ec57cb5c0f
## Description This PR fixes zizmor --min-severity high findings in our GitHub Actions workflows by: - Pinning all uses: references to immutable commit SHAs (replaces floating tags like @v6 / @main). - Pinning internal Terraform setup action usage (coder/coder/.github/actions/setup-tf@main) to a fixed ref/commit. - Pinning crate-ci/typos to a commit SHA. - Removing GitHub expression template expansion inside a run: block in version-bump.yaml (prevents template injection flagged by zizmor). ## Type of Change - [ ] New module - [ ] New template - [ ] Bug fix - [ ] Feature/enhancement - [ ] Documentation - [x] Other ## Module Information N/A ## Template Information N/A ## Testing & Validation - [ ] Tests pass (`bun test`) - [ ] Code formatted (`bun fmt`) - [x] Changes tested locally - zizmor .github/workflows/* --min-severity high ## Related Issues - coder/registry#642 - https://github.com/coder/registry/pull/662
43 lines
1.5 KiB
YAML
43 lines
1.5 KiB
YAML
name: deploy-registry
|
|
|
|
on:
|
|
schedule:
|
|
# Runs at 02:30 UTC Monday through Friday
|
|
- cron: "30 2 * * 1-5"
|
|
push:
|
|
tags:
|
|
# Matches release/<namespace>/<resource_name>/<semantic_version>
|
|
# (e.g., "release/whizus/exoscale-zone/v1.0.13")
|
|
- "release/*/*/v*.*.*"
|
|
branches: # Templates get released when merged to main
|
|
- main
|
|
paths:
|
|
- ".github/workflows/deploy-registry.yaml"
|
|
- "registry/**/templates/**"
|
|
- "registry/**/README.md"
|
|
- ".icons/**"
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
|
|
# Set id-token permission for gcloud
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
|
|
- name: Authenticate with Google Cloud
|
|
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
|
|
with:
|
|
workload_identity_provider: projects/309789351055/locations/global/workloadIdentityPools/github-actions/providers/github
|
|
service_account: registry-v2-github@coder-registry-1.iam.gserviceaccount.com
|
|
- name: Set up Google Cloud SDK
|
|
uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
|
|
- name: Deploy to dev.registry.coder.com
|
|
run: gcloud builds triggers run 29818181-126d-4f8a-a937-f228b27d3d34 --branch main
|
|
- name: Deploy to registry.coder.com
|
|
run: gcloud builds triggers run 106610ff-41fb-4bd0-90a2-7643583fb9c0 --tag production
|