Bryan BeverlyandCursor
36f6f69707
Convert all GitHub Actions uses: refs from mutable tags to immutable SHA pins with version comments. This prevents tag-hijack supply chain attacks while preserving version tracking for Renovate. Part of the org-wide Dependency Strategy Unification (Step 2). Co-authored-by: Cursor <[email protected]>
37 lines
1.1 KiB
YAML
37 lines
1.1 KiB
YAML
name: Run release bot
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
run:
|
|
if: ${{ github.repository == 'trufflesecurity/trufflehog' }}
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Login to GCP
|
|
id: auth
|
|
uses: "google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093" # v3
|
|
with:
|
|
credentials_json: ${{ secrets.GCP_SA_TRUFFLE_RELEASE_BOT }}
|
|
|
|
- name: Login to GAR
|
|
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
|
|
with:
|
|
registry: us-central1-docker.pkg.dev
|
|
username: _json_key
|
|
password: ${{ secrets.GCP_SA_TRUFFLE_RELEASE_BOT }}
|
|
|
|
- name: Run release bot
|
|
env:
|
|
RELEASE_TAG: ${{ github.event.release.tag_name }}
|
|
run: |
|
|
docker run \
|
|
-e GOOGLE_APPLICATION_CREDENTIALS=/tmp/keys/GCP_SA_TRUFFLE_RELEASE_BOT.json \
|
|
-v ${{ steps.auth.outputs.credentials_file_path }}:/tmp/keys/GCP_SA_TRUFFLE_RELEASE_BOT.json:ro \
|
|
us-central1-docker.pkg.dev/truffle-release-bot/releases/bot:latest \
|
|
--repository trufflehog "$RELEASE_TAG"
|