From e03be81baa31af93f2de40cba3bc54ce1f8340c5 Mon Sep 17 00:00:00 2001 From: Jo Date: Fri, 5 Jun 2026 09:59:47 +0200 Subject: [PATCH] Lock actions in CI (#2829) * update dockerfile * lock actions * remove dockerhub * fix golangci-lint install in ci image --- .devcontainer/Dockerfile | 34 +++++++++++---------------- .devcontainer/devcontainer.json | 8 ++++++- .github/workflows/builder-image.yml | 22 ++++++++--------- .github/workflows/multiarch-build.yml | 20 ++++++---------- .github/workflows/testing-git.yml | 13 ++++------ .github/workflows/testing.yml | 6 ++--- ci.Dockerfile | 4 ++-- 7 files changed, 48 insertions(+), 59 deletions(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index d652585a..b5aa15cf 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -1,4 +1,4 @@ -FROM quay.io/gmanka/archlinuxarm:base-devel +FROM --platform=linux/amd64 archlinux@sha256:80ee11bda3cb40c46061bbc91db00e3eb8e6147cb17189b4dc9554e501c791a0 LABEL maintainer="Jguer,docker@jguer.space" ENV GO111MODULE=on @@ -6,36 +6,30 @@ WORKDIR /app COPY go.mod . -# asciidoc, doxygen, meson needed for pacman-git +# Disable pacman's landlock/seccomp sandbox: it doesn't work inside BuildKit. +# asciidoc, doxygen, meson needed for pacman-git. RUN set -eux; \ - pacman-key --init; \ - sed -i 's/^#DisableSandboxFilesystem/DisableSandboxFilesystem/' /etc/pacman.conf; \ - sed -i 's/^#DisableSandboxSyscalls/DisableSandboxSyscalls/' /etc/pacman.conf; \ - pacman -Syu --noconfirm --needed pacman-contrib fish git-delta openssh bat go github-cli archlinux-keyring pacman go git gcc make base-devel sudo asciidoc doxygen meson; \ - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v2.10.1; \ + sed -i 's/^#\?DisableSandbox.*/DisableSandbox/' /etc/pacman.conf || true; \ + sed -i 's/^#\?DownloadUser.*/#DownloadUser = alpm/' /etc/pacman.conf || true; \ + pacman -Syu --noconfirm --needed \ + pacman-contrib zsh git-delta openssh bat go github-cli \ + archlinux-keyring git gcc make sudo asciidoc doxygen meson curl; \ + curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v2.12.2; \ go mod download; \ rm -rf /var/lib/pacman/sync/* /var/cache/pacman/* /tmp/* /var/tmp/*; \ - rm -rf /usr/share/man/* /usr/share/doc/* || true; \ - yes | pacman -Scc >/dev/null 2>&1 || true + rm -rf /usr/share/man/* /usr/share/doc/* || true +# Non-root user with passwordless sudo +RUN useradd -m -s /bin/bash docker \ + && echo "docker ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/docker -# Create a non-root user first -RUN useradd -m -s /bin/bash docker - -# Set passwordless sudo for the docker user -RUN echo "docker ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/docker - -# Switch to the docker user USER docker # Install xgotext RUN go install github.com/leonelquinteros/gotext/cli/xgotext@latest -# Add /app/bin to the PATH ENV PATH="/app/bin:/home/docker/go/bin:$PATH" -# Set the working directory WORKDIR /workspace -# Command to run when starting the container -CMD ["fish"] \ No newline at end of file +CMD ["zsh"] \ No newline at end of file diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 69d37f61..60b13309 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -2,8 +2,14 @@ "name": "Existing Dockerfile", "build": { "context": "..", - "dockerfile": "../.devcontainer/Dockerfile" + "dockerfile": "../.devcontainer/Dockerfile", + "options": [ + "--platform=linux/amd64" + ] }, + "runArgs": [ + "--platform=linux/amd64" + ], "overrideCommand": true, "customizations": { "vscode": { diff --git a/.github/workflows/builder-image.yml b/.github/workflows/builder-image.yml index 95a99702..ac4e81ba 100644 --- a/.github/workflows/builder-image.yml +++ b/.github/workflows/builder-image.yml @@ -23,16 +23,16 @@ jobs: - linux/arm64 steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 with: registry: ghcr.io username: ${{ github.repository_owner }} @@ -40,7 +40,7 @@ jobs: - name: Extract metadata for Docker id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 with: images: | ghcr.io/${{ env.REGISTRY_IMAGE }} @@ -50,7 +50,7 @@ jobs: - name: Build and push by digest id: build - uses: docker/build-push-action@v5 + uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 with: context: . file: ci.Dockerfile @@ -65,7 +65,7 @@ jobs: echo -n "$digest" > "/tmp/digests/$(echo "${{ matrix.platform }}" | tr '/' '_')" - name: Upload digest - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: digest-${{ matrix.platform == 'linux/amd64' && 'amd64' || matrix.platform == 'linux/arm/v7' && 'armv7' || 'arm64' }} path: /tmp/digests/* @@ -77,17 +77,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Download digests - uses: actions/download-artifact@v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: digest-* merge-multiple: true path: /tmp/digests - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 with: registry: ghcr.io username: ${{ github.repository_owner }} @@ -95,7 +95,7 @@ jobs: - name: Extract metadata for Docker id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 with: images: | ghcr.io/${{ env.REGISTRY_IMAGE }} diff --git a/.github/workflows/multiarch-build.yml b/.github/workflows/multiarch-build.yml index 99887a73..9945d538 100644 --- a/.github/workflows/multiarch-build.yml +++ b/.github/workflows/multiarch-build.yml @@ -14,21 +14,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Login to Docker Hub - uses: docker/login-action@v3 - with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} + uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 - name: Read info id: tags @@ -50,7 +44,7 @@ jobs: make docker-release ARCH=${{ steps.tags.outputs.arch }} VERSION=${{ steps.tags.outputs.version }} PREFIX="/usr" mv *.tar.gz artifacts - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: yay_${{ steps.tags.outputs.arch }} path: artifacts @@ -63,7 +57,7 @@ jobs: contents: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 @@ -73,7 +67,7 @@ jobs: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: yay_* merge-multiple: true @@ -88,6 +82,6 @@ jobs: ./yay_${{ steps.tags.outputs.version }}_*.tar.gz - name: Release Notary Action - uses: docker://aevea/release-notary:latest + uses: docker://aevea/release-notary@sha256:690915bf87458fd8eb1e1ff0be34b33377f920eda3f38b96c62ecbf897c831f4 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/testing-git.yml b/.github/workflows/testing-git.yml index 2edcf098..92e99acf 100644 --- a/.github/workflows/testing-git.yml +++ b/.github/workflows/testing-git.yml @@ -14,22 +14,17 @@ jobs: container: image: ghcr.io/jguer/yay-builder:latest steps: - - uses: actions/checkout@v4 - - uses: actions/cache@v3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 with: path: ~/go/pkg/mod key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} restore-keys: | ${{ runner.os }}-go- - - uses: actions/cache@v3 - with: - path: /home/runner/work/yay/yay/pacman-git - key: ${{ runner.os }}-pacman-${{ hashFiles('/home/runner/work/yay/yay/pacman-git/PKGBUILD') }} - restore-keys: | - ${{ runner.os }}-pacman- - name: checkout pacman-git run: | - git -C ./pacman-git pull || git clone https://aur.archlinux.org/pacman-git + rm -rf pacman-git + git clone --depth=1 https://aur.archlinux.org/pacman-git useradd github echo 'github ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers chmod -R 777 pacman-git diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml index 2c653182..ed0ea669 100644 --- a/.github/workflows/testing.yml +++ b/.github/workflows/testing.yml @@ -9,8 +9,8 @@ jobs: container: image: ghcr.io/jguer/yay-builder:latest steps: - - uses: actions/checkout@v4 - - uses: actions/cache@v3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 with: path: ~/go/pkg/mod key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} @@ -36,7 +36,7 @@ jobs: GOFLAGS: -buildvcs=false -tags=next run: make - name: Upload yay Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: yay path: ./yay diff --git a/ci.Dockerfile b/ci.Dockerfile index 6603c242..d33130bb 100644 --- a/ci.Dockerfile +++ b/ci.Dockerfile @@ -1,4 +1,4 @@ -FROM quay.io/gmanka/archlinuxarm:base-devel +FROM quay.io/gmanka/archlinuxarm:base-devel@sha256:1f2eccbd8730a0e199e86808ea9728a2c29efb290401cfb8dcd12da849d93e1f LABEL maintainer="Jguer,docker@jguer.space" ENV GO111MODULE=on @@ -12,7 +12,7 @@ RUN set -eux; \ sed -i 's/^#DisableSandboxFilesystem/DisableSandboxFilesystem/' /etc/pacman.conf; \ sed -i 's/^#DisableSandboxSyscalls/DisableSandboxSyscalls/' /etc/pacman.conf; \ pacman -Syu --noconfirm --needed archlinux-keyring pacman go git gcc make base-devel sudo asciidoc doxygen meson; \ - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v2.10.1; \ + go install github.com/golangci/golangci-lint/cmd/golangci-lint@v2.12.2; \ go mod download; \ rm -rf /var/lib/pacman/sync/* /var/cache/pacman/* /tmp/* /var/tmp/*; \ rm -rf /usr/share/man/* /usr/share/doc/* || true; \