From 091b5866d4102cf424d46e15315d343e2398a118 Mon Sep 17 00:00:00 2001 From: StepSecurity Bot Date: Thu, 14 Nov 2024 05:19:16 -0800 Subject: [PATCH] [StepSecurity] ci: Harden GitHub Actions (#488) Signed-off-by: StepSecurity Bot --- .github/workflows/check.yml | 12 ++++++------ .github/workflows/code-coverage-test.yml | 11 +++++++---- .github/workflows/pgxn-release.yml | 5 ++++- .github/workflows/postgresql-12-build.yml | 11 +++++++---- .github/workflows/postgresql-12-pgdg-package.yml | 7 +++++-- .github/workflows/postgresql-12-pmm.yaml | 7 +++++-- .github/workflows/postgresql-12-ppg-package.yml | 7 +++++-- .github/workflows/postgresql-13-build.yml | 11 +++++++---- .github/workflows/postgresql-13-pgdg-package.yml | 7 +++++-- .github/workflows/postgresql-13-pmm.yaml | 7 +++++-- .github/workflows/postgresql-13-ppg-package.yml | 7 +++++-- .github/workflows/postgresql-14-build.yml | 11 +++++++---- .github/workflows/postgresql-14-pgdg-package.yml | 7 +++++-- .github/workflows/postgresql-14-pmm.yaml | 7 +++++-- .github/workflows/postgresql-14-ppg-package.yml | 7 +++++-- .github/workflows/postgresql-15-build.yml | 11 +++++++---- .github/workflows/postgresql-15-pgdg-package.yml | 7 +++++-- .github/workflows/postgresql-15-pmm.yaml | 7 +++++-- .github/workflows/postgresql-15-ppg-package.yml | 7 +++++-- .github/workflows/postgresql-16-build.yml | 11 +++++++---- .github/workflows/postgresql-16-pgdg-package.yml | 7 +++++-- .github/workflows/postgresql-16-ppg-package.yml | 7 +++++-- .github/workflows/postgresql-17-build.yml | 11 +++++++---- .github/workflows/postgresql-17-pgdg-package.yml | 7 +++++-- .github/workflows/scorecard.yml | 2 +- 25 files changed, 135 insertions(+), 66 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 972dd8e..540da11 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -10,12 +10,12 @@ jobs: steps: - name: Checkout sources - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: src/pg_stat_monitor - name: Checkout cppcheck sources - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: "danmar/cppcheck" ref: "2.13.4" @@ -43,13 +43,13 @@ jobs: steps: - name: Clone postgres repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: 'postgres/postgres' ref: 'REL_17_STABLE' - name: Checkout sources - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'contrib/pg_stat_monitor' @@ -87,9 +87,9 @@ jobs: steps: - name: Checkout sources - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Check license headers - uses: apache/skywalking-eyes/header@v0.6.0 + uses: apache/skywalking-eyes/header@cd7b195c51fd3d6ad52afceb760719ddc6b3ee91 # v0.6.0 with: token: "" # Prevent comments diff --git a/.github/workflows/code-coverage-test.yml b/.github/workflows/code-coverage-test.yml index 1b1e200..0e16742 100644 --- a/.github/workflows/code-coverage-test.yml +++ b/.github/workflows/code-coverage-test.yml @@ -5,6 +5,9 @@ on: branches: - main +permissions: + contents: read + jobs: build: name: coverage-test @@ -13,7 +16,7 @@ jobs: steps: - name: Clone postgres repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: 'postgres/postgres' ref: 'REL_15_STABLE' @@ -80,7 +83,7 @@ jobs: pg_ctl -D /opt/pgsql/data -l logfile start - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -110,7 +113,7 @@ jobs: working-directory: src/pg_stat_monitor - name: Upload - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0 with: verbose: true token: ${{ secrets.CODECOV_TOKEN }} @@ -127,7 +130,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | diff --git a/.github/workflows/pgxn-release.yml b/.github/workflows/pgxn-release.yml index 0a58f35..a77390e 100644 --- a/.github/workflows/pgxn-release.yml +++ b/.github/workflows/pgxn-release.yml @@ -7,6 +7,9 @@ on: required: true type: string +permissions: + contents: read + jobs: release: name: Release @@ -19,7 +22,7 @@ jobs: shell: bash - name: Check out - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: ref: '${{ inputs.version }}' diff --git a/.github/workflows/postgresql-12-build.yml b/.github/workflows/postgresql-12-build.yml index 94a0ce9..07de039 100644 --- a/.github/workflows/postgresql-12-build.yml +++ b/.github/workflows/postgresql-12-build.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-12-build-test @@ -15,7 +18,7 @@ jobs: steps: - name: Clone postgres repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: 'postgres/postgres' ref: 'REL_12_STABLE' @@ -81,7 +84,7 @@ jobs: pg_ctl -D /opt/pgsql/data -l logfile start - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -115,7 +118,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | @@ -138,7 +141,7 @@ jobs: make installcheck-world - name: Report on installcheck-world test suites fail - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 if: ${{ failure() }} with: name: Regressions output files of failed testsuite, and pg log diff --git a/.github/workflows/postgresql-12-pgdg-package.yml b/.github/workflows/postgresql-12-pgdg-package.yml index 6c85923..8008d28 100644 --- a/.github/workflows/postgresql-12-pgdg-package.yml +++ b/.github/workflows/postgresql-12-pgdg-package.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-12-pgdg-package-test @@ -15,7 +18,7 @@ jobs: steps: - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -77,7 +80,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | diff --git a/.github/workflows/postgresql-12-pmm.yaml b/.github/workflows/postgresql-12-pmm.yaml index cb30f5b..66e7e53 100644 --- a/.github/workflows/postgresql-12-pmm.yaml +++ b/.github/workflows/postgresql-12-pmm.yaml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-12-pgsm-pmm-integration-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone QA Integration repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: 'Percona-Lab/qa-integration' ref: 'main' @@ -39,7 +42,7 @@ jobs: run: docker exec pgsql_pgsm_12 cat pmm-agent.log > ./pmm-ui-tests/tests/output/pmm-agent.log - name: Upload Tests Artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 if: success() || failure() # run this step even if previous step failed with: name: tests-artifact diff --git a/.github/workflows/postgresql-12-ppg-package.yml b/.github/workflows/postgresql-12-ppg-package.yml index 41177ca..ab1f32d 100644 --- a/.github/workflows/postgresql-12-ppg-package.yml +++ b/.github/workflows/postgresql-12-ppg-package.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-12-ppg-package-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -92,7 +95,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | diff --git a/.github/workflows/postgresql-13-build.yml b/.github/workflows/postgresql-13-build.yml index 3c51df2..27cd22b 100644 --- a/.github/workflows/postgresql-13-build.yml +++ b/.github/workflows/postgresql-13-build.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-13-build-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone postgres repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: 'postgres/postgres' ref: 'REL_13_STABLE' @@ -80,7 +83,7 @@ jobs: pg_ctl -D /opt/pgsql/data -l logfile start - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -114,7 +117,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | @@ -137,7 +140,7 @@ jobs: make installcheck-world - name: Report on installcheck-world test suites fail - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 if: ${{ failure() }} with: name: Regressions output files of failed testsuite, and pg log diff --git a/.github/workflows/postgresql-13-pgdg-package.yml b/.github/workflows/postgresql-13-pgdg-package.yml index 4279841..0d6e35d 100644 --- a/.github/workflows/postgresql-13-pgdg-package.yml +++ b/.github/workflows/postgresql-13-pgdg-package.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-13-pgdg-package-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -76,7 +79,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | diff --git a/.github/workflows/postgresql-13-pmm.yaml b/.github/workflows/postgresql-13-pmm.yaml index c4cf096..604292d 100644 --- a/.github/workflows/postgresql-13-pmm.yaml +++ b/.github/workflows/postgresql-13-pmm.yaml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-13-pgsm-pmm-integration-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone QA Integration repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: 'Percona-Lab/qa-integration' ref: 'main' @@ -39,7 +42,7 @@ jobs: run: docker exec pgsql_pgsm_13 cat pmm-agent.log > ./pmm-ui-tests/tests/output/pmm-agent.log - name: Upload Tests Artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 if: success() || failure() # run this step even if previous step failed with: name: tests-artifact diff --git a/.github/workflows/postgresql-13-ppg-package.yml b/.github/workflows/postgresql-13-ppg-package.yml index 559eaed..12f668a 100644 --- a/.github/workflows/postgresql-13-ppg-package.yml +++ b/.github/workflows/postgresql-13-ppg-package.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-13-ppg-package-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -89,7 +92,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | diff --git a/.github/workflows/postgresql-14-build.yml b/.github/workflows/postgresql-14-build.yml index cb83972..d7673f0 100644 --- a/.github/workflows/postgresql-14-build.yml +++ b/.github/workflows/postgresql-14-build.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-14-build-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone postgres repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: 'postgres/postgres' ref: 'REL_14_STABLE' @@ -80,7 +83,7 @@ jobs: pg_ctl -D /opt/pgsql/data -l logfile start - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -115,7 +118,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | @@ -137,7 +140,7 @@ jobs: run: make installcheck-world - name: Report on installcheck-world test suites fail - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 if: ${{ failure() }} with: name: Regressions output files of failed testsuite, and pg log diff --git a/.github/workflows/postgresql-14-pgdg-package.yml b/.github/workflows/postgresql-14-pgdg-package.yml index 4f3a598..04d3203 100644 --- a/.github/workflows/postgresql-14-pgdg-package.yml +++ b/.github/workflows/postgresql-14-pgdg-package.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-14-pgdg-package-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -75,7 +78,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | diff --git a/.github/workflows/postgresql-14-pmm.yaml b/.github/workflows/postgresql-14-pmm.yaml index dd63856..9749232 100644 --- a/.github/workflows/postgresql-14-pmm.yaml +++ b/.github/workflows/postgresql-14-pmm.yaml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-14-pgsm-pmm-integration-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone QA Integration repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: 'Percona-Lab/qa-integration' ref: 'main' @@ -39,7 +42,7 @@ jobs: run: docker exec pgsql_pgsm_14 cat pmm-agent.log > ./pmm-ui-tests/tests/output/pmm-agent.log - name: Upload Tests Artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 if: success() || failure() # run this step even if previous step failed with: name: tests-artifact diff --git a/.github/workflows/postgresql-14-ppg-package.yml b/.github/workflows/postgresql-14-ppg-package.yml index 6088721..91f57f9 100644 --- a/.github/workflows/postgresql-14-ppg-package.yml +++ b/.github/workflows/postgresql-14-ppg-package.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-14-ppg-package-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -89,7 +92,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | diff --git a/.github/workflows/postgresql-15-build.yml b/.github/workflows/postgresql-15-build.yml index 33093d3..da127ef 100644 --- a/.github/workflows/postgresql-15-build.yml +++ b/.github/workflows/postgresql-15-build.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-15-build-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone postgres repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: 'postgres/postgres' ref: 'REL_15_STABLE' @@ -80,7 +83,7 @@ jobs: pg_ctl -D /opt/pgsql/data -l logfile start - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -115,7 +118,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | @@ -137,7 +140,7 @@ jobs: run: make installcheck-world - name: Report on installcheck-world test suites fail - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 if: ${{ failure() }} with: name: Regressions output files of failed testsuite, and pg log diff --git a/.github/workflows/postgresql-15-pgdg-package.yml b/.github/workflows/postgresql-15-pgdg-package.yml index c84172b..6ae7c5d 100644 --- a/.github/workflows/postgresql-15-pgdg-package.yml +++ b/.github/workflows/postgresql-15-pgdg-package.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-15-pgdg-package-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -75,7 +78,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | diff --git a/.github/workflows/postgresql-15-pmm.yaml b/.github/workflows/postgresql-15-pmm.yaml index b218b80..11ed7b1 100644 --- a/.github/workflows/postgresql-15-pmm.yaml +++ b/.github/workflows/postgresql-15-pmm.yaml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-15-pgsm-pmm-integration-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone QA Integration repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: 'Percona-Lab/qa-integration' ref: 'main' @@ -39,7 +42,7 @@ jobs: run: docker exec pgsql_pgsm_15 cat pmm-agent.log > ./pmm-ui-tests/tests/output/pmm-agent.log - name: Upload Tests Artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 if: success() || failure() # run this step even if previous step failed with: name: tests-artifact diff --git a/.github/workflows/postgresql-15-ppg-package.yml b/.github/workflows/postgresql-15-ppg-package.yml index e52abdf..a9db576 100644 --- a/.github/workflows/postgresql-15-ppg-package.yml +++ b/.github/workflows/postgresql-15-ppg-package.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-15-ppg-package-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -89,7 +92,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | diff --git a/.github/workflows/postgresql-16-build.yml b/.github/workflows/postgresql-16-build.yml index 47d252b..f4a3e85 100644 --- a/.github/workflows/postgresql-16-build.yml +++ b/.github/workflows/postgresql-16-build.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-16-build-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone postgres repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: 'postgres/postgres' ref: 'REL_16_STABLE' @@ -80,7 +83,7 @@ jobs: pg_ctl -D /opt/pgsql/data -l logfile start - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -115,7 +118,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | @@ -137,7 +140,7 @@ jobs: run: make installcheck-world - name: Report on installcheck-world test suites fail - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 if: ${{ failure() }} with: name: Regressions output files of failed testsuite, and pg log diff --git a/.github/workflows/postgresql-16-pgdg-package.yml b/.github/workflows/postgresql-16-pgdg-package.yml index 3291e0e..d7c39dd 100644 --- a/.github/workflows/postgresql-16-pgdg-package.yml +++ b/.github/workflows/postgresql-16-pgdg-package.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-16-pgdg-package-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -75,7 +78,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | diff --git a/.github/workflows/postgresql-16-ppg-package.yml b/.github/workflows/postgresql-16-ppg-package.yml index 8f4fd81..bd9a9c8 100644 --- a/.github/workflows/postgresql-16-ppg-package.yml +++ b/.github/workflows/postgresql-16-ppg-package.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-16-ppg-package-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -89,7 +92,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | diff --git a/.github/workflows/postgresql-17-build.yml b/.github/workflows/postgresql-17-build.yml index 8ed9d01..e7d092a 100644 --- a/.github/workflows/postgresql-17-build.yml +++ b/.github/workflows/postgresql-17-build.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-17-build-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone postgres repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: 'postgres/postgres' ref: 'REL_17_STABLE' @@ -80,7 +83,7 @@ jobs: pg_ctl -D /opt/pgsql/data -l logfile start - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -115,7 +118,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | @@ -137,7 +140,7 @@ jobs: run: make installcheck-world - name: Report on installcheck-world test suites fail - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 if: ${{ failure() }} with: name: Regressions output files of failed testsuite, and pg log diff --git a/.github/workflows/postgresql-17-pgdg-package.yml b/.github/workflows/postgresql-17-pgdg-package.yml index 99175ab..4fd41ae 100644 --- a/.github/workflows/postgresql-17-pgdg-package.yml +++ b/.github/workflows/postgresql-17-pgdg-package.yml @@ -7,6 +7,9 @@ on: tags: - '[0-9]+.[0-9]+.[0-9]+*' +permissions: + contents: read + jobs: build: name: pg-17-pgdg-package-test @@ -14,7 +17,7 @@ jobs: timeout-minutes: 30 steps: - name: Clone pg_stat_monitor repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: 'src/pg_stat_monitor' @@ -75,7 +78,7 @@ jobs: - name: Upload logs on fail if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 with: name: Regressions diff and postgresql log path: | diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index cb2777b..2bab53a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -43,6 +43,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard (optional). - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@396bb3e45325a47dd9ef434068033c6d5bb0d11a # v3.27.3 with: sarif_file: results.sarif