WEEKLY_IMAGE_TAG"
28-
- uses: actions/setup-go@v5
33+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
2934
with:
3035
go-version: "1.23.8"
31-
cache: true
36+
cache: false
3237
# setup docker buildx
3338
- name: Set up QEMU
34-
uses: docker/setup-qemu-action@v2
39+
uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2
3540
- name: Set up Docker Buildx
36-
uses: docker/setup-buildx-action@v2
41+
uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2
3742
# login to docker hub
38-
- uses: docker/login-action@v2
43+
- uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
3944
name: Login to Docker Hub
4045
with:
4146
username: ${{ secrets.DOCKERHUB_USERNAME }}
4247
password: ${{ secrets.DOCKERHUB_TOKEN }}
43-
- uses: actions/setup-node@v3
48+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
4449
with:
4550
node-version: 20
46-
cache: yarn
4751
- run: make frontend/build
4852
- name: Get github app token (valid for an hour)
4953
id: app-goreleaser
50-
uses: tibdex/github-app-token@v1
54+
uses: tibdex/github-app-token@32691ba7c9e7063bd457bd8f2a5703138591fa58 # v1
5155
with:
5256
app_id: ${{ secrets.APP_ID }}
5357
private_key: ${{ secrets.APP_PRIVATE_KEY }}
54-
- uses: goreleaser/goreleaser-action@v6
58+
- uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6
5559
with:
5660
# ensure this aligns with the version specified in the /Makefile
5761
version: v2.7.0
@@ -86,9 +90,9 @@ jobs:
8690
docker manifest push "grafana/pyroscope:${WEEKLY_IMAGE_TAG}"
8791
- name: Get github app token (valid for an hour)
8892
id: app-git-tag
89-
uses: tibdex/github-app-token@v1
93+
uses: tibdex/github-app-token@32691ba7c9e7063bd457bd8f2a5703138591fa58 # v1
9094
with:
9195
app_id: ${{ secrets.APP_ID }}
9296
private_key: ${{ secrets.APP_PRIVATE_KEY }}
9397
- name: Push git tag for weekly release
94-
run: git push https://x-access-token:${{ steps.app-git-tag.output.token }}@github.com/grafana/pyroscope.git "${WEEKLY_IMAGE_TAG}"
98+
run: git push "https://x-access-token:${{ steps.app-git-tag.output.token }}@github.com/grafana/pyroscope.git" "${WEEKLY_IMAGE_TAG}"

‎.github/workflows/backport.yml renamed to ‎.github/workflows_disabled/backport.yml

File renamed without changes.

‎.github/workflows/e2e.yaml renamed to ‎.github/workflows_disabled/e2e.yaml

File renamed without changes.

‎.github/workflows/frontend.yml renamed to ‎.github/workflows_disabled/frontend.yml

File renamed without changes.

‎.github/workflows/fuzzer.yml renamed to ‎.github/workflows_disabled/fuzzer.yml

File renamed without changes.

‎.github/workflows/helm-ci.yml renamed to ‎.github/workflows_disabled/helm-ci.yml

File renamed without changes.

‎.github/workflows/helm-release.yml renamed to ‎.github/workflows_disabled/helm-release.yml

File renamed without changes.

‎.github/workflows/publish-technical-documentation-next.yml renamed to ‎.github/workflows_disabled/publish-technical-documentation-next.yml

File renamed without changes.

‎.github/workflows/publish-technical-documentation-release.yml renamed to ‎.github/workflows_disabled/publish-technical-documentation-release.yml

File renamed without changes.

0 commit comments

Comments
 (0)