Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 9003ae0

Browse files
mafredrimafredri
committed
Merge branch 'main' into mafredri/app-audit
2 parents 16ae577 + 27a160d commit 9003ae0

File tree

365 files changed

+5024
-2137
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

365 files changed

+5024
-2137
lines changed

‎.github/ISSUE_TEMPLATE/1-bug.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: "🐞 Bug"
22
description: "File a bug report."
3-
title: "<title>"
3+
title: "bug: "
44
labels: ["needs-triage"]
55
body:
66
- type: checkboxes

‎.github/dependabot.yaml

+2-1
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@ updates:
3737
# Update our Dockerfile.
3838
- package-ecosystem: "docker"
3939
directories:
40-
- "/dogfood/contents"
40+
- "/dogfood/coder"
41+
- "/dogfood/coder-envbuilder"
4142
- "/scripts"
4243
- "/examples/templates/docker/build"
4344
- "/examples/parameters/build"

‎.github/workflows/ci.yaml

+148-2
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ jobs:
172172

173173
- name: Get golangci-lint cache dir
174174
run: |
175-
linter_ver=$(egrep -o 'GOLANGCI_LINT_VERSION=\S+' dogfood/contents/Dockerfile | cut -d '=' -f 2)
175+
linter_ver=$(egrep -o 'GOLANGCI_LINT_VERSION=\S+' dogfood/coder/Dockerfile | cut -d '=' -f 2)
176176
go install github.com/golangci/golangci-lint/cmd/golangci-lint@v$linter_ver
177177
dir=$(golangci-lint cache status | awk '/Dir/ { print $2 }')
178178
echo "LINT_CACHE_DIR=$dir" >> $GITHUB_ENV
@@ -1024,7 +1024,11 @@ jobs:
10241024
# Necessary to push docker images to ghcr.io.
10251025
packages: write
10261026
# Necessary for GCP authentication (https://github.com/google-github-actions/setup-gcloud#usage)
1027+
# Also necessary for keyless cosign (https://docs.sigstore.dev/cosign/signing/overview/)
1028+
# And for GitHub Actions attestation
10271029
id-token: write
1030+
# Required for GitHub Actions attestation
1031+
attestations: write
10281032
env:
10291033
DOCKER_CLI_EXPERIMENTAL: "enabled"
10301034
outputs:
@@ -1041,7 +1045,7 @@ jobs:
10411045
fetch-depth: 0
10421046

10431047
- name: GHCR Login
1044-
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
1048+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
10451049
with:
10461050
registry: ghcr.io
10471051
username: ${{ github.actor }}
@@ -1069,6 +1073,16 @@ jobs:
10691073
- name: Install zstd
10701074
run: sudo apt-get install -y zstd
10711075

1076+
- name: Install cosign
1077+
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
1078+
with:
1079+
cosign-release: "v2.4.3"
1080+
1081+
- name: Install syft
1082+
uses: anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
1083+
with:
1084+
syft-version: "v1.20.0"
1085+
10721086
- name: Setup Windows EV Signing Certificate
10731087
run: |
10741088
set -euo pipefail
@@ -1170,6 +1184,138 @@ jobs:
11701184
done
11711185
fi
11721186
1187+
# GitHub attestation provides SLSA provenance for the Docker images, establishing a verifiable
1188+
# record that these images were built in GitHub Actions with specific inputs and environment.
1189+
# This complements our existing cosign attestations which focus on SBOMs.
1190+
#
1191+
# We attest each tag separately to ensure all tags have proper provenance records.
1192+
# TODO: Consider refactoring these steps to use a matrix strategy or composite action to reduce duplication
1193+
# while maintaining the required functionality for each tag.
1194+
- name: GitHub Attestation for Docker image
1195+
id: attest_main
1196+
if: github.ref == 'refs/heads/main'
1197+
continue-on-error: true
1198+
uses: actions/attest@a63cfcc7d1aab266ee064c58250cfc2c7d07bc31 # v2.2.1
1199+
with:
1200+
subject-name: "ghcr.io/coder/coder-preview:main"
1201+
predicate-type: "https://slsa.dev/provenance/v1"
1202+
predicate: |
1203+
{
1204+
"buildType": "https://github.com/actions/runner-images/",
1205+
"builder": {
1206+
"id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
1207+
},
1208+
"invocation": {
1209+
"configSource": {
1210+
"uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}",
1211+
"digest": {
1212+
"sha1": "${{ github.sha }}"
1213+
},
1214+
"entryPoint": ".github/workflows/ci.yaml"
1215+
},
1216+
"environment": {
1217+
"github_workflow": "${{ github.workflow }}",
1218+
"github_run_id": "${{ github.run_id }}"
1219+
}
1220+
},
1221+
"metadata": {
1222+
"buildInvocationID": "${{ github.run_id }}",
1223+
"completeness": {
1224+
"environment": true,
1225+
"materials": true
1226+
}
1227+
}
1228+
}
1229+
push-to-registry: true
1230+
1231+
- name: GitHub Attestation for Docker image (latest tag)
1232+
id: attest_latest
1233+
if: github.ref == 'refs/heads/main'
1234+
continue-on-error: true
1235+
uses: actions/attest@a63cfcc7d1aab266ee064c58250cfc2c7d07bc31 # v2.2.1
1236+
with:
1237+
subject-name: "ghcr.io/coder/coder-preview:latest"
1238+
predicate-type: "https://slsa.dev/provenance/v1"
1239+
predicate: |
1240+
{
1241+
"buildType": "https://github.com/actions/runner-images/",
1242+
"builder": {
1243+
"id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
1244+
},
1245+
"invocation": {
1246+
"configSource": {
1247+
"uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}",
1248+
"digest": {
1249+
"sha1": "${{ github.sha }}"
1250+
},
1251+
"entryPoint": ".github/workflows/ci.yaml"
1252+
},
1253+
"environment": {
1254+
"github_workflow": "${{ github.workflow }}",
1255+
"github_run_id": "${{ github.run_id }}"
1256+
}
1257+
},
1258+
"metadata": {
1259+
"buildInvocationID": "${{ github.run_id }}",
1260+
"completeness": {
1261+
"environment": true,
1262+
"materials": true
1263+
}
1264+
}
1265+
}
1266+
push-to-registry: true
1267+
1268+
- name: GitHub Attestation for version-specific Docker image
1269+
id: attest_version
1270+
if: github.ref == 'refs/heads/main'
1271+
continue-on-error: true
1272+
uses: actions/attest@a63cfcc7d1aab266ee064c58250cfc2c7d07bc31 # v2.2.1
1273+
with:
1274+
subject-name: "ghcr.io/coder/coder-preview:${{ steps.build-docker.outputs.tag }}"
1275+
predicate-type: "https://slsa.dev/provenance/v1"
1276+
predicate: |
1277+
{
1278+
"buildType": "https://github.com/actions/runner-images/",
1279+
"builder": {
1280+
"id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
1281+
},
1282+
"invocation": {
1283+
"configSource": {
1284+
"uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}",
1285+
"digest": {
1286+
"sha1": "${{ github.sha }}"
1287+
},
1288+
"entryPoint": ".github/workflows/ci.yaml"
1289+
},
1290+
"environment": {
1291+
"github_workflow": "${{ github.workflow }}",
1292+
"github_run_id": "${{ github.run_id }}"
1293+
}
1294+
},
1295+
"metadata": {
1296+
"buildInvocationID": "${{ github.run_id }}",
1297+
"completeness": {
1298+
"environment": true,
1299+
"materials": true
1300+
}
1301+
}
1302+
}
1303+
push-to-registry: true
1304+
1305+
# Report attestation failures but don't fail the workflow
1306+
- name: Check attestation status
1307+
if: github.ref == 'refs/heads/main'
1308+
run: |
1309+
if [[ "${{ steps.attest_main.outcome }}" == "failure" ]]; then
1310+
echo "::warning::GitHub attestation for main tag failed"
1311+
fi
1312+
if [[ "${{ steps.attest_latest.outcome }}" == "failure" ]]; then
1313+
echo "::warning::GitHub attestation for latest tag failed"
1314+
fi
1315+
if [[ "${{ steps.attest_version.outcome }}" == "failure" ]]; then
1316+
echo "::warning::GitHub attestation for version-specific tag failed"
1317+
fi
1318+
11731319
- name: Prune old images
11741320
if: github.ref == 'refs/heads/main'
11751321
uses: vlaurin/action-ghcr-prune@0cf7d39f88546edd31965acba78cdcb0be14d641 # v0.6.0

‎.github/workflows/docker-base.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4747

4848
- name: Docker login
49-
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
49+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
5050
with:
5151
registry: ghcr.io
5252
username: ${{ github.actor }}

‎.github/workflows/docs-ci.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
- name: Setup Node
2929
uses: ./.github/actions/setup-node
3030

31-
- uses: tj-actions/changed-files@dcc7a0cba800f454d79fff4b993e8c3555bcc0a8 # v45.0.7
31+
- uses: tj-actions/changed-files@531f5f7d163941f0c1c04e0ff4d8bb243ac4366f # v45.0.7
3232
id: changed-files
3333
with:
3434
files: |

‎.github/workflows/dogfood.yaml

+33-8
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,26 @@ jobs:
3535
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3636

3737
- name: Setup Nix
38-
uses: DeterminateSystems/nix-installer-action@e50d5f73bfe71c2dd0aa4218de8f4afa59f8f81d # v16
38+
uses: nixbuild/nix-quick-install-action@5bb6a3b3abe66fd09bbf250dce8ada94f856a703 # v30
39+
40+
- uses: nix-community/cache-nix-action@c448f065ba14308da81de769632ca67a3ce67cf5 # v6.1.2
41+
with:
42+
# restore and save a cache using this key
43+
primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
44+
# if there's no cache hit, restore a cache by this prefix
45+
restore-prefixes-first-match: nix-${{ runner.os }}-
46+
# collect garbage until Nix store size (in bytes) is at most this number
47+
# before trying to save a new cache
48+
# 1G = 1073741824
49+
gc-max-store-size-linux: 5G
50+
# do purge caches
51+
purge: true
52+
# purge all versions of the cache
53+
purge-prefixes: nix-${{ runner.os }}-
54+
# created more than this number of seconds ago relative to the start of the `Post Restore` phase
55+
purge-created: 0
56+
# except the version with the `primary-key`, if it exists
57+
purge-primary-key: never
3958

4059
- name: Get branch name
4160
id: branch-name
@@ -57,7 +76,7 @@ jobs:
5776

5877
- name: Login to DockerHub
5978
if: github.ref == 'refs/heads/main'
60-
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
79+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
6180
with:
6281
username: ${{ secrets.DOCKERHUB_USERNAME }}
6382
password: ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -68,7 +87,7 @@ jobs:
6887
project: b4q6ltmpzh
6988
token: ${{ secrets.DEPOT_TOKEN }}
7089
buildx-fallback: true
71-
context: "{{defaultContext}}:dogfood/contents"
90+
context: "{{defaultContext}}:dogfood/coder"
7291
pull: true
7392
save: true
7493
push: ${{ github.ref == 'refs/heads/main' }}
@@ -113,12 +132,18 @@ jobs:
113132

114133
- name: Terraform init and validate
115134
run: |
116-
cd dogfood
117-
terraform init -upgrade
135+
pushd dogfood/
136+
terraform init
137+
terraform validate
138+
popd
139+
pushd dogfood/coder
140+
terraform init
118141
terraform validate
119-
cd contents
120-
terraform init -upgrade
142+
popd
143+
pushd dogfood/coder-envbuilder
144+
terraform init
121145
terraform validate
146+
popd
122147
123148
- name: Get short commit SHA
124149
if: github.ref == 'refs/heads/main'
@@ -142,6 +167,6 @@ jobs:
142167
# Template source & details
143168
TF_VAR_CODER_TEMPLATE_NAME: ${{ secrets.CODER_TEMPLATE_NAME }}
144169
TF_VAR_CODER_TEMPLATE_VERSION: ${{ steps.vars.outputs.sha_short }}
145-
TF_VAR_CODER_TEMPLATE_DIR: ./contents
170+
TF_VAR_CODER_TEMPLATE_DIR: ./coder
146171
TF_VAR_CODER_TEMPLATE_MESSAGE: ${{ steps.message.outputs.pr_title }}
147172
TF_LOG: info

‎.github/workflows/pr-deploy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -237,7 +237,7 @@ jobs:
237237
uses: ./.github/actions/setup-sqlc
238238

239239
- name: GHCR Login
240-
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
240+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
241241
with:
242242
registry: ghcr.io
243243
username: ${{ github.actor }}

0 commit comments

Comments
 (0)