Steve Degosserie
746fce9328
security: 🛡️ Harden GitHub Actions workflows ( #349 )
...
## Summary
This PR addresses several security vulnerabilities and applies hardening
measures to the GitHub Actions workflows:
- **Replace `secrets: inherit` with explicit secret passing** - Prevents
unnecessary exposure of all repository secrets to called workflows
- **Add SHA256 checksum verification for downloaded binaries** -
Protects against supply chain attacks via compromised upstream releases
- **Add GitHub Environment protections for release workflows** -
Requires approval before publishing to Docker Hub or creating releases
- **Add explicit minimal permissions to all workflows** - Follows
principle of least privilege, removes unnecessary `packages: write` from
CI.yml
## Changes by Category
### 1. Explicit Secret Passing
| Workflow | Before | After |
|----------|--------|-------|
| CI.yml → docker-build-ci | `secrets: inherit` | No secrets
(GITHUB_TOKEN is automatic) |
| CI.yml → docker-build-release | `secrets: inherit` | Explicit
`DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN` |
| CI.yml → e2e-tests | `secrets: inherit` | No secrets (GITHUB_TOKEN is
automatic) |
### 2. Binary Checksum Verification
| Workflow | Binary | SHA256 |
|----------|--------|--------|
| task-rust-lint.yml | taplo 0.8.1 | `c62baa73c9d7c1572...` |
| task-e2e.yml | kurtosis 1.11.99 | `5e88e98c1b255362...` |
### 3. Environment Protections
| Workflow | Job | Environment |
|----------|-----|-------------|
| task-docker-release.yml | build-test-push | `production` |
| task-publish-binary.yml | publish-draft-release | `releases` |
| task-publish-binary.yml | docker-release-candidate | `production` |
| task-publish-runtime.yml | publish-draft-release | `releases` |
### 4. Explicit Permissions
All 14 workflow files now have explicit `permissions:` blocks with
minimal required access.
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Ahmad Kaouk <56095276+ahmadkaouk@users.noreply.github.com>
2025-12-12 09:52:50 +00:00
Steve Degosserie
678a8fb161
fix: 🔧 Use standard Github runners for the publish runtime task ( #225 )
2025-10-11 10:37:19 +02:00
Steve Degosserie
8c950af4a4
fix: 🔧 Add Podman support to srtool runtime build script ( #222 )
...
## Summary
- Adds support for both Docker and Podman container engines in
`build-runtime-srtool.sh` via `IS_PODMAN` environment variable
- Uses `--userns=keep-id` for Podman (proper user namespace handling)
and `--user $(id -u):$(id -g)` for Docker
- Sets `IS_PODMAN=true` in `task-publish-runtime.yml` workflow to enable
Podman by default
## Changes
**`operator/scripts/build-runtime-srtool.sh`:**
- Added conditional logic to detect `IS_PODMAN` env var
- Dynamically selects between `podman` and `docker` as container engine
- Sets appropriate user/namespace flags based on container engine
**`.github/workflows/task-publish-runtime.yml`:**
- Added `IS_PODMAN: true` environment variable to the srtool build step
- Updated comment to use generic "container user" instead of "docker
user"
Co-authored-by: Claude <noreply@anthropic.com>
2025-10-10 22:57:34 +02:00
Steve Degosserie
72bfe9bb62
fix: 🔧 Add revision number to rust toolchain channel version to match with srtool image version ( #209 )
2025-10-07 11:34:21 +02:00
Steve Degosserie
0110a94978
fix: 🔧 Fix invalid runs-on label in Publish runtime task ( #207 )
2025-10-06 15:38:29 +02:00
Steve Degosserie
066a416349
feat: ✨ Publish runtime GitHub action ( #198 )
2025-09-30 15:24:35 +02:00
Steve Degosserie
a62319961c
feat: ✨ Publish runtime GitHub action ( #197 )
2025-09-30 15:11:54 +02:00
Steve Degosserie
51f4e1b0f3
feat: ✨ Publish runtime release Github action ( #196 )
2025-09-30 14:53:15 +02:00
