diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..253e5b3230 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,1291 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: daily + + - package-ecosystem: docker + directory: /contrib/.devcontainer + schedule: + interval: daily + + - package-ecosystem: docker + directory: /contrib/docker/devops + schedule: + interval: daily + + - package-ecosystem: npm + directory: /cypress + schedule: + interval: daily + + - package-ecosystem: npm + directory: /microsite + schedule: + interval: daily + + - package-ecosystem: npm + directory: / + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/app-defaults + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/app-next-example-plugin + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/app-next + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/app + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-app-api + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-defaults + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-dev-utils + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-next + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-openapi-utils + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-plugin-api + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-plugin-manager + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-tasks + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend-test-utils + schedule: + interval: daily + + - package-ecosystem: docker + directory: /packages/backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/catalog-client + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/catalog-model + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/cli-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/cli-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/cli/asset-types + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/cli + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/codemods + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/config-loader + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/config + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/core-app-api + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/core-components + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/core-plugin-api + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/create-app + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/create-app/templates/default-app/examples/template/content + schedule: + interval: daily + + - package-ecosystem: docker + directory: /packages/create-app/templates/default-app/packages/backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/create-app/templates/default-app + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/dev-utils + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/e2e-test + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/errors + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/eslint-plugin + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/eslint-plugin/src/__fixtures__/monorepo + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/eslint-plugin/src/__fixtures__/monorepo/packages/bar + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/eslint-plugin/src/__fixtures__/monorepo/packages/foo + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/frontend-app-api + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/frontend-plugin-api + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/integration-aws-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/integration-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/integration + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/release-manifests + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/repo-tools + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/techdocs-cli-embedded-app + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/techdocs-cli + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/test-utils + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/theme + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/types + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/version-bridge + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/adr-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/adr-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/adr + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/airbrake-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/airbrake + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/allure + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/analytics-module-ga + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/analytics-module-ga4 + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/analytics-module-newrelic-browser + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/apache-airflow + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/api-docs-module-protoc-gen-doc + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/api-docs + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/apollo-explorer + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/app-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/app-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-backend-module-gcp-iap-provider + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-backend-module-github-provider + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-backend-module-gitlab-provider + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-backend-module-google-provider + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-backend-module-oauth2-provider + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/auth-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/azure-devops-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/azure-devops-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/azure-devops + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/azure-sites-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/azure-sites-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/azure-sites + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/badges-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/badges + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/bazaar-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/bazaar + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/bitbucket-cloud-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/bitrise + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-aws + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-azure + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-bitbucket-cloud + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-bitbucket-server + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-bitbucket + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-gcp + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-gerrit + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-github + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-gitlab + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-incremental-ingestion + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-ldap + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-msgraph + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-openapi + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-puppetdb + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-scaffolder-entity-model + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend-module-unprocessed + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-customized + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-graph + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-graphql + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-import + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog-unprocessed-entities + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/catalog + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/cicd-statistics-module-gitlab + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/cicd-statistics + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/circleci + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/cloudbuild + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/code-climate + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/code-coverage-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/code-coverage + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/codescene + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/config-schema + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/cost-insights-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/cost-insights + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/devtools-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/devtools-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/devtools + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/dynatrace + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/entity-feedback-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/entity-feedback-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/entity-feedback + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/entity-validation + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-module-aws-sqs + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-module-azure + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-module-bitbucket-cloud + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-module-gerrit + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-module-github + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-module-gitlab + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend-test-utils + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/events-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/example-todo-list-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/example-todo-list-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/example-todo-list + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/explore-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/explore-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/explore-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/explore + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/firehydrant + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/fossa + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/gcalendar + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/gcp-projects + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/git-release-manager + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/github-actions + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/github-deployments + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/github-issues + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/github-pull-requests-board + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/gitops-profiles + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/gocd + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/graphiql + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/graphql-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/graphql-voyager + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/home-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/home + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/ilert + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/jenkins-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/jenkins-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/jenkins + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/kafka-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/kafka + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/kubernetes-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/kubernetes-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/kubernetes + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/lighthouse-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/lighthouse-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/lighthouse + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/linguist-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/linguist-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/linguist + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/microsoft-calendar + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/newrelic-dashboard + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/newrelic + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/nomad-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/nomad + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/octopus-deploy + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/opencost + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/org-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/org + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/pagerduty + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/periskop-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/periskop + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/permission-backend-module-policy-allow-all + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/permission-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/permission-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/permission-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/permission-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/playlist-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/playlist-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/playlist + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/proxy-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/puppetdb + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/rollbar-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/rollbar + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend-module-confluence-to-markdown + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend-module-cookiecutter + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend-module-gitlab + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend-module-rails + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend-module-sentry + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend-module-yeoman + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/scaffolder + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend-module-catalog + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend-module-elasticsearch + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend-module-explore + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend-module-pg + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend-module-techdocs + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/search + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/sentry + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/shortcuts + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/sonarqube-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/sonarqube-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/sonarqube + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/splunk-on-call + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/stack-overflow-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/stack-overflow + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/stackstorm + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/tech-insights-backend-module-jsonfc + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/tech-insights-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/tech-insights-common + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/tech-insights-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/tech-insights + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/tech-radar + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/techdocs-addons-test-utils + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/techdocs-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/techdocs-module-addons-contrib + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/techdocs-node + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/techdocs-react + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/techdocs + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/todo-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/todo + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/user-settings-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/user-settings + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/vault-backend + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/vault + schedule: + interval: daily + + - package-ecosystem: npm + directory: /plugins/xcmetrics + schedule: + interval: daily + + - package-ecosystem: npm + directory: /storybook + schedule: + interval: daily diff --git a/.github/workflows/automate_area-labels.yml b/.github/workflows/automate_area-labels.yml index 3d616506e1..c7a147470c 100644 --- a/.github/workflows/automate_area-labels.yml +++ b/.github/workflows/automate_area-labels.yml @@ -2,11 +2,22 @@ name: Automate area labels on: - pull_request_target +permissions: + contents: read + jobs: triage: + permissions: + contents: read # for actions/labeler to determine modified files + pull-requests: write # for actions/labeler to add labels to PRs runs-on: ubuntu-latest steps: - - uses: actions/labeler@v4 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4.3.0 with: repo-token: '${{ secrets.GITHUB_TOKEN }}' sync-labels: true diff --git a/.github/workflows/automate_changeset_feedback.yml b/.github/workflows/automate_changeset_feedback.yml index 9cadf12b4f..9d67c9ef12 100644 --- a/.github/workflows/automate_changeset_feedback.yml +++ b/.github/workflows/automate_changeset_feedback.yml @@ -22,14 +22,19 @@ jobs: if: github.repository == 'backstage/backstage' && github.event.pull_request.user.login != 'backstage-service' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: # Fetch the commit that's merged into the base rather than the target ref # This will let us diff only the contents of the PR, without fetching more history ref: 'refs/pull/${{ github.event.pull_request.number }}/merge' - name: fetch base run: git fetch --depth 1 origin ${{ github.base_ref }} - - uses: backstage/actions/changeset-feedback@v0.6.4 + - uses: backstage/actions/changeset-feedback@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 name: Generate feedback with: diff-ref: 'origin/master' diff --git a/.github/workflows/automate_merge_message.yml b/.github/workflows/automate_merge_message.yml index 9fed796aa5..1ae172e8e4 100644 --- a/.github/workflows/automate_merge_message.yml +++ b/.github/workflows/automate_merge_message.yml @@ -23,7 +23,12 @@ jobs: if: github.repository == 'backstage/backstage' && github.event.pull_request.merged == true runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: ref: '${{ github.event.pull_request.merge_commit_sha }}' @@ -39,7 +44,7 @@ jobs: node generate.js ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }} > message.txt - name: Post Message - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 env: ISSUE_NUMBER: ${{ github.event.pull_request.number }} with: diff --git a/.github/workflows/automate_stale.yml b/.github/workflows/automate_stale.yml index 452ecc48d6..a7a0041a9a 100644 --- a/.github/workflows/automate_stale.yml +++ b/.github/workflows/automate_stale.yml @@ -4,11 +4,22 @@ on: schedule: - cron: '*/10 * * * *' # run every 10 minutes as it also removes labels. +permissions: + contents: read + jobs: stale: + permissions: + issues: write # for actions/stale to close stale issues + pull-requests: write # for actions/stale to close stale PRs runs-on: ubuntu-latest steps: - - uses: actions/stale@v7 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/stale@6f05e4244c9a0b2ed3401882b05d701dd0a7289b # v7.0.0 id: stale with: stale-issue-message: > diff --git a/.github/workflows/ci-noop.yml b/.github/workflows/ci-noop.yml index 16bf11dd1a..bafe59e83a 100644 --- a/.github/workflows/ci-noop.yml +++ b/.github/workflows/ci-noop.yml @@ -7,6 +7,9 @@ on: paths: - 'microsite/**' +permissions: + contents: read + jobs: # The verify jobs runs all the verification that doesn't require a # diff towards master, since it takes some time to fetch that. @@ -19,6 +22,11 @@ jobs: name: Verify ${{ matrix.node-version }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP test-noop: @@ -30,4 +38,9 @@ jobs: name: Test ${{ matrix.node-version }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 12c19075a6..3234242223 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,16 +26,21 @@ jobs: name: Install ${{ matrix.node-version }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -57,16 +62,21 @@ jobs: name: Verify ${{ matrix.node-version }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -186,18 +196,23 @@ jobs: INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: fetch branch master run: git fetch origin master - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} diff --git a/.github/workflows/cron.yml b/.github/workflows/cron.yml index ef8906818f..50395b9f5c 100644 --- a/.github/workflows/cron.yml +++ b/.github/workflows/cron.yml @@ -8,7 +8,12 @@ jobs: cron: runs-on: ubuntu-latest steps: - - uses: backstage/actions/cron@v0.6.4 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: backstage/actions/cron@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }} private-key: ${{ secrets.BACKSTAGE_GOALIE_PRIVATE_KEY }} diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000000..9bfe6712e5 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,27 @@ +# Dependency Review Action +# +# This Action will scan dependency manifest files that change as part of a Pull Request, +# surfacing known-vulnerable versions of the packages declared or updated in the PR. +# Once installed, if the workflow run is marked as required, +# PRs introducing known-vulnerable packages will be blocked from merging. +# +# Source repository: https://github.com/actions/dependency-review-action +name: 'Dependency Review' +on: [pull_request] + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - name: 'Checkout Repository' + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - name: 'Dependency Review' + uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1 diff --git a/.github/workflows/deploy_docker-image.yml b/.github/workflows/deploy_docker-image.yml index 231b81598e..1e602bce60 100644 --- a/.github/workflows/deploy_docker-image.yml +++ b/.github/workflows/deploy_docker-image.yml @@ -13,20 +13,25 @@ jobs: node-version: [18.x] steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: path: backstage ref: v${{ github.event.client_payload.version }} - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -40,17 +45,17 @@ jobs: working-directory: ./example-app - name: Login to GitHub Container Registry - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 + uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0 - name: Build and push - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: context: './example-app' file: ./example-app/packages/backend/Dockerfile diff --git a/.github/workflows/deploy_microsite.yml b/.github/workflows/deploy_microsite.yml index dddb2de4af..75976456c0 100644 --- a/.github/workflows/deploy_microsite.yml +++ b/.github/workflows/deploy_microsite.yml @@ -4,8 +4,13 @@ on: branches: - master +permissions: + contents: read + jobs: deploy-microsite-and-storybook: + permissions: + contents: write # for JamesIves/github-pages-deploy-action to push changes in repo runs-on: ubuntu-latest env: @@ -18,10 +23,15 @@ jobs: cancel-in-progress: true steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js 18.x - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x registry-url: https://registry.npmjs.org/ # Needed for auth @@ -56,7 +66,7 @@ jobs: run: ls microsite/build && ls microsite/build/storybook - name: Deploy both microsite and storybook to gh-pages - uses: JamesIves/github-pages-deploy-action@v4.4.3 + uses: JamesIves/github-pages-deploy-action@a1ea191d508feb8485aceba848389d49f80ca2dc # v4.4.3 with: branch: gh-pages folder: microsite/build diff --git a/.github/workflows/deploy_nightly.yml b/.github/workflows/deploy_nightly.yml index e48a6b97ab..d5fe9f5a64 100644 --- a/.github/workflows/deploy_nightly.yml +++ b/.github/workflows/deploy_nightly.yml @@ -14,15 +14,20 @@ jobs: NODE_OPTIONS: --max-old-space-size=4096 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js 18.x - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v18.x @@ -59,7 +64,7 @@ jobs: - name: Discord notification if: ${{ failure() }} - uses: Ilshidur/action-discord@0.3.2 + uses: Ilshidur/action-discord@0c4b27844ba47cb1c7bee539c8eead5284ce9fa9 # 0.3.2 env: DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }} with: diff --git a/.github/workflows/deploy_packages.yml b/.github/workflows/deploy_packages.yml index 2329101eb0..b420ebf690 100644 --- a/.github/workflows/deploy_packages.yml +++ b/.github/workflows/deploy_packages.yml @@ -60,15 +60,20 @@ jobs: INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -112,7 +117,7 @@ jobs: - name: Discord notification if: ${{ failure() }} - uses: Ilshidur/action-discord@0.3.2 + uses: Ilshidur/action-discord@0c4b27844ba47cb1c7bee539c8eead5284ce9fa9 # 0.3.2 env: DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }} with: @@ -137,15 +142,20 @@ jobs: NODE_OPTIONS: --max-old-space-size=4096 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} @@ -185,7 +195,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }} - name: Dispatch repository event - uses: peter-evans/repository-dispatch@v2 + uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570 # v2.1.2 with: token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }} event-type: release-published @@ -193,7 +203,7 @@ jobs: # Notify everyone about this great new release :D - name: Discord notification - uses: Ilshidur/action-discord@0.3.2 + uses: Ilshidur/action-discord@0c4b27844ba47cb1c7bee539c8eead5284ce9fa9 # 0.3.2 env: DISCORD_WEBHOOK: ${{ secrets.DISCORD_RELEASE_WEBHOOK }} TAG_NAME: ${{ steps.create_tag.outputs.tag_name }} diff --git a/.github/workflows/issue.yaml b/.github/workflows/issue.yaml index 89595db189..b456c1dae4 100644 --- a/.github/workflows/issue.yaml +++ b/.github/workflows/issue.yaml @@ -9,5 +9,10 @@ jobs: if: github.repository == 'backstage/backstage' steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Issue sync - uses: backstage/actions/issue-sync@v0.6.4 + uses: backstage/actions/issue-sync@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 diff --git a/.github/workflows/pr-review-comment-trigger.yaml b/.github/workflows/pr-review-comment-trigger.yaml index 67e4c5abba..7ae7122154 100644 --- a/.github/workflows/pr-review-comment-trigger.yaml +++ b/.github/workflows/pr-review-comment-trigger.yaml @@ -7,6 +7,9 @@ on: types: - created +permissions: + contents: read + jobs: trigger: runs-on: ubuntu-latest @@ -16,13 +19,18 @@ jobs: if: github.repository == 'backstage/backstage' && github.event.comment.user.id == github.event.pull_request.user.id steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Save PR number env: PR_NUMBER: ${{ github.event.pull_request.number }} run: | mkdir -p ./pr echo $PR_NUMBER > ./pr/pr_number - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 with: name: pr_number-${{ github.event.pull_request.number }} path: pr/ diff --git a/.github/workflows/pr-review-comment.yaml b/.github/workflows/pr-review-comment.yaml index 0930c75ddd..1f26643bab 100644 --- a/.github/workflows/pr-review-comment.yaml +++ b/.github/workflows/pr-review-comment.yaml @@ -16,9 +16,14 @@ jobs: steps: # Inspired by https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Read PR Number id: pr-number - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | @@ -35,7 +40,7 @@ jobs: const prNumber = artifact.name.slice('pr_number-'.length) core.setOutput('pr-number', prNumber); - - uses: backstage/actions/re-review@v0.6.4 + - uses: backstage/actions/re-review@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }} private-key: ${{ secrets.BACKSTAGE_GOALIE_PRIVATE_KEY }} diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index a92effbd14..4993e93dbb 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -17,8 +17,13 @@ jobs: # Avoid running on issue comments if: github.repository == 'backstage/backstage' && ( github.event.pull_request || github.event.issue.pull_request ) steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: PR sync - uses: backstage/actions/pr-sync@v0.6.4 + uses: backstage/actions/pr-sync@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }} app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 99b391660a..f245240c99 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -28,6 +28,11 @@ jobs: id-token: write steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: 'Checkout code' uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: diff --git a/.github/workflows/sync_code-formatting.yml b/.github/workflows/sync_code-formatting.yml index 6471b265bc..f3afec592d 100644 --- a/.github/workflows/sync_code-formatting.yml +++ b/.github/workflows/sync_code-formatting.yml @@ -9,23 +9,28 @@ jobs: name: Autofix Markdown files using Prettier runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: # Fetch changes to previous commit - required for 'only_changed' in Prettier action fetch-depth: 0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} - name: Run Prettier on ADOPTERS.md - uses: creyD/prettier_action@v4.3 + uses: creyD/prettier_action@31355f8eef017f8aeba2e0bc09d8502b13dbbad1 # v4.3 with: # Modifies commit only if prettier autofixed the ADOPTERS.md prettier_options: --config docs/prettier.config.js --write ADOPTERS.md diff --git a/.github/workflows/sync_dependabot-changesets.yml b/.github/workflows/sync_dependabot-changesets.yml index d5f6f9a36c..0c732f28d1 100644 --- a/.github/workflows/sync_dependabot-changesets.yml +++ b/.github/workflows/sync_dependabot-changesets.yml @@ -10,8 +10,13 @@ jobs: runs-on: ubuntu-latest if: github.actor == 'dependabot[bot]' && github.repository == 'backstage/backstage' steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 2 ref: ${{ github.head_ref }} @@ -21,7 +26,7 @@ jobs: git config --global user.email noreply@backstage.io git config --global user.name 'Github changeset workflow' - name: Generate changeset - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | const { promises: fs } = require('fs'); diff --git a/.github/workflows/sync_release-manifest.yml b/.github/workflows/sync_release-manifest.yml index df8d3909f4..dcb13d58c5 100644 --- a/.github/workflows/sync_release-manifest.yml +++ b/.github/workflows/sync_release-manifest.yml @@ -8,7 +8,12 @@ jobs: runs-on: ubuntu-latest steps: # Setup node & install deps before checkout, keeping install quick - - uses: actions/setup-node@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x - name: Install dependencies @@ -16,7 +21,7 @@ jobs: run: npm install semver@7.3.5 fs-extra@10.0.0 @manypkg/get-packages@1.1.1 - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: path: backstage # 'v' prefix is added here for the tag, we keep it out of the manifest logic @@ -24,7 +29,7 @@ jobs: # Checkout backstage/versions into /backstage/versions, which is where store the output - name: Checkout versions - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: repository: backstage/versions path: backstage/versions @@ -48,7 +53,7 @@ jobs: git push - name: Dispatch update-helper update - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }} # TODO(Rugvip): Remove the create-app dispatch once we've been on the release version for a while diff --git a/.github/workflows/sync_renovate-changesets.yml b/.github/workflows/sync_renovate-changesets.yml index cd67fa9954..f29fdaa6b7 100644 --- a/.github/workflows/sync_renovate-changesets.yml +++ b/.github/workflows/sync_renovate-changesets.yml @@ -10,8 +10,13 @@ jobs: runs-on: ubuntu-latest if: github.actor == 'renovate[bot]' && github.repository == 'backstage/backstage' steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 2 ref: ${{ github.head_ref }} @@ -21,7 +26,7 @@ jobs: git config --global user.email noreply@backstage.io git config --global user.name 'Github changeset workflow' - name: Generate changeset - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | const { promises: fs } = require("fs"); diff --git a/.github/workflows/sync_snyk-github-issues.yml b/.github/workflows/sync_snyk-github-issues.yml index 6b55609bd5..5b8c56da43 100644 --- a/.github/workflows/sync_snyk-github-issues.yml +++ b/.github/workflows/sync_snyk-github-issues.yml @@ -11,20 +11,25 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js 18.x - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v18.x - name: Create Snyk report - uses: snyk/actions/node@master + uses: snyk/actions/node@299cde98a08ff8b1c2bfde1e5a067bce67a6d2b8 # master continue-on-error: true # Snyk CLI exits with error when vulnerabilities are found with: args: > diff --git a/.github/workflows/sync_snyk-monitor.yml b/.github/workflows/sync_snyk-monitor.yml index 8bfa90d726..dbeccb52fc 100644 --- a/.github/workflows/sync_snyk-monitor.yml +++ b/.github/workflows/sync_snyk-monitor.yml @@ -14,13 +14,24 @@ on: # ignore policies in the .snyk files and then have them show up in the snyk web # UI, and also automatically adds any new packages that are created. +permissions: + contents: read + jobs: sync: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Monitor and Synchronize Snyk Policies - uses: snyk/actions/node@master + uses: snyk/actions/node@299cde98a08ff8b1c2bfde1e5a067bce67a6d2b8 # master with: command: monitor args: > @@ -35,7 +46,7 @@ jobs: # Above we run the `monitor` command, this runs the `test` command which is # the one that generates the SARIF report that we can upload to GitHub. - name: Create Snyk report - uses: snyk/actions/node@master + uses: snyk/actions/node@299cde98a08ff8b1c2bfde1e5a067bce67a6d2b8 # master continue-on-error: true # To make sure that SARIF upload gets called with: args: > @@ -47,6 +58,6 @@ jobs: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} NODE_OPTIONS: --max-old-space-size=7168 - name: Upload Snyk report - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 with: sarif_file: snyk.sarif diff --git a/.github/workflows/sync_version-packages.yml b/.github/workflows/sync_version-packages.yml index 127c11791d..a77050318b 100644 --- a/.github/workflows/sync_version-packages.yml +++ b/.github/workflows/sync_version-packages.yml @@ -13,7 +13,12 @@ jobs: name: Create Changeset PR runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 20000 fetch-tags: true @@ -21,7 +26,7 @@ jobs: - name: Install Dependencies run: yarn --immutable - name: Create Release Pull Request - uses: backstage/changesets-action@v2 + uses: backstage/changesets-action@99063c276a7f12e024cb310e7a05a3a5b89449f8 # v2.1.0 with: # Calls out to `changeset version`, but also runs prettier version: yarn release @@ -31,7 +36,7 @@ jobs: - name: Discord notification if: ${{ failure() }} - uses: Ilshidur/action-discord@0.3.2 + uses: Ilshidur/action-discord@0c4b27844ba47cb1c7bee539c8eead5284ce9fa9 # 0.3.2 env: DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }} with: diff --git a/.github/workflows/uffizzi-build.yml b/.github/workflows/uffizzi-build.yml index 1bcd5ebcd8..b2d3667f4d 100644 --- a/.github/workflows/uffizzi-build.yml +++ b/.github/workflows/uffizzi-build.yml @@ -19,17 +19,22 @@ jobs: outputs: tags: ${{ steps.meta.outputs.tags }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: setup-node - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x registry-url: https://registry.npmjs.org/ - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: linux-v18 @@ -46,7 +51,7 @@ jobs: yarn workspace example-backend build - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 + uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0 - name: Generate UUID image name id: uuid @@ -54,13 +59,13 @@ jobs: - name: Docker metadata id: meta - uses: docker/metadata-action@v4 + uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0 with: images: registry.uffizzi.com/${{ env.UUID_TAG_APP }} tags: type=raw,value=60d - name: Build Image - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: context: . file: packages/backend/Dockerfile @@ -76,8 +81,13 @@ jobs: outputs: compose-file-cache-key: ${{ steps.hash.outputs.hash }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Checkout git repo - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Render Compose File run: | BACKSTAGE_IMAGE=$(echo ${{ needs.build-backstage.outputs.tags }}) @@ -86,13 +96,13 @@ jobs: envsubst '$BACKSTAGE_IMAGE $GITHUB_SHA' < .github/uffizzi/docker-compose.uffizzi.yml > docker-compose.rendered.yml cat docker-compose.rendered.yml - name: Upload Rendered Compose File as Artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 with: name: preview-spec path: docker-compose.rendered.yml retention-days: 2 - name: Upload PR Event as Artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 with: name: preview-spec path: ${{ github.event_path }} @@ -104,8 +114,13 @@ jobs: if: ${{ github.event.action == 'closed' }} steps: # If this PR is closing, we will not render a compose file nor pass it to the next workflow. + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Upload PR Event as Artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 with: name: preview-spec path: ${{ github.event_path }} diff --git a/.github/workflows/uffizzi-preview.yaml b/.github/workflows/uffizzi-preview.yaml index 87c1eaa02f..bf43bbdb4c 100644 --- a/.github/workflows/uffizzi-preview.yaml +++ b/.github/workflows/uffizzi-preview.yaml @@ -17,9 +17,14 @@ jobs: git-ref: ${{ env.GIT_REF }} pr-number: ${{ env.PR_NUMBER }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: 'Download artifacts' # Fetch output (zip archive) from the workflow run that triggered this workflow. - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({ @@ -59,7 +64,7 @@ jobs: - name: Cache Rendered Compose File if: ${{ fromJSON(env.EVENT_JSON).action != 'closed' }} - uses: actions/cache@v3 + uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2 with: path: docker-compose.rendered.yml key: ${{ env.COMPOSE_FILE_HASH }} diff --git a/.github/workflows/verify_accessibility-noop.yml b/.github/workflows/verify_accessibility-noop.yml index bde483eece..e2b1860b28 100644 --- a/.github/workflows/verify_accessibility-noop.yml +++ b/.github/workflows/verify_accessibility-noop.yml @@ -17,9 +17,17 @@ on: - 'plugins/search/src/**' - 'plugins/search-react/src/**' +permissions: + contents: read + jobs: noop: name: Accessibility runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/verify_accessibility.yml b/.github/workflows/verify_accessibility.yml index 32ded3bd3a..7d8753b3bd 100644 --- a/.github/workflows/verify_accessibility.yml +++ b/.github/workflows/verify_accessibility.yml @@ -19,13 +19,18 @@ jobs: name: Accessibility runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Use Node.js 18.x - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v18.x - name: run Lighthouse CI diff --git a/.github/workflows/verify_codeql.yml b/.github/workflows/verify_codeql.yml index f3417ac582..8ea2e8fcd8 100644 --- a/.github/workflows/verify_codeql.yml +++ b/.github/workflows/verify_codeql.yml @@ -19,8 +19,15 @@ on: schedule: - cron: '0 8 * * 6' +permissions: + contents: read + jobs: analyze: + permissions: + actions: read # for github/codeql-action/init to get workflow details + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/autobuild to send a status report name: Analyze runs-on: ubuntu-latest @@ -34,8 +41,13 @@ jobs: # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: # We must fetch at least the immediate parents so that if this is # a pull request then we can checkout the head. @@ -43,7 +55,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -54,7 +66,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -68,4 +80,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 diff --git a/.github/workflows/verify_docs-quality.yml b/.github/workflows/verify_docs-quality.yml index dc1d942e32..1760b2a186 100644 --- a/.github/workflows/verify_docs-quality.yml +++ b/.github/workflows/verify_docs-quality.yml @@ -11,7 +11,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 # Vale does not support file excludes, so we use the script to generate a list of files instead # The action also does not allow args or a local config file to be passed in, so the files array @@ -21,7 +26,7 @@ jobs: run: echo "args=$(node scripts/check-docs-quality.js --ci-args)" >> $GITHUB_OUTPUT - name: documentation quality check - uses: errata-ai/vale-action@v2.0.1 + uses: errata-ai/vale-action@c4213d4de3d5f718b8497bd86161531c78992084 # v2.0.1 with: # This also contains --config=.github/vale/config.ini ... :/ files: '${{ steps.generate.outputs.args }}' diff --git a/.github/workflows/verify_e2e-kubernetes-noop.yml b/.github/workflows/verify_e2e-kubernetes-noop.yml index bedf357079..5c52968820 100644 --- a/.github/workflows/verify_e2e-kubernetes-noop.yml +++ b/.github/workflows/verify_e2e-kubernetes-noop.yml @@ -9,6 +9,9 @@ on: - '.github/workflows/verify_e2e-kubernetes.yml' - 'packages/backend-common/src/**' +permissions: + contents: read + jobs: verify: runs-on: ubuntu-latest @@ -19,4 +22,9 @@ jobs: name: Kubernetes ${{ matrix.node-version }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/verify_e2e-kubernetes.yml b/.github/workflows/verify_e2e-kubernetes.yml index 0c78c1f933..237ce4977b 100644 --- a/.github/workflows/verify_e2e-kubernetes.yml +++ b/.github/workflows/verify_e2e-kubernetes.yml @@ -21,21 +21,26 @@ jobs: name: Kubernetes ${{ matrix.node-version }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} - name: bootstrap kind - uses: helm/kind-action@v1.8.0 + uses: helm/kind-action@dda0770415bac9fc20092cacbc54aa298604d140 # v1.8.0 - name: kubernetes test working-directory: packages/backend-common diff --git a/.github/workflows/verify_e2e-linux-noop.yml b/.github/workflows/verify_e2e-linux-noop.yml index 1384b83378..27e08c7055 100644 --- a/.github/workflows/verify_e2e-linux-noop.yml +++ b/.github/workflows/verify_e2e-linux-noop.yml @@ -14,6 +14,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: noop: runs-on: ubuntu-latest @@ -24,4 +27,9 @@ jobs: name: E2E Linux ${{ matrix.node-version }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/verify_e2e-linux.yml b/.github/workflows/verify_e2e-linux.yml index 61ce55e385..9c684b9ea3 100644 --- a/.github/workflows/verify_e2e-linux.yml +++ b/.github/workflows/verify_e2e-linux.yml @@ -39,7 +39,12 @@ jobs: name: E2E Linux ${{ matrix.node-version }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Configure Git run: | @@ -47,12 +52,12 @@ jobs: git config --global user.name 'GitHub e2e user' - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} diff --git a/.github/workflows/verify_e2e-techdocs.yml b/.github/workflows/verify_e2e-techdocs.yml index fd5c4f0956..a7116d9bf8 100644 --- a/.github/workflows/verify_e2e-techdocs.yml +++ b/.github/workflows/verify_e2e-techdocs.yml @@ -12,6 +12,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: verify: runs-on: ubuntu-latest @@ -26,8 +29,13 @@ jobs: name: Techdocs steps: - - uses: actions/checkout@v3 - - uses: actions/setup-python@v4 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: '3.9' diff --git a/.github/workflows/verify_e2e-windows-noop.yml b/.github/workflows/verify_e2e-windows-noop.yml index f042c350c2..e4b8556f58 100644 --- a/.github/workflows/verify_e2e-windows-noop.yml +++ b/.github/workflows/verify_e2e-windows-noop.yml @@ -11,6 +11,9 @@ on: - 'packages/e2e-test/**' - 'packages/create-app/**' +permissions: + contents: read + jobs: noop: runs-on: windows-2019 @@ -21,4 +24,9 @@ jobs: name: E2E Windows ${{ matrix.node-version }} steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/verify_e2e-windows.yml b/.github/workflows/verify_e2e-windows.yml index b1decefd10..016ea04b95 100644 --- a/.github/workflows/verify_e2e-windows.yml +++ b/.github/workflows/verify_e2e-windows.yml @@ -32,12 +32,17 @@ jobs: steps: # In order to have the create-app template function as if it was downloaded from NPM # we need to make sure we checkout files with LF line endings only + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Set git to use LF run: | git config --global core.autocrlf false git config --global core.eol lf - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Configure Git run: | @@ -45,18 +50,18 @@ jobs: git config --global user.name 'GitHub e2e user' - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: setup python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: '3.10' - name: Add msbuild to PATH - uses: microsoft/setup-msbuild@v1.3.1 + uses: microsoft/setup-msbuild@1ff57057b5cfdc39105cd07a01d78e9b0ea0c14c # v1.3.1 - name: Setup gyp env run: | @@ -70,7 +75,7 @@ jobs: npm prefix -g | % {npm config set node_gyp "$_\node_modules\node-gyp\bin\node-gyp.js"} - name: setup chrome - uses: browser-actions/setup-chrome@latest + uses: browser-actions/setup-chrome@803ef6dfb4fdf22089c9563225d95e4a515820a0 # latest - name: yarn install uses: backstage/actions/yarn-install@v0.6.4 diff --git a/.github/workflows/verify_fossa.yml b/.github/workflows/verify_fossa.yml index 8c6b25d2e4..5174845467 100644 --- a/.github/workflows/verify_fossa.yml +++ b/.github/workflows/verify_fossa.yml @@ -5,13 +5,21 @@ on: pull_request: branches: [master] +permissions: + contents: read + jobs: analyze: runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Install Fossa run: "curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | bash" diff --git a/.github/workflows/verify_microsite-noop.yml b/.github/workflows/verify_microsite-noop.yml index cca7e512c5..8c329a0f27 100644 --- a/.github/workflows/verify_microsite-noop.yml +++ b/.github/workflows/verify_microsite-noop.yml @@ -11,10 +11,18 @@ on: - 'mkdocs.yml' - 'docs/**' +permissions: + contents: read + jobs: noop: runs-on: ubuntu-latest name: Microsite steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/verify_microsite.yml b/.github/workflows/verify_microsite.yml index d219d0ea74..e14799f378 100644 --- a/.github/workflows/verify_microsite.yml +++ b/.github/workflows/verify_microsite.yml @@ -9,6 +9,9 @@ on: - 'mkdocs.yml' - 'docs/**' +permissions: + contents: read + jobs: build-microsite: runs-on: ubuntu-latest @@ -20,10 +23,15 @@ jobs: name: Microsite steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js 18.x - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18.x diff --git a/.github/workflows/verify_storybook-noop.yml b/.github/workflows/verify_storybook-noop.yml index c1f16e4fbd..aee4623d5a 100644 --- a/.github/workflows/verify_storybook-noop.yml +++ b/.github/workflows/verify_storybook-noop.yml @@ -18,10 +18,18 @@ on: - 'packages/core-components/src/**' - '**/*.stories.tsx' +permissions: + contents: read + jobs: noop: runs-on: ubuntu-latest name: Storybook steps: + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + - run: echo NOOP diff --git a/.github/workflows/verify_storybook.yml b/.github/workflows/verify_storybook.yml index bcb0cfe178..3d1bcbf34e 100644 --- a/.github/workflows/verify_storybook.yml +++ b/.github/workflows/verify_storybook.yml @@ -27,17 +27,22 @@ jobs: name: Storybook steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 0 # Required to retrieve git history - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth - name: yarn install - uses: backstage/actions/yarn-install@v0.6.4 + uses: backstage/actions/yarn-install@497722d45fb5a35c14c721f63ed74e6ad5f629dd # v0.6.4 with: cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} - name: storybook yarn install @@ -46,7 +51,7 @@ jobs: - run: yarn build-storybook - - uses: chromaui/action@v1 + - uses: chromaui/action@807600692d28833b717c155e15ed20905cdc865c # v1 with: token: ${{ secrets.GITHUB_TOKEN }} # projectToken intentionally shared to allow collaborators to run Chromatic on forks diff --git a/.github/workflows/verify_windows.yml b/.github/workflows/verify_windows.yml index 312c662b5a..309c2be7ab 100644 --- a/.github/workflows/verify_windows.yml +++ b/.github/workflows/verify_windows.yml @@ -7,6 +7,9 @@ on: paths: - '.github/workflows/verify_windows.yml' +permissions: + contents: read + jobs: build: runs-on: windows-2022 @@ -25,10 +28,15 @@ jobs: INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: use node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ # Needed for auth diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000000..723e338d33 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,18 @@ +repos: +- repo: https://github.com/gitleaks/gitleaks + rev: v8.16.3 + hooks: + - id: gitleaks +- repo: https://github.com/jumanjihouse/pre-commit-hooks + rev: 3.0.0 + hooks: + - id: shellcheck +- repo: https://github.com/pre-commit/mirrors-eslint + rev: v8.38.0 + hooks: + - id: eslint +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.4.0 + hooks: + - id: end-of-file-fixer + - id: trailing-whitespace