Skip to content

Commit f35dcbc

Browse files
jsf9kjsf9k
authored
Merge pull request #201 from cisagov/improvement/use-job-preamble-action
Apply our standard job preamble via cisagov/action-job-preamble
2 parents b35dec3 + c271b40 commit f35dcbc

File tree

3 files changed

+85
-52
lines changed

3 files changed

+85
-52
lines changed

‎.github/dependabot.yml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,12 @@ updates:
1313
# - dependency-name: actions/checkout
1414
# - dependency-name: actions/setup-go
1515
# - dependency-name: actions/setup-python
16+
# - dependency-name: cisagov/action-job-preamble
1617
# - dependency-name: cisagov/setup-env-github-action
17-
# - dependency-name: crazy-max/ghaction-dump-context
1818
# - dependency-name: crazy-max/ghaction-github-labeler
19-
# - dependency-name: crazy-max/ghaction-github-status
20-
# - dependency-name: GitHubSecurityLab/actions-permissions
2119
# - dependency-name: hashicorp/setup-packer
2220
# - dependency-name: hashicorp/setup-terraform
2321
# - dependency-name: mxschmitt/action-tmate
24-
# - dependency-name: step-security/harden-runner
2522
package-ecosystem: github-actions
2623
schedule:
2724
interval: weekly

‎.github/workflows/build.yml‎

Lines changed: 42 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -36,23 +36,29 @@ jobs:
3636
steps:
3737
# Note that a duplicate of this step must be added at the top of
3838
# each job.
39-
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
39+
- name: Apply standard cisagov job preamble
40+
uses: cisagov/action-job-preamble@v1
4041
with:
41-
# Uses the organization variable unless overridden
42-
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
43-
# Note that a duplicate of this step must be added at the top of
44-
# each job.
45-
- id: harden-runner
46-
name: Harden the runner
47-
uses: step-security/harden-runner@v2
48-
with:
49-
egress-policy: audit
50-
- id: github-status
51-
name: Check GitHub status
52-
uses: crazy-max/ghaction-github-status@v4
53-
- id: dump-context
54-
name: Dump context
55-
uses: crazy-max/ghaction-dump-context@v2
42+
check_github_status: "true"
43+
# This functionality is poorly implemented and has been
44+
# causing a lot of problems due to the MITM implementation
45+
# hogging or leaking memory, so we disable it for now.
46+
monitor_permissions: "false"
47+
output_workflow_context: "true"
48+
# Use a variable to specify the permissions monitoring
49+
# configuration. By default this will yield the
50+
# configuration stored in the cisagov organization-level
51+
# variable, but if you want to use a different configuration
52+
# then simply:
53+
# 1. Create a repository-level variable with the name
54+
# ACTIONS_PERMISSIONS_CONFIG.
55+
# 2. Set this new variable's value to the configuration you
56+
# want to use for this repository.
57+
#
58+
# Note in particular that changing the permissions
59+
# monitoring configuration *does not* require you to modify
60+
# this workflow.
61+
permissions_monitoring_config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
5662
lint:
5763
needs:
5864
- diagnostics
@@ -61,15 +67,27 @@ jobs:
6167
contents: read
6268
runs-on: ubuntu-latest
6369
steps:
64-
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
65-
with:
66-
# Uses the organization variable unless overridden
67-
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
68-
- id: harden-runner
69-
name: Harden the runner
70-
uses: step-security/harden-runner@v2
70+
- name: Apply standard cisagov job preamble
71+
uses: cisagov/action-job-preamble@v1
7172
with:
72-
egress-policy: audit
73+
# This functionality is poorly implemented and has been
74+
# causing a lot of problems due to the MITM implementation
75+
# hogging or leaking memory, so we disable it for now.
76+
monitor_permissions: "false"
77+
# Use a variable to specify the permissions monitoring
78+
# configuration. By default this will yield the
79+
# configuration stored in the cisagov organization-level
80+
# variable, but if you want to use a different configuration
81+
# then simply:
82+
# 1. Create a repository-level variable with the name
83+
# ACTIONS_PERMISSIONS_CONFIG.
84+
# 2. Set this new variable's value to the configuration you
85+
# want to use for this repository.
86+
#
87+
# Note in particular that changing the permissions
88+
# monitoring configuration *does not* require you to modify
89+
# this workflow.
90+
permissions_monitoring_config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
7391
- id: setup-env
7492
uses: cisagov/setup-env-github-action@develop
7593
- uses: actions/checkout@v4

‎.github/workflows/sync-labels.yml‎

Lines changed: 42 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -20,23 +20,29 @@ jobs:
2020
steps:
2121
# Note that a duplicate of this step must be added at the top of
2222
# each job.
23-
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
23+
- name: Apply standard cisagov job preamble
24+
uses: cisagov/action-job-preamble@v1
2425
with:
25-
# Uses the organization variable unless overridden
26-
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
27-
# Note that a duplicate of this step must be added at the top of
28-
# each job.
29-
- id: harden-runner
30-
name: Harden the runner
31-
uses: step-security/harden-runner@v2
32-
with:
33-
egress-policy: audit
34-
- id: github-status
35-
name: Check GitHub status
36-
uses: crazy-max/ghaction-github-status@v4
37-
- id: dump-context
38-
name: Dump context
39-
uses: crazy-max/ghaction-dump-context@v2
26+
check_github_status: "true"
27+
# This functionality is poorly implemented and has been
28+
# causing a lot of problems due to the MITM implementation
29+
# hogging or leaking memory, so we disable it for now.
30+
monitor_permissions: "false"
31+
output_workflow_context: "true"
32+
# Use a variable to specify the permissions monitoring
33+
# configuration. By default this will yield the
34+
# configuration stored in the cisagov organization-level
35+
# variable, but if you want to use a different configuration
36+
# then simply:
37+
# 1. Create a repository-level variable with the name
38+
# ACTIONS_PERMISSIONS_CONFIG.
39+
# 2. Set this new variable's value to the configuration you
40+
# want to use for this repository.
41+
#
42+
# Note in particular that changing the permissions
43+
# monitoring configuration *does not* require you to modify
44+
# this workflow.
45+
permissions_monitoring_config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
4046
labeler:
4147
needs:
4248
- diagnostics
@@ -47,15 +53,27 @@ jobs:
4753
issues: write
4854
runs-on: ubuntu-latest
4955
steps:
50-
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
51-
with:
52-
# Uses the organization variable unless overridden
53-
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
54-
- id: harden-runner
55-
name: Harden the runner
56-
uses: step-security/harden-runner@v2
56+
- name: Apply standard cisagov job preamble
57+
uses: cisagov/action-job-preamble@v1
5758
with:
58-
egress-policy: audit
59+
# This functionality is poorly implemented and has been
60+
# causing a lot of problems due to the MITM implementation
61+
# hogging or leaking memory, so we disable it for now.
62+
monitor_permissions: "false"
63+
# Use a variable to specify the permissions monitoring
64+
# configuration. By default this will yield the
65+
# configuration stored in the cisagov organization-level
66+
# variable, but if you want to use a different configuration
67+
# then simply:
68+
# 1. Create a repository-level variable with the name
69+
# ACTIONS_PERMISSIONS_CONFIG.
70+
# 2. Set this new variable's value to the configuration you
71+
# want to use for this repository.
72+
#
73+
# Note in particular that changing the permissions
74+
# monitoring configuration *does not* require you to modify
75+
# this workflow.
76+
permissions_monitoring_config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
5977
- uses: actions/checkout@v4
6078
- name: Sync repository labels
6179
if: success()

0 commit comments

Comments
 (0)