Skip to content

Commit 687e41e

Browse files
NicconikeNicconike
committed
ci(fix): add permissions to workflow files and update templates, tests
1 parent a16cf27 commit 687e41e

11 files changed

Lines changed: 379 additions & 156 deletions

File tree

‎.github/workflows/bandit.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ on:
1010
pull_request:
1111
branches: [master]
1212

13+
permissions:
14+
contents: read
15+
1316
jobs:
1417
bandit:
1518
uses: Nicconike/Steam-Stats/.github/workflows/bandit.yml@master

‎.github/workflows/codeql.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
pull_request:
77
branches: [master]
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
static-analysis:
1114
uses: Nicconike/Steam-Stats/.github/workflows/codeql.yml@master

‎.github/workflows/coverage.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,16 @@ on:
1010
pull_request:
1111
branches: [master]
1212

13+
permissions:
14+
contents: read
15+
1316
jobs:
1417
code-coverage:
1518
uses: Nicconike/Steam-Stats/.github/workflows/coverage.yml@master
1619
with:
1720
use_playwright: false
1821
secrets:
1922
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
23+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
24+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
2025
INPUT_WAKATIME_API_KEY: ${{ secrets.WAKATIME_API_KEY }}

‎.github/workflows/dependency-review.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ on:
33
pull_request:
44
branches: [master]
55

6+
permissions:
7+
contents: read
8+
69
jobs:
710
dependency-review:
811
uses: Nicconike/Steam-Stats/.github/workflows/dependency-review.yml@master

‎.github/workflows/release.yml‎

Lines changed: 220 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,228 @@ on:
88
paths:
99
- ".github/workflows/release.yml"
1010
- "api/*.py"
11+
- "templates/*.j2"
1112
- "pyproject.toml"
1213
- "Dockerfile"
13-
- "requirements.txt"
14+
15+
permissions:
16+
contents: read
1417

1518
jobs:
1619
release:
17-
uses: Nicconike/Steam-Stats/.github/workflows/release.yml@master
18-
with:
19-
repo_name: "Wakatime-Leaderboards"
20-
docker_image: "wakatime-leaderboards"
21-
secrets:
22-
APP_ID: ${{ secrets.GH_APP_ID }}
23-
APP_PRIVATE_KEY: ${{ secrets.GH_PRIVATE_KEY }}
24-
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
20+
if: |
21+
github.actor != 'dependabot[bot]' &&
22+
github.actor != 'github-actions[bot]' &&
23+
github.actor != 'protected-auto-commits[bot]'
24+
name: Release
25+
runs-on: ubuntu-latest
26+
concurrency:
27+
group: ${{ github.workflow }}-${{ github.ref }}
28+
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
29+
permissions:
30+
id-token: write
31+
contents: write
32+
outputs:
33+
released: ${{ steps.semantic.outputs.released }}
34+
version: ${{ steps.semantic.outputs.version }}
35+
previous_version: ${{ steps.semantic.outputs.previous_version }}
36+
steps:
37+
- name: Harden the runner
38+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
39+
with:
40+
egress-policy: audit
41+
42+
- name: GitHub App Token
43+
uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
44+
id: app-token
45+
with:
46+
app-id: ${{ secrets.APP_ID }}
47+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
48+
49+
- name: Checkout Code
50+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
51+
with:
52+
fetch-depth: 0
53+
token: ${{ steps.app-token.outputs.token }}
54+
55+
- name: Setup Python
56+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
57+
with:
58+
python-version: "3.13"
59+
cache: "pip"
60+
61+
- name: Install Dependencies
62+
run: |
63+
pip install python-semantic-release==10.4.1
64+
65+
- name: Update to Latest Commit
66+
run: |
67+
git fetch origin
68+
git reset --hard origin/${{ github.ref_name }}
69+
70+
- name: Semantic Release
71+
id: semantic
72+
uses: python-semantic-release/python-semantic-release@4d4cb0ab842247caea1963132c242c62aab1e4d5 # v10.4.1
73+
with:
74+
github_token: ${{ steps.app-token.outputs.token }}
75+
env:
76+
PYTHON_KEYRING_BACKEND: keyring.backends.null.Keyring
77+
78+
- name: Publish to GitHub Release Assets
79+
uses: python-semantic-release/publish-action@ae6462adc12bd3d1738070d784b65b5189b955a9 # v10.4.1
80+
with:
81+
github_token: ${{ steps.app-token.outputs.token }}
82+
tag: ${{ steps.semantic.outputs.tag }}
83+
84+
- name: Build distribution
85+
run: |
86+
pip install build==1.3.0
87+
python -m build
88+
89+
- name: Publish to PyPI
90+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
91+
with:
92+
packages-dir: dist
93+
print-hash: true
94+
verbose: true
95+
continue-on-error: true
96+
97+
docker:
98+
name: Docker
99+
runs-on: ubuntu-latest
100+
needs: release
101+
if: needs.release.outputs.released == 'true'
102+
concurrency:
103+
group: ${{ github.workflow }}-${{ github.ref }}
104+
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
105+
permissions:
106+
contents: read
107+
attestations: write
108+
id-token: write
109+
packages: write
110+
steps:
111+
- name: Harden the runner
112+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
113+
with:
114+
egress-policy: audit
115+
116+
- name: GitHub App Token
117+
uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
118+
id: app-token
119+
with:
120+
app-id: ${{ secrets.APP_ID }}
121+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
122+
123+
- name: Checkout Code
124+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
125+
with:
126+
fetch-depth: 0
127+
token: ${{ steps.app-token.outputs.token }}
128+
129+
- name: Install CoSign
130+
if: github.event_name != 'pull_request'
131+
uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
132+
with:
133+
cosign-release: "v2.6.0"
134+
135+
- name: Setup Docker Buildx
136+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
137+
138+
- name: Login to Docker Hub
139+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
140+
with:
141+
username: ${{ vars.DOCKER_USERNAME }}
142+
password: ${{ secrets.DOCKER_TOKEN }}
143+
144+
- name: Login to GitHub Container Registry
145+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
146+
with:
147+
registry: ghcr.io
148+
username: ${{ github.actor }}
149+
password: ${{ secrets.GITHUB_TOKEN }}
150+
151+
- name: Extract Docker Metadata
152+
id: meta
153+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
154+
with:
155+
images: |
156+
${{ vars.DOCKER_USERNAME }}/${{ github.event.repository.name }}
157+
ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
158+
tags: |
159+
type=raw,value=master
160+
type=raw,value=v${{ needs.release.outputs.version }}
161+
162+
- name: Build & Push Docker Image
163+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
164+
id: push
165+
with:
166+
context: .
167+
file: ./Dockerfile
168+
push: true
169+
tags: ${{ steps.meta.outputs.tags }}
170+
labels: ${{ steps.meta.outputs.labels }}
171+
platforms: linux/amd64
172+
cache-from: type=gha
173+
cache-to: type=gha,mode=max
174+
secrets: |
175+
GITHUB_TOKEN=${{ steps.app-token.outputs.token }}
176+
177+
- name: Sign the published Docker Image
178+
if: ${{ github.event_name != 'pull_request' }}
179+
env:
180+
TAGS: ${{ steps.meta.outputs.tags }}
181+
DIGEST: ${{ steps.push.outputs.digest }}
182+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
183+
184+
- name: Generate Artifact Attestation
185+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
186+
with:
187+
subject-name: ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
188+
subject-digest: ${{ steps.push.outputs.digest }}
189+
push-to-registry: true
190+
191+
- name: Docker Scout Scan
192+
uses: docker/scout-action@f8c776824083494ab0d56b8105ba2ca85c86e4de # v1.18.2
193+
with:
194+
command: quickview, cves
195+
image: ${{ vars.DOCKER_USERNAME }}/${{ github.event.repository.name }}:master
196+
write-comment: true
197+
github-token: ${{ secrets.GITHUB_TOKEN }}
198+
sarif-file: docker-scout-results.sarif
199+
200+
- name: Upload Scout Scan Results
201+
if: always()
202+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
203+
with:
204+
name: docker-scout-results
205+
path: docker-scout-results.sarif
206+
207+
cleanup:
208+
runs-on: ubuntu-latest
209+
name: Cleanup
210+
needs: [release, docker]
211+
concurrency:
212+
group: ${{ github.workflow }}-cleanup
213+
cancel-in-progress: false
214+
permissions:
215+
contents: read
216+
packages: write
217+
steps:
218+
- name: Harden the runner
219+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
220+
with:
221+
egress-policy: audit
222+
223+
- name: Checkout Code
224+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
225+
with:
226+
fetch-depth: 0
227+
228+
- name: Delete Old GHCR Tags
229+
uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0
230+
with:
231+
package-name: "wakatime-leaderboards"
232+
package-type: "container"
233+
min-versions-to-keep: 2
234+
delete-only-untagged-versions: true
235+
token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/scorecard.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
pull_request:
77
branches: [master]
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
scorecard:
1114
uses: Nicconike/Steam-Stats/.github/workflows/scorecard.yml@master

‎.github/workflows/wakatime.yml‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,11 @@ on:
88
push:
99
branches: [master]
1010
paths:
11-
- '.github/workflows/wakatime.yml'
12-
- 'api/*.py'
11+
- ".github/workflows/wakatime.yml"
12+
- "api/*.py"
13+
14+
permissions:
15+
contents: read
1316

1417
jobs:
1518
update-readme:
@@ -20,16 +23,16 @@ jobs:
2023
github.actor != 'protected-auto-commits[bot]'
2124
runs-on: ubuntu-latest
2225
steps:
23-
- name: GitHub App Token
24-
uses: actions/create-github-app-token@v2
25-
id: app-token
26-
with:
27-
app-id: ${{ secrets.GH_APP_ID }}
28-
private-key: ${{ secrets.GH_PRIVATE_KEY }}
26+
- name: GitHub App Token
27+
uses: actions/create-github-app-token@v2
28+
id: app-token
29+
with:
30+
app-id: ${{ secrets.GH_APP_ID }}
31+
private-key: ${{ secrets.GH_PRIVATE_KEY }}
2932

30-
- name: Run Wakatime Leaderboards
31-
uses: docker://nicconike/wakatime-leaderboards:master
32-
env:
33-
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
34-
GITHUB_REPOSITORY: ${{ github.repository }}
35-
INPUT_WAKATIME_API_KEY: ${{ secrets.WAKATIME_API_KEY }}
33+
- name: Run Wakatime Leaderboards
34+
uses: docker://nicconike/wakatime-leaderboards:master
35+
env:
36+
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
37+
GITHUB_REPOSITORY: ${{ github.repository }}
38+
INPUT_WAKATIME_API_KEY: ${{ secrets.WAKATIME_API_KEY }}

0 commit comments

Comments
 (0)