mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 13:37:30 +00:00
18256bdf0e
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Upgraded security protections across build and deployment workflows
for enhanced runner environment hardening.
* Strengthened CI/CD infrastructure security measures throughout
automated processes.
* No direct user-facing changes.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
28 lines
861 B
YAML
28 lines
861 B
YAML
name: Secret sync to confidential
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
# This allows a subsequently queued workflow run to interrupt previous runs
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
sync_secrets:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
|
|
with:
|
|
egress-policy: audit
|
|
- uses: jpoehnelt/secrets-sync-action@7840777f242539d96b60477b66aa1c179e7644ea # v1.10.0
|
|
name: Sync secrets to confidential
|
|
with:
|
|
SECRETS: |
|
|
^DIGICERT_.*
|
|
^APPLE_.*
|
|
REPOSITORIES: |
|
|
fleetdm/confidential
|
|
DRY_RUN: true
|
|
GITHUB_TOKEN: ${{ secrets.SECRETS_GITHUB_PAT }}
|
|
CONCURRENCY: 10
|