Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit9003ae0

Browse files
committed
Merge branch 'main' into mafredri/app-audit
2 parents16ae577 +27a160d commit9003ae0

File tree

365 files changed

+5024
-2137
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

365 files changed

+5024
-2137
lines changed

‎.github/ISSUE_TEMPLATE/1-bug.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name:"🐞 Bug"
22
description:"File a bug report."
3-
title:"<title>"
3+
title:"bug:"
44
labels:["needs-triage"]
55
body:
66
-type:checkboxes

‎.github/dependabot.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@ updates:
3737
# Update our Dockerfile.
3838
-package-ecosystem:"docker"
3939
directories:
40-
-"/dogfood/contents"
40+
-"/dogfood/coder"
41+
-"/dogfood/coder-envbuilder"
4142
-"/scripts"
4243
-"/examples/templates/docker/build"
4344
-"/examples/parameters/build"

‎.github/workflows/ci.yaml

Lines changed: 148 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ jobs:
172172

173173
-name:Get golangci-lint cache dir
174174
run:|
175-
linter_ver=$(egrep -o 'GOLANGCI_LINT_VERSION=\S+' dogfood/contents/Dockerfile | cut -d '=' -f 2)
175+
linter_ver=$(egrep -o 'GOLANGCI_LINT_VERSION=\S+' dogfood/coder/Dockerfile | cut -d '=' -f 2)
176176
go install github.com/golangci/golangci-lint/cmd/golangci-lint@v$linter_ver
177177
dir=$(golangci-lint cache status | awk '/Dir/ { print $2 }')
178178
echo "LINT_CACHE_DIR=$dir" >> $GITHUB_ENV
@@ -1024,7 +1024,11 @@ jobs:
10241024
# Necessary to push docker images to ghcr.io.
10251025
packages:write
10261026
# Necessary for GCP authentication (https://github.com/google-github-actions/setup-gcloud#usage)
1027+
# Also necessary for keyless cosign (https://docs.sigstore.dev/cosign/signing/overview/)
1028+
# And for GitHub Actions attestation
10271029
id-token:write
1030+
# Required for GitHub Actions attestation
1031+
attestations:write
10281032
env:
10291033
DOCKER_CLI_EXPERIMENTAL:"enabled"
10301034
outputs:
@@ -1041,7 +1045,7 @@ jobs:
10411045
fetch-depth:0
10421046

10431047
-name:GHCR Login
1044-
uses:docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567# v3.3.0
1048+
uses:docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772# v3.4.0
10451049
with:
10461050
registry:ghcr.io
10471051
username:${{ github.actor }}
@@ -1069,6 +1073,16 @@ jobs:
10691073
-name:Install zstd
10701074
run:sudo apt-get install -y zstd
10711075

1076+
-name:Install cosign
1077+
uses:sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a# v3.8.1
1078+
with:
1079+
cosign-release:"v2.4.3"
1080+
1081+
-name:Install syft
1082+
uses:anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0# v0.18.0
1083+
with:
1084+
syft-version:"v1.20.0"
1085+
10721086
-name:Setup Windows EV Signing Certificate
10731087
run:|
10741088
set -euo pipefail
@@ -1170,6 +1184,138 @@ jobs:
11701184
done
11711185
fi
11721186
1187+
# GitHub attestation provides SLSA provenance for the Docker images, establishing a verifiable
1188+
# record that these images were built in GitHub Actions with specific inputs and environment.
1189+
# This complements our existing cosign attestations which focus on SBOMs.
1190+
#
1191+
# We attest each tag separately to ensure all tags have proper provenance records.
1192+
# TODO: Consider refactoring these steps to use a matrix strategy or composite action to reduce duplication
1193+
# while maintaining the required functionality for each tag.
1194+
-name:GitHub Attestation for Docker image
1195+
id:attest_main
1196+
if:github.ref == 'refs/heads/main'
1197+
continue-on-error:true
1198+
uses:actions/attest@a63cfcc7d1aab266ee064c58250cfc2c7d07bc31# v2.2.1
1199+
with:
1200+
subject-name:"ghcr.io/coder/coder-preview:main"
1201+
predicate-type:"https://slsa.dev/provenance/v1"
1202+
predicate:|
1203+
{
1204+
"buildType": "https://github.com/actions/runner-images/",
1205+
"builder": {
1206+
"id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
1207+
},
1208+
"invocation": {
1209+
"configSource": {
1210+
"uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}",
1211+
"digest": {
1212+
"sha1": "${{ github.sha }}"
1213+
},
1214+
"entryPoint": ".github/workflows/ci.yaml"
1215+
},
1216+
"environment": {
1217+
"github_workflow": "${{ github.workflow }}",
1218+
"github_run_id": "${{ github.run_id }}"
1219+
}
1220+
},
1221+
"metadata": {
1222+
"buildInvocationID": "${{ github.run_id }}",
1223+
"completeness": {
1224+
"environment": true,
1225+
"materials":true
1226+
}
1227+
}
1228+
}
1229+
push-to-registry:true
1230+
1231+
-name:GitHub Attestation for Docker image (latest tag)
1232+
id:attest_latest
1233+
if:github.ref == 'refs/heads/main'
1234+
continue-on-error:true
1235+
uses:actions/attest@a63cfcc7d1aab266ee064c58250cfc2c7d07bc31# v2.2.1
1236+
with:
1237+
subject-name:"ghcr.io/coder/coder-preview:latest"
1238+
predicate-type:"https://slsa.dev/provenance/v1"
1239+
predicate:|
1240+
{
1241+
"buildType": "https://github.com/actions/runner-images/",
1242+
"builder": {
1243+
"id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
1244+
},
1245+
"invocation": {
1246+
"configSource": {
1247+
"uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}",
1248+
"digest": {
1249+
"sha1": "${{ github.sha }}"
1250+
},
1251+
"entryPoint": ".github/workflows/ci.yaml"
1252+
},
1253+
"environment": {
1254+
"github_workflow": "${{ github.workflow }}",
1255+
"github_run_id": "${{ github.run_id }}"
1256+
}
1257+
},
1258+
"metadata": {
1259+
"buildInvocationID": "${{ github.run_id }}",
1260+
"completeness": {
1261+
"environment": true,
1262+
"materials":true
1263+
}
1264+
}
1265+
}
1266+
push-to-registry:true
1267+
1268+
-name:GitHub Attestation for version-specific Docker image
1269+
id:attest_version
1270+
if:github.ref == 'refs/heads/main'
1271+
continue-on-error:true
1272+
uses:actions/attest@a63cfcc7d1aab266ee064c58250cfc2c7d07bc31# v2.2.1
1273+
with:
1274+
subject-name:"ghcr.io/coder/coder-preview:${{ steps.build-docker.outputs.tag }}"
1275+
predicate-type:"https://slsa.dev/provenance/v1"
1276+
predicate:|
1277+
{
1278+
"buildType": "https://github.com/actions/runner-images/",
1279+
"builder": {
1280+
"id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
1281+
},
1282+
"invocation": {
1283+
"configSource": {
1284+
"uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}",
1285+
"digest": {
1286+
"sha1": "${{ github.sha }}"
1287+
},
1288+
"entryPoint": ".github/workflows/ci.yaml"
1289+
},
1290+
"environment": {
1291+
"github_workflow": "${{ github.workflow }}",
1292+
"github_run_id": "${{ github.run_id }}"
1293+
}
1294+
},
1295+
"metadata": {
1296+
"buildInvocationID": "${{ github.run_id }}",
1297+
"completeness": {
1298+
"environment": true,
1299+
"materials":true
1300+
}
1301+
}
1302+
}
1303+
push-to-registry:true
1304+
1305+
# Report attestation failures but don't fail the workflow
1306+
-name:Check attestation status
1307+
if:github.ref == 'refs/heads/main'
1308+
run:|
1309+
if [[ "${{ steps.attest_main.outcome }}" == "failure" ]]; then
1310+
echo "::warning::GitHub attestation for main tag failed"
1311+
fi
1312+
if [[ "${{ steps.attest_latest.outcome }}" == "failure" ]]; then
1313+
echo "::warning::GitHub attestation for latest tag failed"
1314+
fi
1315+
if [[ "${{ steps.attest_version.outcome }}" == "failure" ]]; then
1316+
echo "::warning::GitHub attestation for version-specific tag failed"
1317+
fi
1318+
11731319
-name:Prune old images
11741320
if:github.ref == 'refs/heads/main'
11751321
uses:vlaurin/action-ghcr-prune@0cf7d39f88546edd31965acba78cdcb0be14d641# v0.6.0

‎.github/workflows/docker-base.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646
uses:actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683# v4.2.2
4747

4848
-name:Docker login
49-
uses:docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567# v3.3.0
49+
uses:docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772# v3.4.0
5050
with:
5151
registry:ghcr.io
5252
username:${{ github.actor }}

‎.github/workflows/docs-ci.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
-name:Setup Node
2929
uses:./.github/actions/setup-node
3030

31-
-uses:tj-actions/changed-files@dcc7a0cba800f454d79fff4b993e8c3555bcc0a8# v45.0.7
31+
-uses:tj-actions/changed-files@531f5f7d163941f0c1c04e0ff4d8bb243ac4366f# v45.0.7
3232
id:changed-files
3333
with:
3434
files:|

‎.github/workflows/dogfood.yaml

Lines changed: 33 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,26 @@ jobs:
3535
uses:actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683# v4.2.2
3636

3737
-name:Setup Nix
38-
uses:DeterminateSystems/nix-installer-action@e50d5f73bfe71c2dd0aa4218de8f4afa59f8f81d# v16
38+
uses:nixbuild/nix-quick-install-action@5bb6a3b3abe66fd09bbf250dce8ada94f856a703# v30
39+
40+
-uses:nix-community/cache-nix-action@c448f065ba14308da81de769632ca67a3ce67cf5# v6.1.2
41+
with:
42+
# restore and save a cache using this key
43+
primary-key:nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
44+
# if there's no cache hit, restore a cache by this prefix
45+
restore-prefixes-first-match:nix-${{ runner.os }}-
46+
# collect garbage until Nix store size (in bytes) is at most this number
47+
# before trying to save a new cache
48+
# 1G = 1073741824
49+
gc-max-store-size-linux:5G
50+
# do purge caches
51+
purge:true
52+
# purge all versions of the cache
53+
purge-prefixes:nix-${{ runner.os }}-
54+
# created more than this number of seconds ago relative to the start of the `Post Restore` phase
55+
purge-created:0
56+
# except the version with the `primary-key`, if it exists
57+
purge-primary-key:never
3958

4059
-name:Get branch name
4160
id:branch-name
@@ -57,7 +76,7 @@ jobs:
5776

5877
-name:Login to DockerHub
5978
if:github.ref == 'refs/heads/main'
60-
uses:docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567# v3.3.0
79+
uses:docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772# v3.4.0
6180
with:
6281
username:${{ secrets.DOCKERHUB_USERNAME }}
6382
password:${{ secrets.DOCKERHUB_PASSWORD }}
@@ -68,7 +87,7 @@ jobs:
6887
project:b4q6ltmpzh
6988
token:${{ secrets.DEPOT_TOKEN }}
7089
buildx-fallback:true
71-
context:"{{defaultContext}}:dogfood/contents"
90+
context:"{{defaultContext}}:dogfood/coder"
7291
pull:true
7392
save:true
7493
push:${{ github.ref == 'refs/heads/main' }}
@@ -113,12 +132,18 @@ jobs:
113132

114133
-name:Terraform init and validate
115134
run:|
116-
cd dogfood
117-
terraform init -upgrade
135+
pushd dogfood/
136+
terraform init
137+
terraform validate
138+
popd
139+
pushd dogfood/coder
140+
terraform init
118141
terraform validate
119-
cd contents
120-
terraform init -upgrade
142+
popd
143+
pushd dogfood/coder-envbuilder
144+
terraform init
121145
terraform validate
146+
popd
122147
123148
-name:Get short commit SHA
124149
if:github.ref == 'refs/heads/main'
@@ -142,6 +167,6 @@ jobs:
142167
# Template source & details
143168
TF_VAR_CODER_TEMPLATE_NAME:${{ secrets.CODER_TEMPLATE_NAME }}
144169
TF_VAR_CODER_TEMPLATE_VERSION:${{ steps.vars.outputs.sha_short }}
145-
TF_VAR_CODER_TEMPLATE_DIR:./contents
170+
TF_VAR_CODER_TEMPLATE_DIR:./coder
146171
TF_VAR_CODER_TEMPLATE_MESSAGE:${{ steps.message.outputs.pr_title }}
147172
TF_LOG:info

‎.github/workflows/pr-deploy.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -237,7 +237,7 @@ jobs:
237237
uses:./.github/actions/setup-sqlc
238238

239239
-name:GHCR Login
240-
uses:docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567# v3.3.0
240+
uses:docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772# v3.4.0
241241
with:
242242
registry:ghcr.io
243243
username:${{ github.actor }}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp