Oct 29, 2024 · Oct 29, 2024 · Oct 29, 2024 · Oct 29, 2024 · Oct 29, 2024 · Oct 29, 2024
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
 permissions:
  actions: read
  contents: read
  security-events: write

 on:
  workflow_dispatch:

 jobs:
  codeql:
    permissions:
      security-events: write
    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
    steps:
      - name: Harden Runner
            "${{ secrets.SLACK_SECURITY_FAILURE_WEBHOOK_URL }}"

  trivy:
    permissions:
      security-events: write
    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
    steps:
      - name: Harden Runner
          # protoc must be in lockstep with our dogfood Dockerfile or the
          # version in the comments will differ. This is also defined in
          # ci.yaml.
          set -x
          set -euxo pipefail
          cd dogfood/contents
          mkdir -p /usr/local/bin
          mkdir -p /usr/local/include

          DOCKER_BUILDKIT=1 docker build . --target proto -t protoc
          protoc_path=/usr/local/bin/protoc
          docker run --rm --entrypoint cat protoc /tmp/bin/protoc > $protoc_path
          chmod +x $protoc_path
          protoc --version
          # Copy the generated files to the include directory.
          docker run --rm -v /usr/local/include:/target protoc cp -r /tmp/include/google /target/
          ls -la /usr/local/include/google/protobuf/
          stat /usr/local/include/google/protobuf/timestamp.proto

      - name: Build Coder linux amd64 Docker image
        id: build
Original file line number	Diff line number	Diff line change
Expand Up		@@ -3,7 +3,6 @@ name: "security"
		permissions:
		actions: read
		contents: read
		security-events: write

		on:
		workflow_dispatch:
Expand All		@@ -23,6 +22,8 @@ concurrency:

		jobs:
		codeql:
		permissions:
		security-events: write
		runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' \|\| 'ubuntu-latest' }}
		steps:
		- name: Harden Runner
Expand DownExpand Up		@@ -61,6 +62,8 @@ jobs:
		"${{ secrets.SLACK_SECURITY_FAILURE_WEBHOOK_URL }}"

		trivy:
		permissions:
		security-events: write
		runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' \|\| 'ubuntu-latest' }}
		steps:
		- name: Harden Runner
Expand DownExpand Up		@@ -95,13 +98,20 @@ jobs:
		# protoc must be in lockstep with our dogfood Dockerfile or the
		# version in the comments will differ. This is also defined in
		# ci.yaml.
		set -x
		set -euxo pipefail
		cd dogfood/contents
		mkdir -p /usr/local/bin
		mkdir -p /usr/local/include

		DOCKER_BUILDKIT=1 docker build . --target proto -t protoc
		protoc_path=/usr/local/bin/protoc
		docker run --rm --entrypoint cat protoc /tmp/bin/protoc > $protoc_path
		chmod +x $protoc_path
		protoc --version
		# Copy the generated files to the include directory.
		docker run --rm -v /usr/local/include:/target protoc cp -r /tmp/include/google /target/
		ls -la /usr/local/include/google/protobuf/
		stat /usr/local/include/google/protobuf/timestamp.proto

		- name: Build Coder linux amd64 Docker image
		id: build
Expand Down