From b73020637ee9fae7c12ba8c44a69f29979129a9c Mon Sep 17 00:00:00 2001 From: StepSecurity Bot Date: Thu, 21 Sep 2023 16:45:27 +0000 Subject: [PATCH 1/5] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/dependabot.yml | 1291 +++++++++++++++++ .github/workflows/automate_area-labels.yml | 13 +- .../workflows/automate_changeset_feedback.yml | 9 +- .github/workflows/automate_merge_message.yml | 9 +- .github/workflows/automate_stale.yml | 13 +- .github/workflows/ci-noop.yml | 13 + .github/workflows/ci.yml | 33 +- .github/workflows/cron.yml | 7 +- .github/workflows/dependency-review.yml | 27 + .github/workflows/deploy_docker-image.yml | 17 +- .github/workflows/deploy_microsite.yml | 16 +- .github/workflows/deploy_nightly.yml | 13 +- .github/workflows/deploy_packages.yml | 28 +- .github/workflows/issue.yaml | 7 +- .../workflows/pr-review-comment-trigger.yaml | 10 +- .github/workflows/pr-review-comment.yaml | 9 +- .github/workflows/pr.yaml | 7 +- .github/workflows/scorecard.yml | 5 + .github/workflows/sync_code-formatting.yml | 13 +- .../workflows/sync_dependabot-changesets.yml | 9 +- .github/workflows/sync_release-manifest.yml | 13 +- .../workflows/sync_renovate-changesets.yml | 9 +- .github/workflows/sync_snyk-github-issues.yml | 13 +- .github/workflows/sync_snyk-monitor.yml | 19 +- .github/workflows/sync_version-packages.yml | 11 +- .github/workflows/uffizzi-build.yml | 35 +- .github/workflows/uffizzi-preview.yaml | 9 +- .../workflows/verify_accessibility-noop.yml | 8 + .github/workflows/verify_accessibility.yml | 11 +- .github/workflows/verify_codeql.yml | 20 +- .github/workflows/verify_docs-quality.yml | 9 +- .../workflows/verify_e2e-kubernetes-noop.yml | 8 + .github/workflows/verify_e2e-kubernetes.yml | 13 +- .github/workflows/verify_e2e-linux-noop.yml | 8 + .github/workflows/verify_e2e-linux.yml | 11 +- .github/workflows/verify_e2e-techdocs.yml | 12 +- .github/workflows/verify_e2e-windows-noop.yml | 8 + .github/workflows/verify_e2e-windows.yml | 15 +- .github/workflows/verify_fossa.yml | 10 +- .github/workflows/verify_microsite-noop.yml | 8 + .github/workflows/verify_microsite.yml | 12 +- .github/workflows/verify_storybook-noop.yml | 8 + .github/workflows/verify_storybook.yml | 13 +- .github/workflows/verify_windows.yml | 12 +- .pre-commit-config.yaml | 18 + 45 files changed, 1752 insertions(+), 110 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/dependency-review.yml create mode 100644 .pre-commit-config.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..253e5b3230 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,1291 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: daily + + - package-ecosystem: docker + directory: /contrib/.devcontainer + schedule: + interval: daily + + - package-ecosystem: docker + directory: /contrib/docker/devops + schedule: + interval: daily + + - package-ecosystem: npm + directory: /cypress + schedule: + interval: daily + + - package-ecosystem: npm + directory: /microsite + schedule: + interval: daily + + - package-ecosystem: npm + directory: / + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/app-defaults + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/app-next-example-plugin + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/app-next + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/app + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-app-api + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-defaults + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-dev-utils + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-next + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-openapi-utils + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-plugin-api + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-plugin-manager + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-tasks + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-test-utils + schedule: + interval: daily + + - package-ecosystem: docker + directory: /packages/backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/catalog-client + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/catalog-model + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/cli-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/cli-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/cli/asset-types + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/cli + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/codemods + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/config-loader + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/config + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/core-app-api + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/core-components + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/core-plugin-api + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/create-app + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/create-app/templates/default-app/examples/template/content + schedule: + interval: daily + + - package-ecosystem: docker + directory: /packages/create-app/templates/default-app/packages/backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/create-app/templates/default-app + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/dev-utils + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/e2e-test + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/errors + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/eslint-plugin + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/eslint-plugin/src/__fixtures__/monorepo + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/eslint-plugin/src/__fixtures__/monorepo/packages/bar + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/eslint-plugin/src/__fixtures__/monorepo/packages/foo + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/frontend-app-api + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/frontend-plugin-api + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/integration-aws-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/integration-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/integration + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/release-manifests + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/repo-tools + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/techdocs-cli-embedded-app + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/techdocs-cli + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/test-utils + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/theme + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/types + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/version-bridge + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/adr-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/adr-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/adr + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/airbrake-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/airbrake + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/allure + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/analytics-module-ga + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/analytics-module-ga4 + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/analytics-module-newrelic-browser + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/apache-airflow + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/api-docs-module-protoc-gen-doc + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/api-docs + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/apollo-explorer + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/app-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/app-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-backend-module-gcp-iap-provider + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-backend-module-github-provider + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-backend-module-gitlab-provider + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-backend-module-google-provider + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-backend-module-oauth2-provider + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/azure-devops-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/azure-devops-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/azure-devops + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/azure-sites-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/azure-sites-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/azure-sites + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/badges-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/badges + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/bazaar-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/bazaar + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/bitbucket-cloud-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/bitrise + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-aws + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-azure + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-bitbucket-cloud + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-bitbucket-server + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-bitbucket + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-gcp + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-gerrit + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-github + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-gitlab + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-incremental-ingestion + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-ldap + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-msgraph + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-openapi + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-puppetdb + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-scaffolder-entity-model + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-unprocessed + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-customized + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-graph + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-graphql + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-import + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-unprocessed-entities + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/cicd-statistics-module-gitlab + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/cicd-statistics + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/circleci + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/cloudbuild + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/code-climate + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/code-coverage-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/code-coverage + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/codescene + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/config-schema + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/cost-insights-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/cost-insights + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/devtools-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/devtools-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/devtools + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/dynatrace + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/entity-feedback-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/entity-feedback-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/entity-feedback + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/entity-validation + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-module-aws-sqs + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-module-azure + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-module-bitbucket-cloud + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-module-gerrit + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-module-github + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-module-gitlab + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-test-utils + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/example-todo-list-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/example-todo-list-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/example-todo-list + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/explore-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/explore-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/explore-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/explore + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/firehydrant + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/fossa + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/gcalendar + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/gcp-projects + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/git-release-manager + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/github-actions + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/github-deployments + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/github-issues + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/github-pull-requests-board + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/gitops-profiles + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/gocd + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/graphiql + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/graphql-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/graphql-voyager + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/home-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/home + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/ilert + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/jenkins-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/jenkins-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/jenkins + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/kafka-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/kafka + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/kubernetes-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/kubernetes-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/kubernetes + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/lighthouse-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/lighthouse-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/lighthouse + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/linguist-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/linguist-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/linguist + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/microsoft-calendar + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/newrelic-dashboard + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/newrelic + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/nomad-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/nomad + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/octopus-deploy + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/opencost + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/org-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/org + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/pagerduty + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/periskop-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/periskop + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/permission-backend-module-policy-allow-all + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/permission-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/permission-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/permission-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/permission-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/playlist-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/playlist-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/playlist + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/proxy-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/puppetdb + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/rollbar-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/rollbar + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend-module-confluence-to-markdown + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend-module-cookiecutter + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend-module-gitlab + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend-module-rails + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend-module-sentry + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend-module-yeoman + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend-module-catalog + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend-module-elasticsearch + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend-module-explore + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend-module-pg + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend-module-techdocs + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/sentry + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/shortcuts + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/sonarqube-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/sonarqube-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/sonarqube + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/splunk-on-call + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/stack-overflow-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/stack-overflow + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/stackstorm + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/tech-insights-backend-module-jsonfc + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/tech-insights-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/tech-insights-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/tech-insights-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/tech-insights + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/tech-radar + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/techdocs-addons-test-utils + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/techdocs-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/techdocs-module-addons-contrib + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/techdocs-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/techdocs-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/techdocs + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/todo-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/todo + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/user-settings-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/user-settings + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/vault-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/vault + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/xcmetrics + schedule: + interval: daily + + - package-ecosystem: npm + directory: /storybook + schedule: + interval: daily diff --git a/.github/workflows/automate_area-labels.yml b/.github/workflows/automate_area-labels.yml index 3d616506e1..c7a147470c 100644 --- a/.github/workflows/automate_area-labels.yml +++ b/.github/workflows/automate_area-labels.yml @@ -2,11 +2,22 @@ name: Automate area labels on: - pull_request_target +permissions: + contents: read + jobs: triage: + permissions: + contents: read # for actions/labeler to determine modified files + pull-requests: write # for actions/labeler to add labels to PRs runs-on: ubuntu-latest steps: - - uses: actions/labeler@v4 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4.3.0 with: repo-token: '${{ secrets.GITHUB_TOKEN }}' sync-labels: true diff --git a/.github/workflows/automate_changeset_feedback.yml b/.github/workflows/automate_changeset_feedback.yml index 9cadf12b4f..9d67c9ef12 100644 --- a/.github/workflows/automate_changeset_feedback.yml +++ b/.github/workflows/automate_changeset_feedback.yml @@ -22,14 +22,19 @@ jobs: if: github.repository == 'backstage/backstage' && github.event.pull_request.user.login != 'backstage-service' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: # Fetch the commit that's merged into the base rather than the target ref # This will let us diff only the contents of the PR, without fetching more history ref: 'refs/pull/${{ github.event.pull_request.number }}/merge' - name: fetch base run: git fetch --depth 1 origin ${{ github.base_ref }} - - uses: backstage/actions/changeset-feedback@v0.6.4 + - uses: backstage/actions/changeset-feedback@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 name: Generate feedback with: diff-ref: 'origin/master' diff --git a/.github/workflows/automate_merge_message.yml b/.github/workflows/automate_merge_message.yml index 9fed796aa5..1ae172e8e4 100644 --- a/.github/workflows/automate_merge_message.yml +++ b/.github/workflows/automate_merge_message.yml @@ -23,7 +23,12 @@ jobs: if: github.repository == 'backstage/backstage' && github.event.pull_request.merged == true runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: ref: '${{ github.event.pull_request.merge_commit_sha }}' @@ -39,7 +44,7 @@ jobs: node generate.js ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }} > message.txt - name: Post Message - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 env: ISSUE_NUMBER: ${{ github.event.pull_request.number }} with: diff --git a/.github/workflows/automate_stale.yml b/.github/workflows/automate_stale.yml index 452ecc48d6..a7a0041a9a 100644 --- a/.github/workflows/automate_stale.yml +++ b/.github/workflows/automate_stale.yml @@ -4,11 +4,22 @@ on: schedule: - cron: '*/10 * * * *' # run every 10 minutes as it also removes labels. +permissions: + contents: read + jobs: stale: + permissions: + issues: write # for actions/stale to close stale issues + pull-requests: write # for actions/stale to close stale PRs runs-on: ubuntu-latest steps: - - uses: actions/stale@v7 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/stale@6f05e4244c9a0b2ed3401882b05d701dd0a7289b # v7.0.0 id: stale with: stale-issue-message: > diff --git a/.github/workflows/ci-noop.yml b/.github/workflows/ci-noop.yml index 16bf11dd1a..bafe59e83a 100644 --- a/.github/workflows/ci-noop.yml +++ b/.github/workflows/ci-noop.yml @@ -7,6 +7,9 @@ on: paths: - 'microsite/**' +permissions: + contents: read + jobs: # The verify jobs runs all the verification that doesn't require a # diff towards master, since it takes some time to fetch that. @@ -19,6 +22,11 @@ jobs: name: Verify ${{ matrix.node-version }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP test-noop: @@ -30,4 +38,9 @@ jobs: name: Test ${{ matrix.node-version }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 12c19075a6..3234242223 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,16 +26,21 @@ jobs: name: Install ${{ matrix.node-version }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -57,16 +62,21 @@ jobs: name: Verify ${{ matrix.node-version }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -186,18 +196,23 @@ jobs: INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: fetch branch master run: git fetch origin master - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} diff --git a/.github/workflows/cron.yml b/.github/workflows/cron.yml index ef8906818f..50395b9f5c 100644 --- a/.github/workflows/cron.yml +++ b/.github/workflows/cron.yml @@ -8,7 +8,12 @@ jobs: cron: runs-on: ubuntu-latest steps: - - uses: backstage/actions/cron@v0.6.4 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: backstage/actions/cron@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }} private-key: ${{ secrets.BACKSTAGE_GOALIE_PRIVATE_KEY }} diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000000..9bfe6712e5 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,27 @@ +# Dependency Review Action +# +# This Action will scan dependency manifest files that change as part of a Pull Request, +# surfacing known-vulnerable versions of the packages declared or updated in the PR. +# Once installed, if the workflow run is marked as required, +# PRs introducing known-vulnerable packages will be blocked from merging. +# +# Source repository: https://github.com/actions/dependency-review-action +name: 'Dependency Review' +on: [pull_request] + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - name: 'Checkout Repository' + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - name: 'Dependency Review' + uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1 diff --git a/.github/workflows/deploy_docker-image.yml b/.github/workflows/deploy_docker-image.yml index 231b81598e..1e602bce60 100644 --- a/.github/workflows/deploy_docker-image.yml +++ b/.github/workflows/deploy_docker-image.yml @@ -13,20 +13,25 @@ jobs: node-version: [18.x] steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: path: backstage ref: v${{ github.event.client_payload.version }} - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -40,17 +45,17 @@ jobs: working-directory: ./example-app - name: Login to GitHub Container Registry - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 + uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0 - name: Build and push - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: context: './example-app' file: ./example-app/packages/backend/Dockerfile diff --git a/.github/workflows/deploy_microsite.yml b/.github/workflows/deploy_microsite.yml index dddb2de4af..75976456c0 100644 --- a/.github/workflows/deploy_microsite.yml +++ b/.github/workflows/deploy_microsite.yml @@ -4,8 +4,13 @@ on: branches: - master +permissions: + contents: read + jobs: deploy-microsite-and-storybook: + permissions: + contents: write # for JamesIves/github-pages-deploy-action to push changes in repo runs-on: ubuntu-latest env: @@ -18,10 +23,15 @@ jobs: cancel-in-progress: true steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js 18.x - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x registry-url: https://registry.npmjs.org/ # Needed for auth @@ -56,7 +66,7 @@ jobs: run: ls microsite/build && ls microsite/build/storybook - name: Deploy both microsite and storybook to gh-pages - uses: JamesIves/github-pages-deploy-action@v4.4.3 + uses: JamesIves/github-pages-deploy-action@a1ea191d508feb8485aceba848389d49f80ca2dc # v4.4.3 with: branch: gh-pages folder: microsite/build diff --git a/.github/workflows/deploy_nightly.yml b/.github/workflows/deploy_nightly.yml index e48a6b97ab..d5fe9f5a64 100644 --- a/.github/workflows/deploy_nightly.yml +++ b/.github/workflows/deploy_nightly.yml @@ -14,15 +14,20 @@ jobs: NODE_OPTIONS: --max-old-space-size=4096 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js 18.x - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v18.x @@ -59,7 +64,7 @@ jobs: - name: Discord notification if: ${{ failure() }} - uses: Ilshidur/action-discord@0.3.2 + uses: Ilshidur/action-discord@0c4b27844ba47cb1c7bee539c8eead5284ce9fa9 # 0.3.2 env: DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }} with: diff --git a/.github/workflows/deploy_packages.yml b/.github/workflows/deploy_packages.yml index 2329101eb0..b420ebf690 100644 --- a/.github/workflows/deploy_packages.yml +++ b/.github/workflows/deploy_packages.yml @@ -60,15 +60,20 @@ jobs: INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -112,7 +117,7 @@ jobs: - name: Discord notification if: ${{ failure() }} - uses: Ilshidur/action-discord@0.3.2 + uses: Ilshidur/action-discord@0c4b27844ba47cb1c7bee539c8eead5284ce9fa9 # 0.3.2 env: DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }} with: @@ -137,15 +142,20 @@ jobs: NODE_OPTIONS: --max-old-space-size=4096 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -185,7 +195,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }} - name: Dispatch repository event - uses: peter-evans/repository-dispatch@v2 + uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570 # v2.1.2 with: token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }} event-type: release-published @@ -193,7 +203,7 @@ jobs: # Notify everyone about this great new release :D - name: Discord notification - uses: Ilshidur/action-discord@0.3.2 + uses: Ilshidur/action-discord@0c4b27844ba47cb1c7bee539c8eead5284ce9fa9 # 0.3.2 env: DISCORD_WEBHOOK: ${{ secrets.DISCORD_RELEASE_WEBHOOK }} TAG_NAME: ${{ steps.create_tag.outputs.tag_name }} diff --git a/.github/workflows/issue.yaml b/.github/workflows/issue.yaml index 89595db189..b456c1dae4 100644 --- a/.github/workflows/issue.yaml +++ b/.github/workflows/issue.yaml @@ -9,5 +9,10 @@ jobs: if: github.repository == 'backstage/backstage' steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Issue sync - uses: backstage/actions/issue-sync@v0.6.4 + uses: backstage/actions/issue-sync@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 diff --git a/.github/workflows/pr-review-comment-trigger.yaml b/.github/workflows/pr-review-comment-trigger.yaml index 67e4c5abba..7ae7122154 100644 --- a/.github/workflows/pr-review-comment-trigger.yaml +++ b/.github/workflows/pr-review-comment-trigger.yaml @@ -7,6 +7,9 @@ on: types: - created +permissions: + contents: read + jobs: trigger: runs-on: ubuntu-latest @@ -16,13 +19,18 @@ jobs: if: github.repository == 'backstage/backstage' && github.event.comment.user.id == github.event.pull_request.user.id steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Save PR number env: PR_NUMBER: ${{ github.event.pull_request.number }} run: | mkdir -p ./pr echo $PR_NUMBER > ./pr/pr_number - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 with: name: pr_number-${{ github.event.pull_request.number }} path: pr/ diff --git a/.github/workflows/pr-review-comment.yaml b/.github/workflows/pr-review-comment.yaml index 0930c75ddd..1f26643bab 100644 --- a/.github/workflows/pr-review-comment.yaml +++ b/.github/workflows/pr-review-comment.yaml @@ -16,9 +16,14 @@ jobs: steps: # Inspired by https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Read PR Number id: pr-number - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | @@ -35,7 +40,7 @@ jobs: const prNumber = artifact.name.slice('pr_number-'.length) core.setOutput('pr-number', prNumber); - - uses: backstage/actions/re-review@v0.6.4 + - uses: backstage/actions/re-review@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }} private-key: ${{ secrets.BACKSTAGE_GOALIE_PRIVATE_KEY }} diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index a92effbd14..4993e93dbb 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -17,8 +17,13 @@ jobs: # Avoid running on issue comments if: github.repository == 'backstage/backstage' && ( github.event.pull_request || github.event.issue.pull_request ) steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: PR sync - uses: backstage/actions/pr-sync@v0.6.4 + uses: backstage/actions/pr-sync@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }} app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 99b391660a..f245240c99 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -28,6 +28,11 @@ jobs: id-token: write steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: 'Checkout code' uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: diff --git a/.github/workflows/sync_code-formatting.yml b/.github/workflows/sync_code-formatting.yml index 6471b265bc..f3afec592d 100644 --- a/.github/workflows/sync_code-formatting.yml +++ b/.github/workflows/sync_code-formatting.yml @@ -9,23 +9,28 @@ jobs: name: Autofix Markdown files using Prettier runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: # Fetch changes to previous commit - required for 'only_changed' in Prettier action fetch-depth: 0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} - name: Run Prettier on ADOPTERS.md - uses: creyD/prettier_action@v4.3 + uses: creyD/prettier_action@31355f8eef017f8aeba2e0bc09d8502b13dbbad1 # v4.3 with: # Modifies commit only if prettier autofixed the ADOPTERS.md prettier_options: --config docs/prettier.config.js --write ADOPTERS.md diff --git a/.github/workflows/sync_dependabot-changesets.yml b/.github/workflows/sync_dependabot-changesets.yml index d5f6f9a36c..0c732f28d1 100644 --- a/.github/workflows/sync_dependabot-changesets.yml +++ b/.github/workflows/sync_dependabot-changesets.yml @@ -10,8 +10,13 @@ jobs: runs-on: ubuntu-latest if: github.actor == 'dependabot[bot]' && github.repository == 'backstage/backstage' steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 2 ref: ${{ github.head_ref }} @@ -21,7 +26,7 @@ jobs: git config --global user.email noreply@backstage.io git config --global user.name 'Github changeset workflow' - name: Generate changeset - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | const { promises: fs } = require('fs'); diff --git a/.github/workflows/sync_release-manifest.yml b/.github/workflows/sync_release-manifest.yml index df8d3909f4..dcb13d58c5 100644 --- a/.github/workflows/sync_release-manifest.yml +++ b/.github/workflows/sync_release-manifest.yml @@ -8,7 +8,12 @@ jobs: runs-on: ubuntu-latest steps: # Setup node & install deps before checkout, keeping install quick - - uses: actions/setup-node@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x - name: Install dependencies @@ -16,7 +21,7 @@ jobs: run: npm install semver@7.3.5 fs-extra@10.0.0 @manypkg/get-packages@1.1.1 - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: path: backstage # 'v' prefix is added here for the tag, we keep it out of the manifest logic @@ -24,7 +29,7 @@ jobs: # Checkout backstage/versions into /backstage/versions, which is where store the output - name: Checkout versions - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: repository: backstage/versions path: backstage/versions @@ -48,7 +53,7 @@ jobs: git push - name: Dispatch update-helper update - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }} # TODO(Rugvip): Remove the create-app dispatch once we've been on the release version for a while diff --git a/.github/workflows/sync_renovate-changesets.yml b/.github/workflows/sync_renovate-changesets.yml index cd67fa9954..f29fdaa6b7 100644 --- a/.github/workflows/sync_renovate-changesets.yml +++ b/.github/workflows/sync_renovate-changesets.yml @@ -10,8 +10,13 @@ jobs: runs-on: ubuntu-latest if: github.actor == 'renovate[bot]' && github.repository == 'backstage/backstage' steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 2 ref: ${{ github.head_ref }} @@ -21,7 +26,7 @@ jobs: git config --global user.email noreply@backstage.io git config --global user.name 'Github changeset workflow' - name: Generate changeset - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | const { promises: fs } = require("fs"); diff --git a/.github/workflows/sync_snyk-github-issues.yml b/.github/workflows/sync_snyk-github-issues.yml index 6b55609bd5..5b8c56da43 100644 --- a/.github/workflows/sync_snyk-github-issues.yml +++ b/.github/workflows/sync_snyk-github-issues.yml @@ -11,20 +11,25 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js 18.x - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v18.x - name: Create Snyk report - uses: snyk/actions/node@master + uses: snyk/actions/node@299cde98a08ff8b1c2bfde1e5a067bce67a6d2b8 # master continue-on-error: true # Snyk CLI exits with error when vulnerabilities are found with: args: > diff --git a/.github/workflows/sync_snyk-monitor.yml b/.github/workflows/sync_snyk-monitor.yml index 8bfa90d726..dbeccb52fc 100644 --- a/.github/workflows/sync_snyk-monitor.yml +++ b/.github/workflows/sync_snyk-monitor.yml @@ -14,13 +14,24 @@ on: # ignore policies in the .snyk files and then have them show up in the snyk web # UI, and also automatically adds any new packages that are created. +permissions: + contents: read + jobs: sync: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Monitor and Synchronize Snyk Policies - uses: snyk/actions/node@master + uses: snyk/actions/node@299cde98a08ff8b1c2bfde1e5a067bce67a6d2b8 # master with: command: monitor args: > @@ -35,7 +46,7 @@ jobs: # Above we run the `monitor` command, this runs the `test` command which is # the one that generates the SARIF report that we can upload to GitHub. - name: Create Snyk report - uses: snyk/actions/node@master + uses: snyk/actions/node@299cde98a08ff8b1c2bfde1e5a067bce67a6d2b8 # master continue-on-error: true # To make sure that SARIF upload gets called with: args: > @@ -47,6 +58,6 @@ jobs: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} NODE_OPTIONS: --max-old-space-size=7168 - name: Upload Snyk report - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 with: sarif_file: snyk.sarif diff --git a/.github/workflows/sync_version-packages.yml b/.github/workflows/sync_version-packages.yml index 127c11791d..a77050318b 100644 --- a/.github/workflows/sync_version-packages.yml +++ b/.github/workflows/sync_version-packages.yml @@ -13,7 +13,12 @@ jobs: name: Create Changeset PR runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 20000 fetch-tags: true @@ -21,7 +26,7 @@ jobs: - name: Install Dependencies run: yarn --immutable - name: Create Release Pull Request - uses: backstage/changesets-action@v2 + uses: backstage/changesets-action@99063c276a7f12e024cb310e7a05a3a5b89449f8 # v2.1.0 with: # Calls out to `changeset version`, but also runs prettier version: yarn release @@ -31,7 +36,7 @@ jobs: - name: Discord notification if: ${{ failure() }} - uses: Ilshidur/action-discord@0.3.2 + uses: Ilshidur/action-discord@0c4b27844ba47cb1c7bee539c8eead5284ce9fa9 # 0.3.2 env: DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }} with: diff --git a/.github/workflows/uffizzi-build.yml b/.github/workflows/uffizzi-build.yml index 1bcd5ebcd8..b2d3667f4d 100644 --- a/.github/workflows/uffizzi-build.yml +++ b/.github/workflows/uffizzi-build.yml @@ -19,17 +19,22 @@ jobs: outputs: tags: ${{ steps.meta.outputs.tags }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: setup-node - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x registry-url: https://registry.npmjs.org/ - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: linux-v18 @@ -46,7 +51,7 @@ jobs: yarn workspace example-backend build - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 + uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0 - name: Generate UUID image name id: uuid @@ -54,13 +59,13 @@ jobs: - name: Docker metadata id: meta - uses: docker/metadata-action@v4 + uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0 with: images: registry.uffizzi.com/${{ env.UUID_TAG_APP }} tags: type=raw,value=60d - name: Build Image - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: context: . file: packages/backend/Dockerfile @@ -76,8 +81,13 @@ jobs: outputs: compose-file-cache-key: ${{ steps.hash.outputs.hash }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Checkout git repo - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Render Compose File run: | BACKSTAGE_IMAGE=$(echo ${{ needs.build-backstage.outputs.tags }}) @@ -86,13 +96,13 @@ jobs: envsubst '$BACKSTAGE_IMAGE $GITHUB_SHA' < .github/uffizzi/docker-compose.uffizzi.yml > docker-compose.rendered.yml cat docker-compose.rendered.yml - name: Upload Rendered Compose File as Artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 with: name: preview-spec path: docker-compose.rendered.yml retention-days: 2 - name: Upload PR Event as Artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 with: name: preview-spec path: ${{ github.event_path }} @@ -104,8 +114,13 @@ jobs: if: ${{ github.event.action == 'closed' }} steps: # If this PR is closing, we will not render a compose file nor pass it to the next workflow. + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Upload PR Event as Artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 with: name: preview-spec path: ${{ github.event_path }} diff --git a/.github/workflows/uffizzi-preview.yaml b/.github/workflows/uffizzi-preview.yaml index 87c1eaa02f..bf43bbdb4c 100644 --- a/.github/workflows/uffizzi-preview.yaml +++ b/.github/workflows/uffizzi-preview.yaml @@ -17,9 +17,14 @@ jobs: git-ref: ${{ env.GIT_REF }} pr-number: ${{ env.PR_NUMBER }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: 'Download artifacts' # Fetch output (zip archive) from the workflow run that triggered this workflow. - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({ @@ -59,7 +64,7 @@ jobs: - name: Cache Rendered Compose File if: ${{ fromJSON(env.EVENT_JSON).action != 'closed' }} - uses: actions/cache@v3 + uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2 with: path: docker-compose.rendered.yml key: ${{ env.COMPOSE_FILE_HASH }} diff --git a/.github/workflows/verify_accessibility-noop.yml b/.github/workflows/verify_accessibility-noop.yml index bde483eece..e2b1860b28 100644 --- a/.github/workflows/verify_accessibility-noop.yml +++ b/.github/workflows/verify_accessibility-noop.yml @@ -17,9 +17,17 @@ on: - 'plugins/search/src/**' - 'plugins/search-react/src/**' +permissions: + contents: read + jobs: noop: name: Accessibility runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/verify_accessibility.yml b/.github/workflows/verify_accessibility.yml index 32ded3bd3a..7d8753b3bd 100644 --- a/.github/workflows/verify_accessibility.yml +++ b/.github/workflows/verify_accessibility.yml @@ -19,13 +19,18 @@ jobs: name: Accessibility runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Use Node.js 18.x - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v18.x - name: run Lighthouse CI diff --git a/.github/workflows/verify_codeql.yml b/.github/workflows/verify_codeql.yml index f3417ac582..8ea2e8fcd8 100644 --- a/.github/workflows/verify_codeql.yml +++ b/.github/workflows/verify_codeql.yml @@ -19,8 +19,15 @@ on: schedule: - cron: '0 8 * * 6' +permissions: + contents: read + jobs: analyze: + permissions: + actions: read # for github/codeql-action/init to get workflow details + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/autobuild to send a status report name: Analyze runs-on: ubuntu-latest @@ -34,8 +41,13 @@ jobs: # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: # We must fetch at least the immediate parents so that if this is # a pull request then we can checkout the head. @@ -43,7 +55,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -54,7 +66,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 # ℹ️ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -68,4 +80,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 diff --git a/.github/workflows/verify_docs-quality.yml b/.github/workflows/verify_docs-quality.yml index dc1d942e32..1760b2a186 100644 --- a/.github/workflows/verify_docs-quality.yml +++ b/.github/workflows/verify_docs-quality.yml @@ -11,7 +11,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 # Vale does not support file excludes, so we use the script to generate a list of files instead # The action also does not allow args or a local config file to be passed in, so the files array @@ -21,7 +26,7 @@ jobs: run: echo "args=$(node scripts/check-docs-quality.js --ci-args)" >> $GITHUB_OUTPUT - name: documentation quality check - uses: errata-ai/vale-action@v2.0.1 + uses: errata-ai/vale-action@c4213d4de3d5f718b8497bd86161531c78992084 # v2.0.1 with: # This also contains --config=.github/vale/config.ini ... :/ files: '${{ steps.generate.outputs.args }}' diff --git a/.github/workflows/verify_e2e-kubernetes-noop.yml b/.github/workflows/verify_e2e-kubernetes-noop.yml index bedf357079..5c52968820 100644 --- a/.github/workflows/verify_e2e-kubernetes-noop.yml +++ b/.github/workflows/verify_e2e-kubernetes-noop.yml @@ -9,6 +9,9 @@ on: - '.github/workflows/verify_e2e-kubernetes.yml' - 'packages/backend-common/src/**' +permissions: + contents: read + jobs: verify: runs-on: ubuntu-latest @@ -19,4 +22,9 @@ jobs: name: Kubernetes ${{ matrix.node-version }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/verify_e2e-kubernetes.yml b/.github/workflows/verify_e2e-kubernetes.yml index 0c78c1f933..237ce4977b 100644 --- a/.github/workflows/verify_e2e-kubernetes.yml +++ b/.github/workflows/verify_e2e-kubernetes.yml @@ -21,21 +21,26 @@ jobs: name: Kubernetes ${{ matrix.node-version }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} - name: bootstrap kind - uses: helm/kind-action@v1.8.0 + uses: helm/kind-action@dda0770415bac9fc20092cacbc54aa298604d140 # v1.8.0 - name: kubernetes test working-directory: packages/backend-common diff --git a/.github/workflows/verify_e2e-linux-noop.yml b/.github/workflows/verify_e2e-linux-noop.yml index 1384b83378..27e08c7055 100644 --- a/.github/workflows/verify_e2e-linux-noop.yml +++ b/.github/workflows/verify_e2e-linux-noop.yml @@ -14,6 +14,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: noop: runs-on: ubuntu-latest @@ -24,4 +27,9 @@ jobs: name: E2E Linux ${{ matrix.node-version }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/verify_e2e-linux.yml b/.github/workflows/verify_e2e-linux.yml index 61ce55e385..9c684b9ea3 100644 --- a/.github/workflows/verify_e2e-linux.yml +++ b/.github/workflows/verify_e2e-linux.yml @@ -39,7 +39,12 @@ jobs: name: E2E Linux ${{ matrix.node-version }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Configure Git run: | @@ -47,12 +52,12 @@ jobs: git config --global user.name 'GitHub e2e user' - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} diff --git a/.github/workflows/verify_e2e-techdocs.yml b/.github/workflows/verify_e2e-techdocs.yml index fd5c4f0956..a7116d9bf8 100644 --- a/.github/workflows/verify_e2e-techdocs.yml +++ b/.github/workflows/verify_e2e-techdocs.yml @@ -12,6 +12,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: verify: runs-on: ubuntu-latest @@ -26,8 +29,13 @@ jobs: name: Techdocs steps: - - uses: actions/checkout@v3 - - uses: actions/setup-python@v4 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: '3.9' diff --git a/.github/workflows/verify_e2e-windows-noop.yml b/.github/workflows/verify_e2e-windows-noop.yml index f042c350c2..e4b8556f58 100644 --- a/.github/workflows/verify_e2e-windows-noop.yml +++ b/.github/workflows/verify_e2e-windows-noop.yml @@ -11,6 +11,9 @@ on: - 'packages/e2e-test/**' - 'packages/create-app/**' +permissions: + contents: read + jobs: noop: runs-on: windows-2019 @@ -21,4 +24,9 @@ jobs: name: E2E Windows ${{ matrix.node-version }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/verify_e2e-windows.yml b/.github/workflows/verify_e2e-windows.yml index b1decefd10..016ea04b95 100644 --- a/.github/workflows/verify_e2e-windows.yml +++ b/.github/workflows/verify_e2e-windows.yml @@ -32,12 +32,17 @@ jobs: steps: # In order to have the create-app template function as if it was downloaded from NPM # we need to make sure we checkout files with LF line endings only + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Set git to use LF run: | git config --global core.autocrlf false git config --global core.eol lf - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Configure Git run: | @@ -45,18 +50,18 @@ jobs: git config --global user.name 'GitHub e2e user' - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: setup python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: '3.10' - name: Add msbuild to PATH - uses: microsoft/setup-msbuild@v1.3.1 + uses: microsoft/setup-msbuild@1ff57057b5cfdc39105cd07a01d78e9b0ea0c14c # v1.3.1 - name: Setup gyp env run: | @@ -70,7 +75,7 @@ jobs: npm prefix -g | % {npm config set node_gyp "$_\node_modules\node-gyp\bin\node-gyp.js"} - name: setup chrome - uses: browser-actions/setup-chrome@latest + uses: browser-actions/setup-chrome@803ef6dfb4fdf22089c9563225d95e4a515820a0 # latest - name: yarn install uses: backstage/actions/yarn-install@v0.6.4 diff --git a/.github/workflows/verify_fossa.yml b/.github/workflows/verify_fossa.yml index 8c6b25d2e4..5174845467 100644 --- a/.github/workflows/verify_fossa.yml +++ b/.github/workflows/verify_fossa.yml @@ -5,13 +5,21 @@ on: pull_request: branches: [master] +permissions: + contents: read + jobs: analyze: runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Install Fossa run: "curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | bash" diff --git a/.github/workflows/verify_microsite-noop.yml b/.github/workflows/verify_microsite-noop.yml index cca7e512c5..8c329a0f27 100644 --- a/.github/workflows/verify_microsite-noop.yml +++ b/.github/workflows/verify_microsite-noop.yml @@ -11,10 +11,18 @@ on: - 'mkdocs.yml' - 'docs/**' +permissions: + contents: read + jobs: noop: runs-on: ubuntu-latest name: Microsite steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/verify_microsite.yml b/.github/workflows/verify_microsite.yml index d219d0ea74..e14799f378 100644 --- a/.github/workflows/verify_microsite.yml +++ b/.github/workflows/verify_microsite.yml @@ -9,6 +9,9 @@ on: - 'mkdocs.yml' - 'docs/**' +permissions: + contents: read + jobs: build-microsite: runs-on: ubuntu-latest @@ -20,10 +23,15 @@ jobs: name: Microsite steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js 18.x - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x diff --git a/.github/workflows/verify_storybook-noop.yml b/.github/workflows/verify_storybook-noop.yml index c1f16e4fbd..aee4623d5a 100644 --- a/.github/workflows/verify_storybook-noop.yml +++ b/.github/workflows/verify_storybook-noop.yml @@ -18,10 +18,18 @@ on: - 'packages/core-components/src/**' - '**/*.stories.tsx' +permissions: + contents: read + jobs: noop: runs-on: ubuntu-latest name: Storybook steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/verify_storybook.yml b/.github/workflows/verify_storybook.yml index bcb0cfe178..3d1bcbf34e 100644 --- a/.github/workflows/verify_storybook.yml +++ b/.github/workflows/verify_storybook.yml @@ -27,17 +27,22 @@ jobs: name: Storybook steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 0 # Required to retrieve git history - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} - name: storybook yarn install @@ -46,7 +51,7 @@ jobs: - run: yarn build-storybook - - uses: chromaui/action@v1 + - uses: chromaui/action@807600692d28833b717c155e15ed20905cdc865c # v1 with: token: ${{ secrets.GITHUB_TOKEN }} # projectToken intentionally shared to allow collaborators to run Chromatic on forks diff --git a/.github/workflows/verify_windows.yml b/.github/workflows/verify_windows.yml index 312c662b5a..309c2be7ab 100644 --- a/.github/workflows/verify_windows.yml +++ b/.github/workflows/verify_windows.yml @@ -7,6 +7,9 @@ on: paths: - '.github/workflows/verify_windows.yml' +permissions: + contents: read + jobs: build: runs-on: windows-2022 @@ -25,10 +28,15 @@ jobs: INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000000..723e338d33 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,18 @@ +repos: +- repo: https://github.com/gitleaks/gitleaks + rev: v8.16.3 + hooks: + - id: gitleaks +- repo: https://github.com/jumanjihouse/pre-commit-hooks + rev: 3.0.0 + hooks: + - id: shellcheck +- repo: https://github.com/pre-commit/mirrors-eslint + rev: v8.38.0 + hooks: + - id: eslint +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.4.0 + hooks: + - id: end-of-file-fixer + - id: trailing-whitespace From 753630068a34a5d23d0ef462b51c61b024d36d11 Mon Sep 17 00:00:00 2001 From: NishkarshRaj Date: Thu, 21 Sep 2023 22:43:12 +0530 Subject: [PATCH 2/5] bump Signed-off-by: NishkarshRaj --- .github/dependabot.yml | 1291 ----------------- .github/workflows/automate_area-labels.yml | 6 +- .../workflows/automate_changeset_feedback.yml | 4 +- .github/workflows/automate_merge_message.yml | 4 +- .github/workflows/automate_stale.yml | 6 +- .github/workflows/ci.yml | 18 +- .github/workflows/cron.yml | 2 +- .github/workflows/dependency-review.yml | 27 - .github/workflows/deploy_docker-image.yml | 12 +- .github/workflows/deploy_microsite.yml | 6 +- .github/workflows/deploy_packages.yml | 12 +- .github/workflows/issue.yaml | 2 +- .../workflows/pr-review-comment-trigger.yaml | 2 +- .github/workflows/pr-review-comment.yaml | 4 +- .github/workflows/pr.yaml | 2 +- .github/workflows/scorecard.yml | 4 +- .github/workflows/sync_code-formatting.yml | 4 +- .../workflows/sync_dependabot-changesets.yml | 4 +- .github/workflows/sync_release-manifest.yml | 8 +- .../workflows/sync_renovate-changesets.yml | 4 +- .github/workflows/sync_snyk-github-issues.yml | 6 +- .github/workflows/sync_snyk-monitor.yml | 8 +- .github/workflows/sync_version-packages.yml | 4 +- .github/workflows/uffizzi-build.yml | 14 +- .github/workflows/uffizzi-preview.yaml | 4 +- .github/workflows/verify_accessibility.yml | 6 +- .github/workflows/verify_codeql.yml | 14 +- .github/workflows/verify_docs-quality.yml | 2 +- .github/workflows/verify_e2e-kubernetes.yml | 6 +- .github/workflows/verify_e2e-linux.yml | 6 +- .github/workflows/verify_e2e-techdocs.yml | 4 +- .github/workflows/verify_e2e-windows.yml | 8 +- .github/workflows/verify_fossa.yml | 2 +- .github/workflows/verify_microsite.yml | 4 +- .github/workflows/verify_storybook.yml | 6 +- .github/workflows/verify_windows.yml | 4 +- .pre-commit-config.yaml | 18 - 37 files changed, 101 insertions(+), 1437 deletions(-) delete mode 100644 .github/dependabot.yml delete mode 100644 .github/workflows/dependency-review.yml delete mode 100644 .pre-commit-config.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 253e5b3230..0000000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,1291 +0,0 @@ -version: 2 -updates: - - package-ecosystem: github-actions - directory: / - schedule: - interval: daily - - - package-ecosystem: docker - directory: /contrib/.devcontainer - schedule: - interval: daily - - - package-ecosystem: docker - directory: /contrib/docker/devops - schedule: - interval: daily - - - package-ecosystem: npm - directory: /cypress - schedule: - interval: daily - - - package-ecosystem: npm - directory: /microsite - schedule: - interval: daily - - - package-ecosystem: npm - directory: / - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/app-defaults - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/app-next-example-plugin - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/app-next - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/app - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/backend-app-api - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/backend-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/backend-defaults - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/backend-dev-utils - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/backend-next - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/backend-openapi-utils - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/backend-plugin-api - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/backend-plugin-manager - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/backend-tasks - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/backend-test-utils - schedule: - interval: daily - - - package-ecosystem: docker - directory: /packages/backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/catalog-client - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/catalog-model - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/cli-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/cli-node - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/cli/asset-types - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/cli - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/codemods - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/config-loader - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/config - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/core-app-api - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/core-components - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/core-plugin-api - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/create-app - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/create-app/templates/default-app/examples/template/content - schedule: - interval: daily - - - package-ecosystem: docker - directory: /packages/create-app/templates/default-app/packages/backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/create-app/templates/default-app - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/dev-utils - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/e2e-test - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/errors - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/eslint-plugin - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/eslint-plugin/src/__fixtures__/monorepo - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/eslint-plugin/src/__fixtures__/monorepo/packages/bar - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/eslint-plugin/src/__fixtures__/monorepo/packages/foo - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/frontend-app-api - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/frontend-plugin-api - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/integration-aws-node - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/integration-react - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/integration - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/release-manifests - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/repo-tools - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/techdocs-cli-embedded-app - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/techdocs-cli - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/test-utils - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/theme - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/types - schedule: - interval: daily - - - package-ecosystem: npm - directory: /packages/version-bridge - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/adr-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/adr-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/adr - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/airbrake-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/airbrake - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/allure - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/analytics-module-ga - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/analytics-module-ga4 - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/analytics-module-newrelic-browser - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/apache-airflow - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/api-docs-module-protoc-gen-doc - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/api-docs - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/apollo-explorer - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/app-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/app-node - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/auth-backend-module-gcp-iap-provider - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/auth-backend-module-github-provider - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/auth-backend-module-gitlab-provider - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/auth-backend-module-google-provider - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/auth-backend-module-oauth2-provider - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/auth-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/auth-node - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/azure-devops-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/azure-devops-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/azure-devops - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/azure-sites-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/azure-sites-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/azure-sites - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/badges-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/badges - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/bazaar-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/bazaar - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/bitbucket-cloud-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/bitrise - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-aws - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-azure - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-bitbucket-cloud - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-bitbucket-server - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-bitbucket - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-gcp - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-gerrit - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-github - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-gitlab - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-incremental-ingestion - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-ldap - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-msgraph - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-openapi - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-puppetdb - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-scaffolder-entity-model - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend-module-unprocessed - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-customized - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-graph - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-graphql - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-import - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-node - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-react - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog-unprocessed-entities - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/catalog - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/cicd-statistics-module-gitlab - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/cicd-statistics - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/circleci - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/cloudbuild - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/code-climate - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/code-coverage-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/code-coverage - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/codescene - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/config-schema - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/cost-insights-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/cost-insights - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/devtools-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/devtools-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/devtools - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/dynatrace - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/entity-feedback-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/entity-feedback-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/entity-feedback - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/entity-validation - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/events-backend-module-aws-sqs - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/events-backend-module-azure - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/events-backend-module-bitbucket-cloud - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/events-backend-module-gerrit - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/events-backend-module-github - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/events-backend-module-gitlab - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/events-backend-test-utils - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/events-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/events-node - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/example-todo-list-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/example-todo-list-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/example-todo-list - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/explore-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/explore-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/explore-react - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/explore - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/firehydrant - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/fossa - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/gcalendar - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/gcp-projects - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/git-release-manager - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/github-actions - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/github-deployments - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/github-issues - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/github-pull-requests-board - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/gitops-profiles - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/gocd - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/graphiql - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/graphql-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/graphql-voyager - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/home-react - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/home - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/ilert - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/jenkins-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/jenkins-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/jenkins - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/kafka-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/kafka - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/kubernetes-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/kubernetes-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/kubernetes - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/lighthouse-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/lighthouse-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/lighthouse - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/linguist-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/linguist-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/linguist - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/microsoft-calendar - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/newrelic-dashboard - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/newrelic - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/nomad-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/nomad - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/octopus-deploy - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/opencost - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/org-react - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/org - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/pagerduty - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/periskop-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/periskop - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/permission-backend-module-policy-allow-all - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/permission-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/permission-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/permission-node - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/permission-react - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/playlist-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/playlist-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/playlist - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/proxy-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/puppetdb - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/rollbar-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/rollbar - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/scaffolder-backend-module-confluence-to-markdown - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/scaffolder-backend-module-cookiecutter - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/scaffolder-backend-module-gitlab - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/scaffolder-backend-module-rails - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/scaffolder-backend-module-sentry - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/scaffolder-backend-module-yeoman - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/scaffolder-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/scaffolder-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/scaffolder-node - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/scaffolder-react - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/scaffolder - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/search-backend-module-catalog - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/search-backend-module-elasticsearch - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/search-backend-module-explore - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/search-backend-module-pg - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/search-backend-module-techdocs - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/search-backend-node - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/search-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/search-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/search-react - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/search - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/sentry - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/shortcuts - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/sonarqube-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/sonarqube-react - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/sonarqube - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/splunk-on-call - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/stack-overflow-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/stack-overflow - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/stackstorm - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/tech-insights-backend-module-jsonfc - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/tech-insights-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/tech-insights-common - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/tech-insights-node - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/tech-insights - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/tech-radar - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/techdocs-addons-test-utils - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/techdocs-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/techdocs-module-addons-contrib - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/techdocs-node - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/techdocs-react - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/techdocs - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/todo-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/todo - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/user-settings-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/user-settings - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/vault-backend - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/vault - schedule: - interval: daily - - - package-ecosystem: npm - directory: /plugins/xcmetrics - schedule: - interval: daily - - - package-ecosystem: npm - directory: /storybook - schedule: - interval: daily diff --git a/.github/workflows/automate_area-labels.yml b/.github/workflows/automate_area-labels.yml index c7a147470c..dfb60c9243 100644 --- a/.github/workflows/automate_area-labels.yml +++ b/.github/workflows/automate_area-labels.yml @@ -8,8 +8,8 @@ permissions: jobs: triage: permissions: - contents: read # for actions/labeler to determine modified files - pull-requests: write # for actions/labeler to add labels to PRs + contents: read # for actions/labeler to determine modified files + pull-requests: write # for actions/labeler to add labels to PRs runs-on: ubuntu-latest steps: - name: Harden Runner @@ -17,7 +17,7 @@ jobs: with: egress-policy: audit - - uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4.3.0 + - uses: actions/labeler@v4.3.0 with: repo-token: '${{ secrets.GITHUB_TOKEN }}' sync-labels: true diff --git a/.github/workflows/automate_changeset_feedback.yml b/.github/workflows/automate_changeset_feedback.yml index 9d67c9ef12..483d59dc8c 100644 --- a/.github/workflows/automate_changeset_feedback.yml +++ b/.github/workflows/automate_changeset_feedback.yml @@ -27,14 +27,14 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 with: # Fetch the commit that's merged into the base rather than the target ref # This will let us diff only the contents of the PR, without fetching more history ref: 'refs/pull/${{ github.event.pull_request.number }}/merge' - name: fetch base run: git fetch --depth 1 origin ${{ github.base_ref }} - - uses: backstage/actions/changeset-feedback@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + - uses: backstage/actions/changeset-feedback@v0.6.4 name: Generate feedback with: diff-ref: 'origin/master' diff --git a/.github/workflows/automate_merge_message.yml b/.github/workflows/automate_merge_message.yml index 1ae172e8e4..4cbf6c69a2 100644 --- a/.github/workflows/automate_merge_message.yml +++ b/.github/workflows/automate_merge_message.yml @@ -28,7 +28,7 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 with: ref: '${{ github.event.pull_request.merge_commit_sha }}' @@ -44,7 +44,7 @@ jobs: node generate.js ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }} > message.txt - name: Post Message - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 + uses: actions/github-script@v6.4.1 env: ISSUE_NUMBER: ${{ github.event.pull_request.number }} with: diff --git a/.github/workflows/automate_stale.yml b/.github/workflows/automate_stale.yml index a7a0041a9a..40ebdf8a3e 100644 --- a/.github/workflows/automate_stale.yml +++ b/.github/workflows/automate_stale.yml @@ -10,8 +10,8 @@ permissions: jobs: stale: permissions: - issues: write # for actions/stale to close stale issues - pull-requests: write # for actions/stale to close stale PRs + issues: write # for actions/stale to close stale issues + pull-requests: write # for actions/stale to close stale PRs runs-on: ubuntu-latest steps: - name: Harden Runner @@ -19,7 +19,7 @@ jobs: with: egress-policy: audit - - uses: actions/stale@6f05e4244c9a0b2ed3401882b05d701dd0a7289b # v7.0.0 + - uses: actions/stale@v7.0.0 id: stale with: stale-issue-message: > diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3234242223..b08a28d786 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -31,16 +31,16 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/yarn-install@v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -67,16 +67,16 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/yarn-install@v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -201,18 +201,18 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 - name: fetch branch master run: git fetch origin master - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/yarn-install@v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} diff --git a/.github/workflows/cron.yml b/.github/workflows/cron.yml index 50395b9f5c..2874be512c 100644 --- a/.github/workflows/cron.yml +++ b/.github/workflows/cron.yml @@ -13,7 +13,7 @@ jobs: with: egress-policy: audit - - uses: backstage/actions/cron@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + - uses: backstage/actions/cron@v0.6.4 with: app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }} private-key: ${{ secrets.BACKSTAGE_GOALIE_PRIVATE_KEY }} diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml deleted file mode 100644 index 9bfe6712e5..0000000000 --- a/.github/workflows/dependency-review.yml +++ /dev/null @@ -1,27 +0,0 @@ -# Dependency Review Action -# -# This Action will scan dependency manifest files that change as part of a Pull Request, -# surfacing known-vulnerable versions of the packages declared or updated in the PR. -# Once installed, if the workflow run is marked as required, -# PRs introducing known-vulnerable packages will be blocked from merging. -# -# Source repository: https://github.com/actions/dependency-review-action -name: 'Dependency Review' -on: [pull_request] - -permissions: - contents: read - -jobs: - dependency-review: - runs-on: ubuntu-latest - steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit - - - name: 'Checkout Repository' - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - - name: 'Dependency Review' - uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1 diff --git a/.github/workflows/deploy_docker-image.yml b/.github/workflows/deploy_docker-image.yml index 1e602bce60..30e7badcd0 100644 --- a/.github/workflows/deploy_docker-image.yml +++ b/.github/workflows/deploy_docker-image.yml @@ -19,19 +19,19 @@ jobs: egress-policy: audit - name: checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@v3.6.0 with: path: backstage ref: v${{ github.event.client_payload.version }} - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/yarn-install@v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -45,17 +45,17 @@ jobs: working-directory: ./example-app - name: Login to GitHub Container Registry - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 + uses: docker/login-action@v2.2.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0 + uses: docker/setup-buildx-action@v2.10.0 - name: Build and push - uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 + uses: docker/build-push-action@v4.2.1 with: context: './example-app' file: ./example-app/packages/backend/Dockerfile diff --git a/.github/workflows/deploy_microsite.yml b/.github/workflows/deploy_microsite.yml index 75976456c0..f614db31ca 100644 --- a/.github/workflows/deploy_microsite.yml +++ b/.github/workflows/deploy_microsite.yml @@ -10,7 +10,7 @@ permissions: jobs: deploy-microsite-and-storybook: permissions: - contents: write # for JamesIves/github-pages-deploy-action to push changes in repo + contents: write # for JamesIves/github-pages-deploy-action to push changes in repo runs-on: ubuntu-latest env: @@ -28,10 +28,10 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 - name: use node.js 18.x - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: 18.x registry-url: https://registry.npmjs.org/ # Needed for auth diff --git a/.github/workflows/deploy_packages.yml b/.github/workflows/deploy_packages.yml index b420ebf690..a8a4315191 100644 --- a/.github/workflows/deploy_packages.yml +++ b/.github/workflows/deploy_packages.yml @@ -65,15 +65,15 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/yarn-install@v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -147,15 +147,15 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/yarn-install@v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} diff --git a/.github/workflows/issue.yaml b/.github/workflows/issue.yaml index b456c1dae4..1c1c028f20 100644 --- a/.github/workflows/issue.yaml +++ b/.github/workflows/issue.yaml @@ -15,4 +15,4 @@ jobs: egress-policy: audit - name: Issue sync - uses: backstage/actions/issue-sync@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/issue-sync@v0.6.4 diff --git a/.github/workflows/pr-review-comment-trigger.yaml b/.github/workflows/pr-review-comment-trigger.yaml index 7ae7122154..784dc6cf79 100644 --- a/.github/workflows/pr-review-comment-trigger.yaml +++ b/.github/workflows/pr-review-comment-trigger.yaml @@ -30,7 +30,7 @@ jobs: run: | mkdir -p ./pr echo $PR_NUMBER > ./pr/pr_number - - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 + - uses: actions/upload-artifact@v3.1.3 with: name: pr_number-${{ github.event.pull_request.number }} path: pr/ diff --git a/.github/workflows/pr-review-comment.yaml b/.github/workflows/pr-review-comment.yaml index 1f26643bab..e557c85d51 100644 --- a/.github/workflows/pr-review-comment.yaml +++ b/.github/workflows/pr-review-comment.yaml @@ -23,7 +23,7 @@ jobs: - name: Read PR Number id: pr-number - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 + uses: actions/github-script@v6.4.1 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | @@ -40,7 +40,7 @@ jobs: const prNumber = artifact.name.slice('pr_number-'.length) core.setOutput('pr-number', prNumber); - - uses: backstage/actions/re-review@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + - uses: backstage/actions/re-review@v0.6.4 with: app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }} private-key: ${{ secrets.BACKSTAGE_GOALIE_PRIVATE_KEY }} diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 4993e93dbb..8c99f105a9 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -23,7 +23,7 @@ jobs: egress-policy: audit - name: PR sync - uses: backstage/actions/pr-sync@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/pr-sync@v0.6.4 with: github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }} app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f245240c99..3a1e2b1501 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -34,7 +34,7 @@ jobs: egress-policy: audit - name: 'Checkout code' - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@v3.6.0 with: persist-credentials: false @@ -58,7 +58,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: 'Upload artifact' - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 + uses: actions/upload-artifact@v3.1.3 with: name: SARIF file path: results.sarif diff --git a/.github/workflows/sync_code-formatting.yml b/.github/workflows/sync_code-formatting.yml index f3afec592d..fa8d91f25a 100644 --- a/.github/workflows/sync_code-formatting.yml +++ b/.github/workflows/sync_code-formatting.yml @@ -20,12 +20,12 @@ jobs: fetch-depth: 0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/yarn-install@v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} diff --git a/.github/workflows/sync_dependabot-changesets.yml b/.github/workflows/sync_dependabot-changesets.yml index 0c732f28d1..2ac6d7f0d0 100644 --- a/.github/workflows/sync_dependabot-changesets.yml +++ b/.github/workflows/sync_dependabot-changesets.yml @@ -16,7 +16,7 @@ jobs: egress-policy: audit - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@v3.6.0 with: fetch-depth: 2 ref: ${{ github.head_ref }} @@ -26,7 +26,7 @@ jobs: git config --global user.email noreply@backstage.io git config --global user.name 'Github changeset workflow' - name: Generate changeset - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 + uses: actions/github-script@v6.4.1 with: script: | const { promises: fs } = require('fs'); diff --git a/.github/workflows/sync_release-manifest.yml b/.github/workflows/sync_release-manifest.yml index dcb13d58c5..a3f6bc232f 100644 --- a/.github/workflows/sync_release-manifest.yml +++ b/.github/workflows/sync_release-manifest.yml @@ -13,7 +13,7 @@ jobs: with: egress-policy: audit - - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + - uses: actions/setup-node@v3.8.1 with: node-version: 18.x - name: Install dependencies @@ -21,7 +21,7 @@ jobs: run: npm install semver@7.3.5 fs-extra@10.0.0 @manypkg/get-packages@1.1.1 - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@v3.6.0 with: path: backstage # 'v' prefix is added here for the tag, we keep it out of the manifest logic @@ -29,7 +29,7 @@ jobs: # Checkout backstage/versions into /backstage/versions, which is where store the output - name: Checkout versions - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@v3.6.0 with: repository: backstage/versions path: backstage/versions @@ -53,7 +53,7 @@ jobs: git push - name: Dispatch update-helper update - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 + uses: actions/github-script@v6.4.1 with: github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }} # TODO(Rugvip): Remove the create-app dispatch once we've been on the release version for a while diff --git a/.github/workflows/sync_renovate-changesets.yml b/.github/workflows/sync_renovate-changesets.yml index f29fdaa6b7..738abcf773 100644 --- a/.github/workflows/sync_renovate-changesets.yml +++ b/.github/workflows/sync_renovate-changesets.yml @@ -16,7 +16,7 @@ jobs: egress-policy: audit - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@v3.6.0 with: fetch-depth: 2 ref: ${{ github.head_ref }} @@ -26,7 +26,7 @@ jobs: git config --global user.email noreply@backstage.io git config --global user.name 'Github changeset workflow' - name: Generate changeset - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 + uses: actions/github-script@v6.4.1 with: script: | const { promises: fs } = require("fs"); diff --git a/.github/workflows/sync_snyk-github-issues.yml b/.github/workflows/sync_snyk-github-issues.yml index 5b8c56da43..690e2fb76e 100644 --- a/.github/workflows/sync_snyk-github-issues.yml +++ b/.github/workflows/sync_snyk-github-issues.yml @@ -16,15 +16,15 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 - name: use node.js 18.x - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: 18.x registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/yarn-install@v0.6.4 with: cache-prefix: ${{ runner.os }}-v18.x diff --git a/.github/workflows/sync_snyk-monitor.yml b/.github/workflows/sync_snyk-monitor.yml index dbeccb52fc..c74c303076 100644 --- a/.github/workflows/sync_snyk-monitor.yml +++ b/.github/workflows/sync_snyk-monitor.yml @@ -20,8 +20,8 @@ permissions: jobs: sync: permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results runs-on: ubuntu-latest steps: - name: Harden Runner @@ -29,7 +29,7 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@ v3.6.0 - name: Monitor and Synchronize Snyk Policies uses: snyk/actions/node@299cde98a08ff8b1c2bfde1e5a067bce67a6d2b8 # master with: @@ -58,6 +58,6 @@ jobs: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} NODE_OPTIONS: --max-old-space-size=7168 - name: Upload Snyk report - uses: github/codeql-action/upload-sarif@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 + uses: github/codeql-action/upload-sarif@v2.21.8 with: sarif_file: snyk.sarif diff --git a/.github/workflows/sync_version-packages.yml b/.github/workflows/sync_version-packages.yml index a77050318b..929fb9cc89 100644 --- a/.github/workflows/sync_version-packages.yml +++ b/.github/workflows/sync_version-packages.yml @@ -18,7 +18,7 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 with: fetch-depth: 20000 fetch-tags: true @@ -26,7 +26,7 @@ jobs: - name: Install Dependencies run: yarn --immutable - name: Create Release Pull Request - uses: backstage/changesets-action@99063c276a7f12e024cb310e7a05a3a5b89449f8 # v2.1.0 + uses: backstage/changesets-action@v2.1.0 with: # Calls out to `changeset version`, but also runs prettier version: yarn release diff --git a/.github/workflows/uffizzi-build.yml b/.github/workflows/uffizzi-build.yml index b2d3667f4d..a58eba7055 100644 --- a/.github/workflows/uffizzi-build.yml +++ b/.github/workflows/uffizzi-build.yml @@ -25,16 +25,16 @@ jobs: egress-policy: audit - name: checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@v3.6.0 - name: setup-node - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: 18.x registry-url: https://registry.npmjs.org/ - name: yarn install - uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/yarn-install@v0.6.4 with: cache-prefix: linux-v18 @@ -87,7 +87,7 @@ jobs: egress-policy: audit - name: Checkout git repo - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@v3.6.0 - name: Render Compose File run: | BACKSTAGE_IMAGE=$(echo ${{ needs.build-backstage.outputs.tags }}) @@ -96,13 +96,13 @@ jobs: envsubst '$BACKSTAGE_IMAGE $GITHUB_SHA' < .github/uffizzi/docker-compose.uffizzi.yml > docker-compose.rendered.yml cat docker-compose.rendered.yml - name: Upload Rendered Compose File as Artifact - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 + uses: actions/upload-artifact@v3.1.3 with: name: preview-spec path: docker-compose.rendered.yml retention-days: 2 - name: Upload PR Event as Artifact - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 + uses: actions/upload-artifact@v3.1.3 with: name: preview-spec path: ${{ github.event_path }} @@ -120,7 +120,7 @@ jobs: egress-policy: audit - name: Upload PR Event as Artifact - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 + uses: actions/upload-artifact@v3.1.3 with: name: preview-spec path: ${{ github.event_path }} diff --git a/.github/workflows/uffizzi-preview.yaml b/.github/workflows/uffizzi-preview.yaml index bf43bbdb4c..deebf356bf 100644 --- a/.github/workflows/uffizzi-preview.yaml +++ b/.github/workflows/uffizzi-preview.yaml @@ -24,7 +24,7 @@ jobs: - name: 'Download artifacts' # Fetch output (zip archive) from the workflow run that triggered this workflow. - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 + uses: actions/github-script@v6.4.1 with: script: | let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({ @@ -64,7 +64,7 @@ jobs: - name: Cache Rendered Compose File if: ${{ fromJSON(env.EVENT_JSON).action != 'closed' }} - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2 + uses: actions/cache@v3.3.2 with: path: docker-compose.rendered.yml key: ${{ env.COMPOSE_FILE_HASH }} diff --git a/.github/workflows/verify_accessibility.yml b/.github/workflows/verify_accessibility.yml index 7d8753b3bd..d53f3834d2 100644 --- a/.github/workflows/verify_accessibility.yml +++ b/.github/workflows/verify_accessibility.yml @@ -24,13 +24,13 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 - name: Use Node.js 18.x - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: 18.x - name: yarn install - uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/yarn-install@v0.6.4 with: cache-prefix: ${{ runner.os }}-v18.x - name: run Lighthouse CI diff --git a/.github/workflows/verify_codeql.yml b/.github/workflows/verify_codeql.yml index 8ea2e8fcd8..666bd5f0f4 100644 --- a/.github/workflows/verify_codeql.yml +++ b/.github/workflows/verify_codeql.yml @@ -25,9 +25,9 @@ permissions: jobs: analyze: permissions: - actions: read # for github/codeql-action/init to get workflow details - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/autobuild to send a status report + actions: read # for github/codeql-action/init to get workflow details + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/autobuild to send a status report name: Analyze runs-on: ubuntu-latest @@ -47,7 +47,7 @@ jobs: egress-policy: audit - name: Checkout repository - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@v3.6.0 with: # We must fetch at least the immediate parents so that if this is # a pull request then we can checkout the head. @@ -55,7 +55,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 + uses: github/codeql-action/init@v2.21.8 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -66,7 +66,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 + uses: github/codeql-action/autobuild@v2.21.8 # ℹ️ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -80,4 +80,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 + uses: github/codeql-action/analyze@v2.21.8 diff --git a/.github/workflows/verify_docs-quality.yml b/.github/workflows/verify_docs-quality.yml index 1760b2a186..ce457a234f 100644 --- a/.github/workflows/verify_docs-quality.yml +++ b/.github/workflows/verify_docs-quality.yml @@ -16,7 +16,7 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 # Vale does not support file excludes, so we use the script to generate a list of files instead # The action also does not allow args or a local config file to be passed in, so the files array diff --git a/.github/workflows/verify_e2e-kubernetes.yml b/.github/workflows/verify_e2e-kubernetes.yml index 237ce4977b..cddd6589d7 100644 --- a/.github/workflows/verify_e2e-kubernetes.yml +++ b/.github/workflows/verify_e2e-kubernetes.yml @@ -26,16 +26,16 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/yarn-install@v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} diff --git a/.github/workflows/verify_e2e-linux.yml b/.github/workflows/verify_e2e-linux.yml index 9c684b9ea3..744a5d7e74 100644 --- a/.github/workflows/verify_e2e-linux.yml +++ b/.github/workflows/verify_e2e-linux.yml @@ -44,7 +44,7 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 - name: Configure Git run: | @@ -52,12 +52,12 @@ jobs: git config --global user.name 'GitHub e2e user' - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/yarn-install@v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} diff --git a/.github/workflows/verify_e2e-techdocs.yml b/.github/workflows/verify_e2e-techdocs.yml index a7116d9bf8..94f08a491f 100644 --- a/.github/workflows/verify_e2e-techdocs.yml +++ b/.github/workflows/verify_e2e-techdocs.yml @@ -34,8 +34,8 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 + - uses: actions/checkout@v3.6.0 + - uses: actions/setup-python@v4.7.0 with: python-version: '3.9' diff --git a/.github/workflows/verify_e2e-windows.yml b/.github/workflows/verify_e2e-windows.yml index 016ea04b95..3ecb33a2da 100644 --- a/.github/workflows/verify_e2e-windows.yml +++ b/.github/workflows/verify_e2e-windows.yml @@ -42,7 +42,7 @@ jobs: git config --global core.autocrlf false git config --global core.eol lf - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 - name: Configure Git run: | @@ -50,18 +50,18 @@ jobs: git config --global user.name 'GitHub e2e user' - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: setup python - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 + uses: actions/setup-python@v4.7.0 with: python-version: '3.10' - name: Add msbuild to PATH - uses: microsoft/setup-msbuild@1ff57057b5cfdc39105cd07a01d78e9b0ea0c14c # v1.3.1 + uses: microsoft/setup-msbuild@v1.3.1 - name: Setup gyp env run: | diff --git a/.github/workflows/verify_fossa.yml b/.github/workflows/verify_fossa.yml index 5174845467..393bcf9631 100644 --- a/.github/workflows/verify_fossa.yml +++ b/.github/workflows/verify_fossa.yml @@ -19,7 +19,7 @@ jobs: egress-policy: audit - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@v3.6.0 - name: Install Fossa run: "curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | bash" diff --git a/.github/workflows/verify_microsite.yml b/.github/workflows/verify_microsite.yml index e14799f378..f0705bedc7 100644 --- a/.github/workflows/verify_microsite.yml +++ b/.github/workflows/verify_microsite.yml @@ -28,10 +28,10 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 - name: use node.js 18.x - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: 18.x diff --git a/.github/workflows/verify_storybook.yml b/.github/workflows/verify_storybook.yml index 3d1bcbf34e..f0354df296 100644 --- a/.github/workflows/verify_storybook.yml +++ b/.github/workflows/verify_storybook.yml @@ -32,17 +32,17 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 with: fetch-depth: 0 # Required to retrieve git history - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 + uses: backstage/actions/yarn-install@v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} - name: storybook yarn install diff --git a/.github/workflows/verify_windows.yml b/.github/workflows/verify_windows.yml index 309c2be7ab..f2c61938d8 100644 --- a/.github/workflows/verify_windows.yml +++ b/.github/workflows/verify_windows.yml @@ -33,10 +33,10 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 + uses: actions/setup-node@v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml deleted file mode 100644 index 723e338d33..0000000000 --- a/.pre-commit-config.yaml +++ /dev/null @@ -1,18 +0,0 @@ -repos: -- repo: https://github.com/gitleaks/gitleaks - rev: v8.16.3 - hooks: - - id: gitleaks -- repo: https://github.com/jumanjihouse/pre-commit-hooks - rev: 3.0.0 - hooks: - - id: shellcheck -- repo: https://github.com/pre-commit/mirrors-eslint - rev: v8.38.0 - hooks: - - id: eslint -- repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.4.0 - hooks: - - id: end-of-file-fixer - - id: trailing-whitespace From 2c92c6ef4093133cb20c07fdb65f102b0a368751 Mon Sep 17 00:00:00 2001 From: NishkarshRaj Date: Fri, 29 Sep 2023 02:05:27 +0530 Subject: [PATCH 3/5] Harden Runner just fails for 1 workflow: Verify Windows Signed-off-by: NishkarshRaj --- .github/workflows/verify_windows.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/verify_windows.yml b/.github/workflows/verify_windows.yml index f2c61938d8..d220df5406 100644 --- a/.github/workflows/verify_windows.yml +++ b/.github/workflows/verify_windows.yml @@ -28,11 +28,6 @@ jobs: INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit - - uses: actions/checkout@v3.6.0 - name: use node.js ${{ matrix.node-version }} From b4d24e9d2e090bbdc1ad7ec4daeeb8c5ab47da2b Mon Sep 17 00:00:00 2001 From: NishkarshRaj Date: Fri, 29 Sep 2023 02:27:25 +0530 Subject: [PATCH 4/5] Disable Harden Runners to validate if they are culprit for broken workflows Signed-off-by: NishkarshRaj --- .github/workflows/automate_area-labels.yml | 8 +++---- .../workflows/automate_changeset_feedback.yml | 8 +++---- .github/workflows/automate_merge_message.yml | 8 +++---- .github/workflows/automate_stale.yml | 8 +++---- .github/workflows/ci-noop.yml | 16 ++++++------- .github/workflows/ci.yml | 24 +++++++++---------- .github/workflows/cron.yml | 8 +++---- .github/workflows/deploy_docker-image.yml | 8 +++---- .github/workflows/deploy_microsite.yml | 8 +++---- .github/workflows/deploy_nightly.yml | 8 +++---- .github/workflows/deploy_packages.yml | 16 ++++++------- .github/workflows/issue.yaml | 8 +++---- .../workflows/pr-review-comment-trigger.yaml | 8 +++---- .github/workflows/pr-review-comment.yaml | 8 +++---- .github/workflows/pr.yaml | 8 +++---- .github/workflows/scorecard.yml | 8 +++---- .github/workflows/sync_code-formatting.yml | 8 +++---- .../workflows/sync_dependabot-changesets.yml | 8 +++---- .github/workflows/sync_release-manifest.yml | 8 +++---- .../workflows/sync_renovate-changesets.yml | 8 +++---- .github/workflows/sync_snyk-github-issues.yml | 8 +++---- .github/workflows/sync_snyk-monitor.yml | 10 ++++---- .github/workflows/uffizzi-build.yml | 24 +++++++++---------- .github/workflows/uffizzi-preview.yaml | 8 +++---- .../workflows/verify_accessibility-noop.yml | 8 +++---- .github/workflows/verify_accessibility.yml | 8 +++---- .github/workflows/verify_codeql.yml | 8 +++---- .github/workflows/verify_docs-quality.yml | 8 +++---- .../workflows/verify_e2e-kubernetes-noop.yml | 8 +++---- .github/workflows/verify_e2e-kubernetes.yml | 8 +++---- .github/workflows/verify_e2e-linux-noop.yml | 8 +++---- .github/workflows/verify_e2e-linux.yml | 8 +++---- .github/workflows/verify_e2e-techdocs.yml | 8 +++---- .github/workflows/verify_e2e-windows-noop.yml | 8 +++---- .github/workflows/verify_e2e-windows.yml | 8 +++---- .github/workflows/verify_fossa.yml | 8 +++---- .github/workflows/verify_microsite-noop.yml | 8 +++---- .github/workflows/verify_microsite.yml | 8 +++---- .github/workflows/verify_storybook-noop.yml | 8 +++---- .github/workflows/verify_storybook.yml | 8 +++---- .github/workflows/verify_windows.yml | 5 ++++ 41 files changed, 190 insertions(+), 185 deletions(-) diff --git a/.github/workflows/automate_area-labels.yml b/.github/workflows/automate_area-labels.yml index dfb60c9243..47b3dfe42b 100644 --- a/.github/workflows/automate_area-labels.yml +++ b/.github/workflows/automate_area-labels.yml @@ -12,10 +12,10 @@ jobs: pull-requests: write # for actions/labeler to add labels to PRs runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/labeler@v4.3.0 with: diff --git a/.github/workflows/automate_changeset_feedback.yml b/.github/workflows/automate_changeset_feedback.yml index 483d59dc8c..8dab48c2a3 100644 --- a/.github/workflows/automate_changeset_feedback.yml +++ b/.github/workflows/automate_changeset_feedback.yml @@ -22,10 +22,10 @@ jobs: if: github.repository == 'backstage/backstage' && github.event.pull_request.user.login != 'backstage-service' runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 with: diff --git a/.github/workflows/automate_merge_message.yml b/.github/workflows/automate_merge_message.yml index 4cbf6c69a2..f5b26b5db3 100644 --- a/.github/workflows/automate_merge_message.yml +++ b/.github/workflows/automate_merge_message.yml @@ -23,10 +23,10 @@ jobs: if: github.repository == 'backstage/backstage' && github.event.pull_request.merged == true runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 with: diff --git a/.github/workflows/automate_stale.yml b/.github/workflows/automate_stale.yml index 40ebdf8a3e..6cca838722 100644 --- a/.github/workflows/automate_stale.yml +++ b/.github/workflows/automate_stale.yml @@ -14,10 +14,10 @@ jobs: pull-requests: write # for actions/stale to close stale PRs runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/stale@v7.0.0 id: stale diff --git a/.github/workflows/ci-noop.yml b/.github/workflows/ci-noop.yml index bafe59e83a..d04770ea15 100644 --- a/.github/workflows/ci-noop.yml +++ b/.github/workflows/ci-noop.yml @@ -22,10 +22,10 @@ jobs: name: Verify ${{ matrix.node-version }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - run: echo NOOP @@ -38,9 +38,9 @@ jobs: name: Test ${{ matrix.node-version }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b08a28d786..f63a34c8a1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,10 +26,10 @@ jobs: name: Install ${{ matrix.node-version }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 @@ -62,10 +62,10 @@ jobs: name: Verify ${{ matrix.node-version }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 @@ -196,10 +196,10 @@ jobs: INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 - name: fetch branch master diff --git a/.github/workflows/cron.yml b/.github/workflows/cron.yml index 2874be512c..28cd7cc26e 100644 --- a/.github/workflows/cron.yml +++ b/.github/workflows/cron.yml @@ -8,10 +8,10 @@ jobs: cron: runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: backstage/actions/cron@v0.6.4 with: diff --git a/.github/workflows/deploy_docker-image.yml b/.github/workflows/deploy_docker-image.yml index 30e7badcd0..34d18465ed 100644 --- a/.github/workflows/deploy_docker-image.yml +++ b/.github/workflows/deploy_docker-image.yml @@ -13,10 +13,10 @@ jobs: node-version: [18.x] steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: checkout uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/deploy_microsite.yml b/.github/workflows/deploy_microsite.yml index f614db31ca..cf11cff115 100644 --- a/.github/workflows/deploy_microsite.yml +++ b/.github/workflows/deploy_microsite.yml @@ -23,10 +23,10 @@ jobs: cancel-in-progress: true steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/deploy_nightly.yml b/.github/workflows/deploy_nightly.yml index d5fe9f5a64..89dc085b61 100644 --- a/.github/workflows/deploy_nightly.yml +++ b/.github/workflows/deploy_nightly.yml @@ -14,10 +14,10 @@ jobs: NODE_OPTIONS: --max-old-space-size=4096 steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 diff --git a/.github/workflows/deploy_packages.yml b/.github/workflows/deploy_packages.yml index a8a4315191..7abe55594c 100644 --- a/.github/workflows/deploy_packages.yml +++ b/.github/workflows/deploy_packages.yml @@ -60,10 +60,10 @@ jobs: INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 @@ -142,10 +142,10 @@ jobs: NODE_OPTIONS: --max-old-space-size=4096 steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/issue.yaml b/.github/workflows/issue.yaml index 1c1c028f20..72873cd358 100644 --- a/.github/workflows/issue.yaml +++ b/.github/workflows/issue.yaml @@ -9,10 +9,10 @@ jobs: if: github.repository == 'backstage/backstage' steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: Issue sync uses: backstage/actions/issue-sync@v0.6.4 diff --git a/.github/workflows/pr-review-comment-trigger.yaml b/.github/workflows/pr-review-comment-trigger.yaml index 784dc6cf79..f106dd819a 100644 --- a/.github/workflows/pr-review-comment-trigger.yaml +++ b/.github/workflows/pr-review-comment-trigger.yaml @@ -19,10 +19,10 @@ jobs: if: github.repository == 'backstage/backstage' && github.event.comment.user.id == github.event.pull_request.user.id steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: Save PR number env: diff --git a/.github/workflows/pr-review-comment.yaml b/.github/workflows/pr-review-comment.yaml index e557c85d51..ade9e51ab5 100644 --- a/.github/workflows/pr-review-comment.yaml +++ b/.github/workflows/pr-review-comment.yaml @@ -16,10 +16,10 @@ jobs: steps: # Inspired by https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: Read PR Number id: pr-number diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 8c99f105a9..ddf5d57d4d 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -17,10 +17,10 @@ jobs: # Avoid running on issue comments if: github.repository == 'backstage/backstage' && ( github.event.pull_request || github.event.issue.pull_request ) steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: PR sync uses: backstage/actions/pr-sync@v0.6.4 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 3a1e2b1501..d052eb2db4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -28,10 +28,10 @@ jobs: id-token: write steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: 'Checkout code' uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/sync_code-formatting.yml b/.github/workflows/sync_code-formatting.yml index fa8d91f25a..b7c41dbcc0 100644 --- a/.github/workflows/sync_code-formatting.yml +++ b/.github/workflows/sync_code-formatting.yml @@ -9,10 +9,10 @@ jobs: name: Autofix Markdown files using Prettier runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: diff --git a/.github/workflows/sync_dependabot-changesets.yml b/.github/workflows/sync_dependabot-changesets.yml index 2ac6d7f0d0..52a91afedf 100644 --- a/.github/workflows/sync_dependabot-changesets.yml +++ b/.github/workflows/sync_dependabot-changesets.yml @@ -10,10 +10,10 @@ jobs: runs-on: ubuntu-latest if: github.actor == 'dependabot[bot]' && github.repository == 'backstage/backstage' steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: Checkout uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/sync_release-manifest.yml b/.github/workflows/sync_release-manifest.yml index a3f6bc232f..906f234afa 100644 --- a/.github/workflows/sync_release-manifest.yml +++ b/.github/workflows/sync_release-manifest.yml @@ -8,10 +8,10 @@ jobs: runs-on: ubuntu-latest steps: # Setup node & install deps before checkout, keeping install quick - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/setup-node@v3.8.1 with: diff --git a/.github/workflows/sync_renovate-changesets.yml b/.github/workflows/sync_renovate-changesets.yml index 738abcf773..afbbaa4fa2 100644 --- a/.github/workflows/sync_renovate-changesets.yml +++ b/.github/workflows/sync_renovate-changesets.yml @@ -10,10 +10,10 @@ jobs: runs-on: ubuntu-latest if: github.actor == 'renovate[bot]' && github.repository == 'backstage/backstage' steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: Checkout uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/sync_snyk-github-issues.yml b/.github/workflows/sync_snyk-github-issues.yml index 690e2fb76e..25e3b659a4 100644 --- a/.github/workflows/sync_snyk-github-issues.yml +++ b/.github/workflows/sync_snyk-github-issues.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/sync_snyk-monitor.yml b/.github/workflows/sync_snyk-monitor.yml index c74c303076..a902e108eb 100644 --- a/.github/workflows/sync_snyk-monitor.yml +++ b/.github/workflows/sync_snyk-monitor.yml @@ -24,12 +24,12 @@ jobs: security-events: write # for github/codeql-action/upload-sarif to upload SARIF results runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - - uses: actions/checkout@ v3.6.0 + - uses: actions/checkout@v3.6.0 - name: Monitor and Synchronize Snyk Policies uses: snyk/actions/node@299cde98a08ff8b1c2bfde1e5a067bce67a6d2b8 # master with: diff --git a/.github/workflows/uffizzi-build.yml b/.github/workflows/uffizzi-build.yml index a58eba7055..3930d87687 100644 --- a/.github/workflows/uffizzi-build.yml +++ b/.github/workflows/uffizzi-build.yml @@ -19,10 +19,10 @@ jobs: outputs: tags: ${{ steps.meta.outputs.tags }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: checkout uses: actions/checkout@v3.6.0 @@ -81,10 +81,10 @@ jobs: outputs: compose-file-cache-key: ${{ steps.hash.outputs.hash }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: Checkout git repo uses: actions/checkout@v3.6.0 @@ -114,10 +114,10 @@ jobs: if: ${{ github.event.action == 'closed' }} steps: # If this PR is closing, we will not render a compose file nor pass it to the next workflow. - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: Upload PR Event as Artifact uses: actions/upload-artifact@v3.1.3 diff --git a/.github/workflows/uffizzi-preview.yaml b/.github/workflows/uffizzi-preview.yaml index deebf356bf..82f8b8b859 100644 --- a/.github/workflows/uffizzi-preview.yaml +++ b/.github/workflows/uffizzi-preview.yaml @@ -17,10 +17,10 @@ jobs: git-ref: ${{ env.GIT_REF }} pr-number: ${{ env.PR_NUMBER }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: 'Download artifacts' # Fetch output (zip archive) from the workflow run that triggered this workflow. diff --git a/.github/workflows/verify_accessibility-noop.yml b/.github/workflows/verify_accessibility-noop.yml index e2b1860b28..5a7228e408 100644 --- a/.github/workflows/verify_accessibility-noop.yml +++ b/.github/workflows/verify_accessibility-noop.yml @@ -25,9 +25,9 @@ jobs: name: Accessibility runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/verify_accessibility.yml b/.github/workflows/verify_accessibility.yml index d53f3834d2..5e4ac62943 100644 --- a/.github/workflows/verify_accessibility.yml +++ b/.github/workflows/verify_accessibility.yml @@ -19,10 +19,10 @@ jobs: name: Accessibility runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 - name: Use Node.js 18.x diff --git a/.github/workflows/verify_codeql.yml b/.github/workflows/verify_codeql.yml index 666bd5f0f4..6523937c8d 100644 --- a/.github/workflows/verify_codeql.yml +++ b/.github/workflows/verify_codeql.yml @@ -41,10 +41,10 @@ jobs: # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: Checkout repository uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/verify_docs-quality.yml b/.github/workflows/verify_docs-quality.yml index ce457a234f..35e9fb1c85 100644 --- a/.github/workflows/verify_docs-quality.yml +++ b/.github/workflows/verify_docs-quality.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/verify_e2e-kubernetes-noop.yml b/.github/workflows/verify_e2e-kubernetes-noop.yml index 5c52968820..6038e7194a 100644 --- a/.github/workflows/verify_e2e-kubernetes-noop.yml +++ b/.github/workflows/verify_e2e-kubernetes-noop.yml @@ -22,9 +22,9 @@ jobs: name: Kubernetes ${{ matrix.node-version }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/verify_e2e-kubernetes.yml b/.github/workflows/verify_e2e-kubernetes.yml index cddd6589d7..e602e6b0d9 100644 --- a/.github/workflows/verify_e2e-kubernetes.yml +++ b/.github/workflows/verify_e2e-kubernetes.yml @@ -21,10 +21,10 @@ jobs: name: Kubernetes ${{ matrix.node-version }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/verify_e2e-linux-noop.yml b/.github/workflows/verify_e2e-linux-noop.yml index 27e08c7055..deb21168dc 100644 --- a/.github/workflows/verify_e2e-linux-noop.yml +++ b/.github/workflows/verify_e2e-linux-noop.yml @@ -27,9 +27,9 @@ jobs: name: E2E Linux ${{ matrix.node-version }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/verify_e2e-linux.yml b/.github/workflows/verify_e2e-linux.yml index 744a5d7e74..53cfa7be50 100644 --- a/.github/workflows/verify_e2e-linux.yml +++ b/.github/workflows/verify_e2e-linux.yml @@ -39,10 +39,10 @@ jobs: name: E2E Linux ${{ matrix.node-version }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/verify_e2e-techdocs.yml b/.github/workflows/verify_e2e-techdocs.yml index 94f08a491f..e1368bbce5 100644 --- a/.github/workflows/verify_e2e-techdocs.yml +++ b/.github/workflows/verify_e2e-techdocs.yml @@ -29,10 +29,10 @@ jobs: name: Techdocs steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 - uses: actions/setup-python@v4.7.0 diff --git a/.github/workflows/verify_e2e-windows-noop.yml b/.github/workflows/verify_e2e-windows-noop.yml index e4b8556f58..74971df3a6 100644 --- a/.github/workflows/verify_e2e-windows-noop.yml +++ b/.github/workflows/verify_e2e-windows-noop.yml @@ -24,9 +24,9 @@ jobs: name: E2E Windows ${{ matrix.node-version }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/verify_e2e-windows.yml b/.github/workflows/verify_e2e-windows.yml index 3ecb33a2da..368c4ad645 100644 --- a/.github/workflows/verify_e2e-windows.yml +++ b/.github/workflows/verify_e2e-windows.yml @@ -32,10 +32,10 @@ jobs: steps: # In order to have the create-app template function as if it was downloaded from NPM # we need to make sure we checkout files with LF line endings only - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: Set git to use LF run: | diff --git a/.github/workflows/verify_fossa.yml b/.github/workflows/verify_fossa.yml index 393bcf9631..82c0d71aa6 100644 --- a/.github/workflows/verify_fossa.yml +++ b/.github/workflows/verify_fossa.yml @@ -13,10 +13,10 @@ jobs: runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - name: Checkout uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/verify_microsite-noop.yml b/.github/workflows/verify_microsite-noop.yml index 8c329a0f27..9597ef3f8b 100644 --- a/.github/workflows/verify_microsite-noop.yml +++ b/.github/workflows/verify_microsite-noop.yml @@ -20,9 +20,9 @@ jobs: name: Microsite steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/verify_microsite.yml b/.github/workflows/verify_microsite.yml index f0705bedc7..d5867f69ee 100644 --- a/.github/workflows/verify_microsite.yml +++ b/.github/workflows/verify_microsite.yml @@ -23,10 +23,10 @@ jobs: name: Microsite steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/verify_storybook-noop.yml b/.github/workflows/verify_storybook-noop.yml index aee4623d5a..97fe6171c1 100644 --- a/.github/workflows/verify_storybook-noop.yml +++ b/.github/workflows/verify_storybook-noop.yml @@ -27,9 +27,9 @@ jobs: name: Storybook steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/verify_storybook.yml b/.github/workflows/verify_storybook.yml index f0354df296..dfe6856c38 100644 --- a/.github/workflows/verify_storybook.yml +++ b/.github/workflows/verify_storybook.yml @@ -27,10 +27,10 @@ jobs: name: Storybook steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit - uses: actions/checkout@v3.6.0 with: diff --git a/.github/workflows/verify_windows.yml b/.github/workflows/verify_windows.yml index d220df5406..153d8d76a5 100644 --- a/.github/workflows/verify_windows.yml +++ b/.github/workflows/verify_windows.yml @@ -28,6 +28,11 @@ jobs: INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }} steps: + # - name: Harden Runner + # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + # with: + # egress-policy: audit + - uses: actions/checkout@v3.6.0 - name: use node.js ${{ matrix.node-version }} From 595ed3b48e7a2f67aca4e967463cba15da7242a5 Mon Sep 17 00:00:00 2001 From: NishkarshRaj Date: Mon, 9 Oct 2023 15:48:02 +0530 Subject: [PATCH 5/5] PR Ready for Review Signed-off-by: NishkarshRaj --- .github/workflows/automate_area-labels.yml | 8 +++--- .../workflows/automate_changeset_feedback.yml | 8 +++--- .github/workflows/automate_merge_message.yml | 8 +++--- .github/workflows/automate_stale.yml | 8 +++--- .github/workflows/ci-noop.yml | 8 +++--- .github/workflows/ci.yml | 24 ++++++++--------- .github/workflows/cron.yml | 8 +++--- .github/workflows/deploy_docker-image.yml | 8 +++--- .github/workflows/deploy_microsite.yml | 8 +++--- .github/workflows/deploy_nightly.yml | 8 +++--- .github/workflows/deploy_packages.yml | 16 ++++++------ .github/workflows/issue.yaml | 8 +++--- .../workflows/pr-review-comment-trigger.yaml | 8 +++--- .github/workflows/pr-review-comment.yaml | 8 +++--- .github/workflows/pr.yaml | 8 +++--- .github/workflows/scorecard.yml | 8 +++--- .github/workflows/sync_code-formatting.yml | 8 +++--- .../workflows/sync_dependabot-changesets.yml | 8 +++--- .github/workflows/sync_release-manifest.yml | 10 +++---- .../workflows/sync_renovate-changesets.yml | 8 +++--- .github/workflows/sync_snyk-github-issues.yml | 8 +++--- .github/workflows/sync_snyk-monitor.yml | 8 +++--- .github/workflows/uffizzi-build.yml | 26 +++++++++---------- .github/workflows/uffizzi-preview.yaml | 8 +++--- .../workflows/verify_accessibility-noop.yml | 8 +++--- .github/workflows/verify_accessibility.yml | 8 +++--- .github/workflows/verify_codeql.yml | 8 +++--- .github/workflows/verify_docs-quality.yml | 8 +++--- .../workflows/verify_e2e-kubernetes-noop.yml | 8 +++--- .github/workflows/verify_e2e-kubernetes.yml | 8 +++--- .github/workflows/verify_e2e-linux-noop.yml | 8 +++--- .github/workflows/verify_e2e-linux.yml | 8 +++--- .github/workflows/verify_e2e-techdocs.yml | 8 +++--- .github/workflows/verify_e2e-windows-noop.yml | 8 +++--- .github/workflows/verify_e2e-windows.yml | 10 +++---- .github/workflows/verify_fossa.yml | 8 +++--- .github/workflows/verify_microsite-noop.yml | 8 +++--- .github/workflows/verify_microsite.yml | 8 +++--- .github/workflows/verify_storybook-noop.yml | 8 +++--- .github/workflows/verify_storybook.yml | 8 +++--- .github/workflows/verify_windows.yml | 8 +++--- 41 files changed, 187 insertions(+), 187 deletions(-) diff --git a/.github/workflows/automate_area-labels.yml b/.github/workflows/automate_area-labels.yml index 47b3dfe42b..dfb60c9243 100644 --- a/.github/workflows/automate_area-labels.yml +++ b/.github/workflows/automate_area-labels.yml @@ -12,10 +12,10 @@ jobs: pull-requests: write # for actions/labeler to add labels to PRs runs-on: ubuntu-latest steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/labeler@v4.3.0 with: diff --git a/.github/workflows/automate_changeset_feedback.yml b/.github/workflows/automate_changeset_feedback.yml index 8dab48c2a3..483d59dc8c 100644 --- a/.github/workflows/automate_changeset_feedback.yml +++ b/.github/workflows/automate_changeset_feedback.yml @@ -22,10 +22,10 @@ jobs: if: github.repository == 'backstage/backstage' && github.event.pull_request.user.login != 'backstage-service' runs-on: ubuntu-latest steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 with: diff --git a/.github/workflows/automate_merge_message.yml b/.github/workflows/automate_merge_message.yml index f5b26b5db3..4cbf6c69a2 100644 --- a/.github/workflows/automate_merge_message.yml +++ b/.github/workflows/automate_merge_message.yml @@ -23,10 +23,10 @@ jobs: if: github.repository == 'backstage/backstage' && github.event.pull_request.merged == true runs-on: ubuntu-latest steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 with: diff --git a/.github/workflows/automate_stale.yml b/.github/workflows/automate_stale.yml index 6cca838722..40ebdf8a3e 100644 --- a/.github/workflows/automate_stale.yml +++ b/.github/workflows/automate_stale.yml @@ -14,10 +14,10 @@ jobs: pull-requests: write # for actions/stale to close stale PRs runs-on: ubuntu-latest steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/stale@v7.0.0 id: stale diff --git a/.github/workflows/ci-noop.yml b/.github/workflows/ci-noop.yml index d04770ea15..7234e945e3 100644 --- a/.github/workflows/ci-noop.yml +++ b/.github/workflows/ci-noop.yml @@ -38,9 +38,9 @@ jobs: name: Test ${{ matrix.node-version }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f63a34c8a1..b08a28d786 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,10 +26,10 @@ jobs: name: Install ${{ matrix.node-version }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 @@ -62,10 +62,10 @@ jobs: name: Verify ${{ matrix.node-version }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 @@ -196,10 +196,10 @@ jobs: INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 - name: fetch branch master diff --git a/.github/workflows/cron.yml b/.github/workflows/cron.yml index 28cd7cc26e..2874be512c 100644 --- a/.github/workflows/cron.yml +++ b/.github/workflows/cron.yml @@ -8,10 +8,10 @@ jobs: cron: runs-on: ubuntu-latest steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: backstage/actions/cron@v0.6.4 with: diff --git a/.github/workflows/deploy_docker-image.yml b/.github/workflows/deploy_docker-image.yml index 34d18465ed..30e7badcd0 100644 --- a/.github/workflows/deploy_docker-image.yml +++ b/.github/workflows/deploy_docker-image.yml @@ -13,10 +13,10 @@ jobs: node-version: [18.x] steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - name: checkout uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/deploy_microsite.yml b/.github/workflows/deploy_microsite.yml index cf11cff115..f614db31ca 100644 --- a/.github/workflows/deploy_microsite.yml +++ b/.github/workflows/deploy_microsite.yml @@ -23,10 +23,10 @@ jobs: cancel-in-progress: true steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/deploy_nightly.yml b/.github/workflows/deploy_nightly.yml index 89dc085b61..d5fe9f5a64 100644 --- a/.github/workflows/deploy_nightly.yml +++ b/.github/workflows/deploy_nightly.yml @@ -14,10 +14,10 @@ jobs: NODE_OPTIONS: --max-old-space-size=4096 steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 diff --git a/.github/workflows/deploy_packages.yml b/.github/workflows/deploy_packages.yml index 7abe55594c..a8a4315191 100644 --- a/.github/workflows/deploy_packages.yml +++ b/.github/workflows/deploy_packages.yml @@ -60,10 +60,10 @@ jobs: INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 @@ -142,10 +142,10 @@ jobs: NODE_OPTIONS: --max-old-space-size=4096 steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/issue.yaml b/.github/workflows/issue.yaml index 72873cd358..1c1c028f20 100644 --- a/.github/workflows/issue.yaml +++ b/.github/workflows/issue.yaml @@ -9,10 +9,10 @@ jobs: if: github.repository == 'backstage/backstage' steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - name: Issue sync uses: backstage/actions/issue-sync@v0.6.4 diff --git a/.github/workflows/pr-review-comment-trigger.yaml b/.github/workflows/pr-review-comment-trigger.yaml index f106dd819a..784dc6cf79 100644 --- a/.github/workflows/pr-review-comment-trigger.yaml +++ b/.github/workflows/pr-review-comment-trigger.yaml @@ -19,10 +19,10 @@ jobs: if: github.repository == 'backstage/backstage' && github.event.comment.user.id == github.event.pull_request.user.id steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - name: Save PR number env: diff --git a/.github/workflows/pr-review-comment.yaml b/.github/workflows/pr-review-comment.yaml index ade9e51ab5..e557c85d51 100644 --- a/.github/workflows/pr-review-comment.yaml +++ b/.github/workflows/pr-review-comment.yaml @@ -16,10 +16,10 @@ jobs: steps: # Inspired by https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - name: Read PR Number id: pr-number diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index ddf5d57d4d..8c99f105a9 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -17,10 +17,10 @@ jobs: # Avoid running on issue comments if: github.repository == 'backstage/backstage' && ( github.event.pull_request || github.event.issue.pull_request ) steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - name: PR sync uses: backstage/actions/pr-sync@v0.6.4 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 06f8eafac5..f4486e2910 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -28,10 +28,10 @@ jobs: id-token: write steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - name: 'Checkout code' uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/sync_code-formatting.yml b/.github/workflows/sync_code-formatting.yml index b7c41dbcc0..fa8d91f25a 100644 --- a/.github/workflows/sync_code-formatting.yml +++ b/.github/workflows/sync_code-formatting.yml @@ -9,10 +9,10 @@ jobs: name: Autofix Markdown files using Prettier runs-on: ubuntu-latest steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: diff --git a/.github/workflows/sync_dependabot-changesets.yml b/.github/workflows/sync_dependabot-changesets.yml index 52a91afedf..2ac6d7f0d0 100644 --- a/.github/workflows/sync_dependabot-changesets.yml +++ b/.github/workflows/sync_dependabot-changesets.yml @@ -10,10 +10,10 @@ jobs: runs-on: ubuntu-latest if: github.actor == 'dependabot[bot]' && github.repository == 'backstage/backstage' steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - name: Checkout uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/sync_release-manifest.yml b/.github/workflows/sync_release-manifest.yml index 906f234afa..46d5d5382a 100644 --- a/.github/workflows/sync_release-manifest.yml +++ b/.github/workflows/sync_release-manifest.yml @@ -7,12 +7,12 @@ jobs: create-new-version: runs-on: ubuntu-latest steps: - # Setup node & install deps before checkout, keeping install quick - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + # Setup node & install deps before checkout, keeping install quick - uses: actions/setup-node@v3.8.1 with: node-version: 18.x diff --git a/.github/workflows/sync_renovate-changesets.yml b/.github/workflows/sync_renovate-changesets.yml index afbbaa4fa2..738abcf773 100644 --- a/.github/workflows/sync_renovate-changesets.yml +++ b/.github/workflows/sync_renovate-changesets.yml @@ -10,10 +10,10 @@ jobs: runs-on: ubuntu-latest if: github.actor == 'renovate[bot]' && github.repository == 'backstage/backstage' steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - name: Checkout uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/sync_snyk-github-issues.yml b/.github/workflows/sync_snyk-github-issues.yml index 25e3b659a4..690e2fb76e 100644 --- a/.github/workflows/sync_snyk-github-issues.yml +++ b/.github/workflows/sync_snyk-github-issues.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/sync_snyk-monitor.yml b/.github/workflows/sync_snyk-monitor.yml index a902e108eb..6450b1bd51 100644 --- a/.github/workflows/sync_snyk-monitor.yml +++ b/.github/workflows/sync_snyk-monitor.yml @@ -24,10 +24,10 @@ jobs: security-events: write # for github/codeql-action/upload-sarif to upload SARIF results runs-on: ubuntu-latest steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 - name: Monitor and Synchronize Snyk Policies diff --git a/.github/workflows/uffizzi-build.yml b/.github/workflows/uffizzi-build.yml index 3930d87687..3107b87b8f 100644 --- a/.github/workflows/uffizzi-build.yml +++ b/.github/workflows/uffizzi-build.yml @@ -19,10 +19,10 @@ jobs: outputs: tags: ${{ steps.meta.outputs.tags }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - name: checkout uses: actions/checkout@v3.6.0 @@ -81,10 +81,10 @@ jobs: outputs: compose-file-cache-key: ${{ steps.hash.outputs.hash }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - name: Checkout git repo uses: actions/checkout@v3.6.0 @@ -113,12 +113,12 @@ jobs: runs-on: ubuntu-latest if: ${{ github.event.action == 'closed' }} steps: - # If this PR is closing, we will not render a compose file nor pass it to the next workflow. - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + # If this PR is closing, we will not render a compose file nor pass it to the next workflow. - name: Upload PR Event as Artifact uses: actions/upload-artifact@v3.1.3 with: diff --git a/.github/workflows/uffizzi-preview.yaml b/.github/workflows/uffizzi-preview.yaml index 82f8b8b859..deebf356bf 100644 --- a/.github/workflows/uffizzi-preview.yaml +++ b/.github/workflows/uffizzi-preview.yaml @@ -17,10 +17,10 @@ jobs: git-ref: ${{ env.GIT_REF }} pr-number: ${{ env.PR_NUMBER }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - name: 'Download artifacts' # Fetch output (zip archive) from the workflow run that triggered this workflow. diff --git a/.github/workflows/verify_accessibility-noop.yml b/.github/workflows/verify_accessibility-noop.yml index 5a7228e408..e2b1860b28 100644 --- a/.github/workflows/verify_accessibility-noop.yml +++ b/.github/workflows/verify_accessibility-noop.yml @@ -25,9 +25,9 @@ jobs: name: Accessibility runs-on: ubuntu-latest steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/verify_accessibility.yml b/.github/workflows/verify_accessibility.yml index 5e4ac62943..d53f3834d2 100644 --- a/.github/workflows/verify_accessibility.yml +++ b/.github/workflows/verify_accessibility.yml @@ -19,10 +19,10 @@ jobs: name: Accessibility runs-on: ubuntu-latest steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 - name: Use Node.js 18.x diff --git a/.github/workflows/verify_codeql.yml b/.github/workflows/verify_codeql.yml index 6523937c8d..666bd5f0f4 100644 --- a/.github/workflows/verify_codeql.yml +++ b/.github/workflows/verify_codeql.yml @@ -41,10 +41,10 @@ jobs: # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - name: Checkout repository uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/verify_docs-quality.yml b/.github/workflows/verify_docs-quality.yml index 35e9fb1c85..ce457a234f 100644 --- a/.github/workflows/verify_docs-quality.yml +++ b/.github/workflows/verify_docs-quality.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/verify_e2e-kubernetes-noop.yml b/.github/workflows/verify_e2e-kubernetes-noop.yml index 6038e7194a..5c52968820 100644 --- a/.github/workflows/verify_e2e-kubernetes-noop.yml +++ b/.github/workflows/verify_e2e-kubernetes-noop.yml @@ -22,9 +22,9 @@ jobs: name: Kubernetes ${{ matrix.node-version }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/verify_e2e-kubernetes.yml b/.github/workflows/verify_e2e-kubernetes.yml index e602e6b0d9..cddd6589d7 100644 --- a/.github/workflows/verify_e2e-kubernetes.yml +++ b/.github/workflows/verify_e2e-kubernetes.yml @@ -21,10 +21,10 @@ jobs: name: Kubernetes ${{ matrix.node-version }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/verify_e2e-linux-noop.yml b/.github/workflows/verify_e2e-linux-noop.yml index deb21168dc..27e08c7055 100644 --- a/.github/workflows/verify_e2e-linux-noop.yml +++ b/.github/workflows/verify_e2e-linux-noop.yml @@ -27,9 +27,9 @@ jobs: name: E2E Linux ${{ matrix.node-version }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/verify_e2e-linux.yml b/.github/workflows/verify_e2e-linux.yml index 53cfa7be50..744a5d7e74 100644 --- a/.github/workflows/verify_e2e-linux.yml +++ b/.github/workflows/verify_e2e-linux.yml @@ -39,10 +39,10 @@ jobs: name: E2E Linux ${{ matrix.node-version }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/verify_e2e-techdocs.yml b/.github/workflows/verify_e2e-techdocs.yml index e1368bbce5..94f08a491f 100644 --- a/.github/workflows/verify_e2e-techdocs.yml +++ b/.github/workflows/verify_e2e-techdocs.yml @@ -29,10 +29,10 @@ jobs: name: Techdocs steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 - uses: actions/setup-python@v4.7.0 diff --git a/.github/workflows/verify_e2e-windows-noop.yml b/.github/workflows/verify_e2e-windows-noop.yml index 74971df3a6..e4b8556f58 100644 --- a/.github/workflows/verify_e2e-windows-noop.yml +++ b/.github/workflows/verify_e2e-windows-noop.yml @@ -24,9 +24,9 @@ jobs: name: E2E Windows ${{ matrix.node-version }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/verify_e2e-windows.yml b/.github/workflows/verify_e2e-windows.yml index 368c4ad645..1385983c24 100644 --- a/.github/workflows/verify_e2e-windows.yml +++ b/.github/workflows/verify_e2e-windows.yml @@ -30,13 +30,13 @@ jobs: name: E2E Windows ${{ matrix.node-version }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + # In order to have the create-app template function as if it was downloaded from NPM # we need to make sure we checkout files with LF line endings only - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit - - name: Set git to use LF run: | git config --global core.autocrlf false diff --git a/.github/workflows/verify_fossa.yml b/.github/workflows/verify_fossa.yml index 82c0d71aa6..393bcf9631 100644 --- a/.github/workflows/verify_fossa.yml +++ b/.github/workflows/verify_fossa.yml @@ -13,10 +13,10 @@ jobs: runs-on: ubuntu-latest steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - name: Checkout uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/verify_microsite-noop.yml b/.github/workflows/verify_microsite-noop.yml index 9597ef3f8b..8c329a0f27 100644 --- a/.github/workflows/verify_microsite-noop.yml +++ b/.github/workflows/verify_microsite-noop.yml @@ -20,9 +20,9 @@ jobs: name: Microsite steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/verify_microsite.yml b/.github/workflows/verify_microsite.yml index d5867f69ee..f0705bedc7 100644 --- a/.github/workflows/verify_microsite.yml +++ b/.github/workflows/verify_microsite.yml @@ -23,10 +23,10 @@ jobs: name: Microsite steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 diff --git a/.github/workflows/verify_storybook-noop.yml b/.github/workflows/verify_storybook-noop.yml index 97fe6171c1..aee4623d5a 100644 --- a/.github/workflows/verify_storybook-noop.yml +++ b/.github/workflows/verify_storybook-noop.yml @@ -27,9 +27,9 @@ jobs: name: Storybook steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - run: echo NOOP diff --git a/.github/workflows/verify_storybook.yml b/.github/workflows/verify_storybook.yml index dfe6856c38..f0354df296 100644 --- a/.github/workflows/verify_storybook.yml +++ b/.github/workflows/verify_storybook.yml @@ -27,10 +27,10 @@ jobs: name: Storybook steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0 with: diff --git a/.github/workflows/verify_windows.yml b/.github/workflows/verify_windows.yml index 153d8d76a5..f2c61938d8 100644 --- a/.github/workflows/verify_windows.yml +++ b/.github/workflows/verify_windows.yml @@ -28,10 +28,10 @@ jobs: INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }} steps: - # - name: Harden Runner - # uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - # with: - # egress-policy: audit + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit - uses: actions/checkout@v3.6.0