Repository navigation
security: pin tibdex/github-app-token to SHA in ci.yml (TeamPCP) #231
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| jobs: | |
| test: | |
| if: github.event_name != 'push' || github.ref != 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12", "3.13"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: 'false' | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install . | |
| - name: Run tests | |
| run: | | |
| pytest --maxfail=1 --disable-warnings | |
| check-bumpver: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| should_run: ${{ steps.check.outputs.should_run }} | |
| steps: | |
| - name: Check for bumpver commit | |
| id: check | |
| run: | | |
| if [[ "${{ github.event.head_commit.message }}" == *"bump: version"* ]]; then | |
| echo "should_run=false" >> $GITHUB_OUTPUT | |
| else | |
| echo "should_run=true" >> $GITHUB_OUTPUT | |
| fi | |
| tag-version: | |
| if: needs.check-bumpver.outputs.should_run == 'true' && github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| needs: check-bumpver | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: 'false' | |
| - name: Generate GitHub App token | |
| id: generate_token | |
| # SECURITY FIX (Finding 2 - TeamPCP audit): Using official GitHub-maintained action | |
| # instead of third-party tibdex. Pinned to SHA for supply chain safety. | |
| # actions/create-github-app-token v3 -> sha f8d387b68d61c58ab83c6c016672934102569859 | |
| uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3 | |
| with: | |
| app-id: ${{ secrets.HAWKY_APP_ID }} | |
| private-key: ${{ secrets.HAWKY_APP_PRIVATE_KEY }} | |
| - name: Set up git for pushing | |
| run: | | |
| git remote set-url origin https://x-access-token:${{ steps.generate_token.outputs.token }}@github.com/${{ github.repository }}.git | |
| - name: Set git user for HawkyMcBuilderFace bot | |
| run: | | |
| git config user.name "${{ secrets.HAWKY_APP_USER }}" | |
| git config user.email "${{ secrets.HAWKY_APP_USER_EMAIL }}" | |
| - name: Fetch and checkout latest main | |
| run: | | |
| git fetch origin main | |
| git checkout origin/main | |
| - name: Show current branch and HEAD | |
| run: | | |
| git branch -a | |
| git status | |
| git rev-parse --abbrev-ref HEAD | |
| - name: Get version from pyproject.toml | |
| id: get_version | |
| run: | | |
| VERSION=$(grep '^version =' pyproject.toml | head -1 | cut -d '"' -f2) | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| - name: Create and push tag for current version (with verbose logging) | |
| run: | | |
| git remote -v | |
| git tag v${{ steps.get_version.outputs.version }} | |
| git fetch origin --tags --verbose | |
| git push origin v${{ steps.get_version.outputs.version }} | |
| bump-version: | |
| if: needs.check-bumpver.outputs.should_run == 'true' && github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| needs: [check-bumpver, tag-version] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: 'false' | |
| - name: Generate GitHub App token | |
| id: generate_token | |
| # SECURITY FIX (Finding 2 - TeamPCP audit): Pinned to commit SHA instead of | |
| # mutable @v2 tag. | |
| # Pin: v2.1.0 -> sha 3beb63f4bd073e61482598c45c71c1019b59b73a | |
| uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3 | |
| with: | |
| app-id: ${{ secrets.HAWKY_APP_ID }} | |
| private-key: ${{ secrets.HAWKY_APP_PRIVATE_KEY }} | |
| - name: Set up git for pushing | |
| run: | | |
| git remote set-url origin https://x-access-token:${{ steps.generate_token.outputs.token }}@github.com/${{ github.repository }}.git | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install . | |
| - name: Set git user for HawkyMcBuilderFace bot | |
| run: | | |
| git config user.name "${{ secrets.HAWKY_APP_USER }}" | |
| git config user.email "${{ secrets.HAWKY_APP_USER_EMAIL }}" | |
| - name: Fetch and checkout latest main | |
| run: | | |
| git fetch origin main | |
| git checkout origin/main | |
| - name: Bump patch version with bumpver | |
| run: bumpver update --patch --commit | |
| - name: Push version bump commit | |
| run: | | |
| git push origin HEAD:main |