ci: publish and deploy on merge to development instead of main #58
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,7 +8,7 @@ env: | |
| on: | ||
| push: | ||
| branches: | ||
| - development | ||
| tags: | ||
| - v* | ||
|
|
||
|
|
@@ -173,20 +173,20 @@ jobs: | |
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Generate token for infrastructure dispatch (development) | ||
| id: infra-dispatch-token-dev | ||
| uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2 | ||
| with: | ||
| app-id: ${{ secrets.GH_APP_ID }} | ||
| private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} | ||
| owner: getoptimum | ||
| repositories: infrastructure | ||
|
Comment on lines
+176
to
183
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
curl -fsSL \
"https://raw.githubusercontent.com/actions/create-github-app-token/29824e69f54612133e76f7eaac726eef6c875baf/action.yml" |
rg -n 'permission-contents'Repository: getoptimum/optimum-gateway Length of output: 190 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- workflow structure and token references ---'
rg -n -C 5 \
'create-github-app-token|infra-dispatch-token|repository_dispatch|DOCKER_TOKEN|permissions:|concurrency:|timeout-minutes|uses:' \
.github/workflows/docker-publish.yml
printf '%s\n' '--- pinned action metadata ---'
curl -fsSL \
'https://raw.githubusercontent.com/actions/create-github-app-token/29824e69f54612133e76f7eaac726eef6c875baf/action.yml' |
sed -n '1,180p'Repository: getoptimum/optimum-gateway Length of output: 16818 🌐 Web query:
💡 Result: When using the actions/create-github-app-token GitHub Action, you can explicitly define permissions for the generated installation access token by using the Citations:
🌐 Web query:
💡 Result: To trigger a repository dispatch event using a GitHub App, you must make a POST request to the GitHub REST API endpoint: POST /repos/{owner}/{repo}/dispatches [1][2]. To perform this action using a GitHub App installation access token, the app must have at least read-level access to the "Contents" repository permission [3]. This permission is required to subscribe to and trigger the repository_dispatch event [3][4]. When making the request, you must provide: 1. event_type: A custom string (100 characters or fewer) used as the event name [1][2]. 2. client_payload: An optional JSON object containing data that your GitHub Actions workflow or GitHub App can use [1][2]. Authentication is performed by including the GitHub App installation access token in the Authorization header of your request: Authorization: Bearer YOUR_INSTALLATION_ACCESS_TOKEN [5]. Citations:
🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- pinned action README permission behavior ---'
curl -fsSL \
'https://raw.githubusercontent.com/actions/create-github-app-token/29824e69f54612133e76f7eaac726eef6c875baf/README.md' |
rg -n -C 8 'permission-|all permissions|permissions' | head -160
printf '%s\n' '--- official repository dispatch documentation ---'
curl -fsSL \
'https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28' |
python3 - <<'PY'
import sys
from html.parser import HTMLParser
class Text(HTMLParser):
def __init__(self):
super().__init__()
self.parts = []
def handle_data(self, data):
value = " ".join(data.split())
if value:
self.parts.append(value)
p = Text()
p.feed(sys.stdin.read())
text = " ".join(p.parts)
needle = "Create a repository dispatch event"
pos = text.find(needle)
if pos < 0:
print("dispatch section not found")
else:
print(text[pos:pos + 5000])
PYRepository: getoptimum/optimum-gateway Length of output: 4191 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
doc=/tmp/github-repos-rest.html
curl -fsSL \
'https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28' \
-o "$doc"
printf '%s\n' '--- repository dispatch section in official REST docs ---'
rg -in -C 12 \
'create a repository dispatch event|repository_dispatch|Contents.*(read|write)|fine-grained' \
"$doc" | head -240
printf '%s\n' '--- official REST API description ---'
api=/tmp/github-rest-api.yaml
curl -fsSL \
'https://raw.githubusercontent.com/github/rest-api-description/main/descriptions/api.github.com/api.github.com.yaml' \
-o "$api"
rg -n -C 16 \
'/repos/\{owner\}/\{repo\}/dispatches|repository dispatch|contents.*write|contents.*read' \
"$api" | head -240Repository: getoptimum/optimum-gateway Length of output: 50383 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
from html.parser import HTMLParser
from html import unescape
path = "/tmp/github-repos-rest.html"
class Parser(HTMLParser):
def __init__(self):
super().__init__()
self.out = []
def handle_data(self, data):
text = " ".join(data.split())
if text:
self.out.append(text)
parser = Parser()
with open(path, encoding="utf-8") as f:
parser.feed(f.read())
text = " ".join(parser.out)
start = text.find("Create a repository dispatch event")
if start < 0:
raise SystemExit("dispatch section not found")
# Stop before the next endpoint heading.
end = text.find("Get the hash algorithm for a repository", start)
if end < 0:
end = start + 7000
print(text[start:end][:9000])
PYRepository: getoptimum/optimum-gateway Length of output: 200 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
from html import unescape
from html.parser import HTMLParser
path = "/tmp/github-repos-rest.html"
raw = open(path, encoding="utf-8").read()
needle = 'id="create-a-repository-dispatch-event"'
positions = []
pos = 0
while True:
pos = raw.find(needle, pos)
if pos < 0:
break
positions.append(pos)
pos += len(needle)
print("heading occurrences:", len(positions), positions)
for i, pos in enumerate(positions):
print(f"\n--- occurrence {i + 1} at {pos} ---")
fragment = raw[max(0, pos - 500):pos + 12000]
parser = HTMLParser()
parts = []
parser.handle_data = lambda data: parts.append(" ".join(data.split()))
parser.feed(fragment)
text = " ".join(x for x in parts if x)
print(text[:9000])
PYRepository: getoptimum/optimum-gateway Length of output: 3600 Restrict both infrastructure App tokens. Set 🧰 Tools🪛 zizmor (1.29.0)[error] 178-178: dangerous use of GitHub App tokens (github-app): app token inherits blanket installation permissions (github-app) 🤖 Prompt for AI AgentsSources: Path instructions, Linters/SAST tools |
||
|
|
||
| - name: Trigger Ansible deploy (development) | ||
| run: | | ||
| gh api repos/getoptimum/infrastructure/dispatches \ | ||
| -f event_type=deploy_gateways \ | ||
| -f "client_payload[tag]=dev-latest" \ | ||
| -f "client_payload[digest]=${{ needs.docker.outputs.digest }}" | ||
| env: | ||
| GH_TOKEN: ${{ steps.infra-dispatch-token-dev.outputs.token }} | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Limit the Docker Hub token to the login step.
DOCKER_TOKENis job-scoped at Line 20, so every action and shell step in thedockerjob receives the credential. The newdevelopmenttrigger increases the code paths that receive this secret.Pass
secrets.OPT_DOCKER_ACCESS_TOKENonly todocker/login-action, or define it as a step-scoped environment variable.As per path instructions, workflows must avoid secret exposure and use least-privilege secret scope.
🤖 Prompt for AI Agents
Source: Path instructions
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Add bounded timeouts to both publishing jobs.
The
dockeranddeploy-devjobs have no job-leveltimeout-minutes. A multi-platform build orgh apidispatch can remain active indefinitely when a runner or external service hangs.Add bounded values appropriate to the build and deployment durations.
As per path instructions, workflows must define job timeouts.
Also applies to: 176-192
🤖 Prompt for AI Agents
Source: Path instructions
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: getoptimum/optimum-gateway
Length of output: 507
🏁 Script executed:
Repository: getoptimum/optimum-gateway
Length of output: 9464
Add workflow-level least-privilege permissions.
dockeranddeploy-devhave no job-level permissions and currently inherit repository defaults forGITHUB_TOKEN, which may allow writes. Addpermissions: contents: readat workflow scope. Keep write access in the narrowly scoped GitHub App tokens.🤖 Prompt for AI Agents
Source: Path instructions
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: getoptimum/optimum-gateway
Length of output: 200
🏁 Script executed:
Repository: getoptimum/optimum-gateway
Length of output: 12763
🏁 Script executed:
Repository: getoptimum/optimum-gateway
Length of output: 339
Add a shared workflow-level concurrency group
The workflow has no
concurrencydeclaration. Concurrent runs can race ongit push origin mainand dispatch deployment digests out of order. Use one group for all publishing runs, not a group keyed bygithub.ref, because both branch and tag runs update the same GitOps branch. Setcancel-in-progress: false.🤖 Prompt for AI Agents
Source: Path instructions