From b6b73a9b7e7f40fe72227706af28c481422528a3 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Mon, 12 Oct 2026 12:37:55 -0600 Subject: [PATCH 1/7] chore: update sha hash pins Signed-off-by: Sean Tronsen --- .github/workflows/build.yml | 4 ++-- .github/workflows/cleanup.yml | 2 +- .github/workflows/dependency-review.yml | 2 +- .github/workflows/govulncheck.yml | 2 +- .github/workflows/lint.yml | 4 ++-- .github/workflows/release.yml | 8 ++++---- .github/workflows/reuse.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/stale.yml | 2 +- .github/workflows/test.yml | 2 +- 10 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f96a7b4..12cfd12 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -14,13 +14,13 @@ permissions: jobs: goreleaser: - uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod validate: needs: goreleaser - uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - name: testbed-quadlet*.rpm diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index a94f259..b09d805 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -14,4 +14,4 @@ permissions: jobs: cleanup: - uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 5e3b672..7533d33 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -10,7 +10,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout pull-requests: write # summary comment on the PR diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index 166afeb..52a8a2d 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -13,7 +13,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) govulncheck: if: ${{ always() }} diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index f2ba4de..795e19f 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -16,12 +16,12 @@ permissions: jobs: lint-go: - uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod lint-ci: - uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout security-events: write # zizmor SARIF upload to GHAS diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6950544..97b8554 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -43,7 +43,7 @@ jobs: packages: write # image push, container provenance id-token: write # Sigstore signing (attest-build-provenance) attestations: write # build provenance attestations - uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod registry-subject-name: ghcr.io/openchami/github-actions-testbed @@ -54,7 +54,7 @@ jobs: # Fork PRs build but don't push, so there is no image to scan. needs: goreleaser if: ${{ needs.goreleaser.outputs.digest != '' }} - uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout security-events: write # SARIF upload to GHAS @@ -66,7 +66,7 @@ jobs: # PR builds produce no packages (they're validated in build.yml). if: ${{ github.event_name == 'push' }} needs: goreleaser - uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - name: testbed-quadlet*.rpm @@ -91,4 +91,4 @@ jobs: needs: [goreleaser, validate] permissions: contents: write # publish the draft GitHub Release - uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index 57e41ae..53e1679 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -12,7 +12,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) reuse: if: ${{ always() }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 14b36d4..b075534 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -19,7 +19,7 @@ jobs: contents: read # baseline for checkout security-events: write # SARIF upload to GHAS id-token: write # publish results to the OpenSSF dashboard - uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) scorecard: if: ${{ always() }} diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index e02ba6b..780b04c 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -12,7 +12,7 @@ permissions: jobs: stale: - uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) permissions: issues: write # label, comment on, and close stale issues pull-requests: write # label, comment on, and close stale PRs diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index ad875cf..2f04897 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -18,7 +18,7 @@ permissions: jobs: test-unit-go: - uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod coverage: true From b5812f93201f4c18bb31c9a3cf9014d5b007f3e2 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Mon, 12 Oct 2026 12:38:28 -0600 Subject: [PATCH 2/7] feat: configure testing for actions PR 41 Signed-off-by: Sean Tronsen --- .github/workflows/build.yml | 13 +++---------- .github/workflows/release.yml | 13 +++---------- 2 files changed, 6 insertions(+), 20 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 12cfd12..cd89dd4 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -23,21 +23,14 @@ jobs: uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - - name: testbed-quadlet*.rpm + - name: testbed-quadlet* files: - - /etc/openchami - - /etc/openchami/configs - /etc/openchami/configs/testbed.yaml - /usr/share/containers/systemd/testbed.container - - /usr/share/containers/systemd/testbed.container.d - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf - - /usr/share/licenses/testbed-quadlet + rpm-files: - /usr/share/licenses/testbed-quadlet/MIT.txt - - name: testbed-quadlet*.deb - files: - - /etc/openchami/configs/testbed.yaml - - /usr/share/containers/systemd/testbed.container - - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf + deb-files: - /usr/share/doc/testbed-quadlet/copyright build: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 97b8554..f1f5364 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -69,21 +69,14 @@ jobs: uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - - name: testbed-quadlet*.rpm + - name: testbed-quadlet* files: - - /etc/openchami - - /etc/openchami/configs - /etc/openchami/configs/testbed.yaml - /usr/share/containers/systemd/testbed.container - - /usr/share/containers/systemd/testbed.container.d - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf - - /usr/share/licenses/testbed-quadlet + rpm-files: - /usr/share/licenses/testbed-quadlet/MIT.txt - - name: testbed-quadlet*.deb - files: - - /etc/openchami/configs/testbed.yaml - - /usr/share/containers/systemd/testbed.container - - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf + deb-files: - /usr/share/doc/testbed-quadlet/copyright publish: From 214c6f97f712bd631db5127dae67780505d7162f Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Mon, 12 Oct 2026 12:49:01 -0600 Subject: [PATCH 3/7] feat: add package file list testing for arch-specific binary packages Signed-off-by: Sean Tronsen --- .github/workflows/build.yml | 8 ++++++++ .github/workflows/release.yml | 8 ++++++++ .goreleaser.yaml | 29 +++++++++++++++++++++++++++++ 3 files changed, 45 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index cd89dd4..42eff4c 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -32,6 +32,14 @@ jobs: - /usr/share/licenses/testbed-quadlet/MIT.txt deb-files: - /usr/share/doc/testbed-quadlet/copyright + # Per-arch binary package; `[-_][0-9]` keeps it from matching testbed-quadlet. + - name: testbed[-_][0-9]* + files: + - /usr/bin/testbed + rpm-files: + - /usr/share/licenses/testbed/MIT.txt + deb-files: + - /usr/share/doc/testbed/copyright build: if: ${{ always() }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f1f5364..5cee23a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -78,6 +78,14 @@ jobs: - /usr/share/licenses/testbed-quadlet/MIT.txt deb-files: - /usr/share/doc/testbed-quadlet/copyright + # Per-arch binary package; `[-_][0-9]` keeps it from matching testbed-quadlet. + - name: testbed[-_][0-9]* + files: + - /usr/bin/testbed + rpm-files: + - /usr/share/licenses/testbed/MIT.txt + deb-files: + - /usr/share/doc/testbed/copyright publish: if: ${{ github.event_name == 'push' }} diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 6feb306..28df765 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -115,6 +115,35 @@ nfpms: rpm: signature: key_file: "{{ .Env.GPG_KEY_PATH }}" + # Binary package: one per goarch, so a single package glob matches several + # files across architectures. + - id: testbed + package_name: testbed + ids: [testbed] + formats: [rpm, deb] + file_name_template: "{{ .ConventionalFileName }}" + vendor: OpenCHAMI + homepage: https://github.com/OpenCHAMI/github-actions-testbed + maintainer: "Sean Tronsen " + description: Test binary package for the OpenCHAMI github-actions workflows. + license: MIT + section: admin + contents: + - src: LICENSES/MIT.txt + dst: /usr/share/licenses/testbed/MIT.txt + type: license + packager: rpm + - src: packaging/deb/copyright + dst: /usr/share/doc/testbed/copyright + packager: deb + overrides: + rpm: + release: "1.el9" + deb: + release: "1" + rpm: + signature: + key_file: "{{ .Env.GPG_KEY_PATH }}" release: disable: '{{ if eq .Env.IS_PR_BUILD "true" }}true{{ else }}false{{ end }}' From ef851d4bc692df4b257e86af3b887d4c51626375 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Mon, 12 Oct 2026 12:57:34 -0600 Subject: [PATCH 4/7] chore: bump workflow digests Signed-off-by: Sean Tronsen --- .github/workflows/build.yml | 4 ++-- .github/workflows/cleanup.yml | 2 +- .github/workflows/dependency-review.yml | 2 +- .github/workflows/govulncheck.yml | 2 +- .github/workflows/lint.yml | 4 ++-- .github/workflows/release.yml | 8 ++++---- .github/workflows/reuse.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/stale.yml | 2 +- .github/workflows/test.yml | 2 +- 10 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 42eff4c..61db8ac 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -14,13 +14,13 @@ permissions: jobs: goreleaser: - uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod validate: needs: goreleaser - uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - name: testbed-quadlet* diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index b09d805..d25fbcc 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -14,4 +14,4 @@ permissions: jobs: cleanup: - uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 7533d33..352e3bc 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -10,7 +10,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout pull-requests: write # summary comment on the PR diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index 52a8a2d..c484b6b 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -13,7 +13,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) govulncheck: if: ${{ always() }} diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 795e19f..e875f5e 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -16,12 +16,12 @@ permissions: jobs: lint-go: - uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod lint-ci: - uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout security-events: write # zizmor SARIF upload to GHAS diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5cee23a..95f6e58 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -43,7 +43,7 @@ jobs: packages: write # image push, container provenance id-token: write # Sigstore signing (attest-build-provenance) attestations: write # build provenance attestations - uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod registry-subject-name: ghcr.io/openchami/github-actions-testbed @@ -54,7 +54,7 @@ jobs: # Fork PRs build but don't push, so there is no image to scan. needs: goreleaser if: ${{ needs.goreleaser.outputs.digest != '' }} - uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout security-events: write # SARIF upload to GHAS @@ -66,7 +66,7 @@ jobs: # PR builds produce no packages (they're validated in build.yml). if: ${{ github.event_name == 'push' }} needs: goreleaser - uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - name: testbed-quadlet* @@ -92,4 +92,4 @@ jobs: needs: [goreleaser, validate] permissions: contents: write # publish the draft GitHub Release - uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index 53e1679..2d0378b 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -12,7 +12,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) reuse: if: ${{ always() }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b075534..f035545 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -19,7 +19,7 @@ jobs: contents: read # baseline for checkout security-events: write # SARIF upload to GHAS id-token: write # publish results to the OpenSSF dashboard - uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) scorecard: if: ${{ always() }} diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 780b04c..27b4dcc 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -12,7 +12,7 @@ permissions: jobs: stale: - uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) permissions: issues: write # label, comment on, and close stale issues pull-requests: write # label, comment on, and close stale PRs diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 2f04897..f700984 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -18,7 +18,7 @@ permissions: jobs: test-unit-go: - uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@ed7b2c6979b2bd98f3fc4a18a60c674d7d085964 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod coverage: true From 2a71d7145ca11b93709424f144069ecbf6d52075 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Mon, 12 Oct 2026 13:20:05 -0600 Subject: [PATCH 5/7] chore: bump shas Signed-off-by: Sean Tronsen --- .github/workflows/build.yml | 4 ++-- .github/workflows/cleanup.yml | 2 +- .github/workflows/dependency-review.yml | 2 +- .github/workflows/govulncheck.yml | 2 +- .github/workflows/lint.yml | 4 ++-- .github/workflows/release.yml | 8 ++++---- .github/workflows/reuse.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/stale.yml | 2 +- .github/workflows/test.yml | 2 +- 10 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 61db8ac..7d519aa 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -14,13 +14,13 @@ permissions: jobs: goreleaser: - uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod validate: needs: goreleaser - uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - name: testbed-quadlet* diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index d25fbcc..48ec3a5 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -14,4 +14,4 @@ permissions: jobs: cleanup: - uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 352e3bc..4ff954f 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -10,7 +10,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout pull-requests: write # summary comment on the PR diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index c484b6b..89daebb 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -13,7 +13,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) govulncheck: if: ${{ always() }} diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index e875f5e..44b7bc4 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -16,12 +16,12 @@ permissions: jobs: lint-go: - uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod lint-ci: - uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout security-events: write # zizmor SARIF upload to GHAS diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 95f6e58..cb50356 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -43,7 +43,7 @@ jobs: packages: write # image push, container provenance id-token: write # Sigstore signing (attest-build-provenance) attestations: write # build provenance attestations - uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod registry-subject-name: ghcr.io/openchami/github-actions-testbed @@ -54,7 +54,7 @@ jobs: # Fork PRs build but don't push, so there is no image to scan. needs: goreleaser if: ${{ needs.goreleaser.outputs.digest != '' }} - uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout security-events: write # SARIF upload to GHAS @@ -66,7 +66,7 @@ jobs: # PR builds produce no packages (they're validated in build.yml). if: ${{ github.event_name == 'push' }} needs: goreleaser - uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - name: testbed-quadlet* @@ -92,4 +92,4 @@ jobs: needs: [goreleaser, validate] permissions: contents: write # publish the draft GitHub Release - uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index 2d0378b..3a9fd98 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -12,7 +12,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) reuse: if: ${{ always() }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f035545..ab384f7 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -19,7 +19,7 @@ jobs: contents: read # baseline for checkout security-events: write # SARIF upload to GHAS id-token: write # publish results to the OpenSSF dashboard - uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) scorecard: if: ${{ always() }} diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 27b4dcc..dd89a47 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -12,7 +12,7 @@ permissions: jobs: stale: - uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) permissions: issues: write # label, comment on, and close stale issues pull-requests: write # label, comment on, and close stale PRs diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f700984..30f9c68 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -18,7 +18,7 @@ permissions: jobs: test-unit-go: - uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@e8e8c4966a61aac37a200c53c670ce58146cdfbf # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod coverage: true From 5db01f306ca52f023968d619fe826fab09c0e916 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Mon, 12 Oct 2026 13:20:31 -0600 Subject: [PATCH 6/7] feat: add PR 41 testing for multiple named images Signed-off-by: Sean Tronsen --- .github/workflows/release.yml | 1 - .goreleaser.yaml | 21 +++++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cb50356..0476d5e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -46,7 +46,6 @@ jobs: uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod - registry-subject-name: ghcr.io/openchami/github-actions-testbed secrets: gpg-key: ${{ github.event_name == 'push' && needs.test-key.outputs.gpg-key-b64 || '' }} diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 28df765..76d6603 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -60,6 +60,27 @@ dockers_v2: org.opencontainers.image.revision: "{{ .FullCommit }}" org.opencontainers.image.created: "{{ .Date }}" org.opencontainers.image.source: https://github.com/OpenCHAMI/github-actions-testbed + # Second, distinctly named image (different title label, so a different + # digest) to exercise per-image attestation. + - id: testbed-alt + ids: [testbed] + dockerfile: Dockerfile + images: + - ghcr.io/openchami/github-actions-testbed-alt + tags: + - "{{ .Tag }}" # vX.Y.Z or pr-N + - '{{ if ne .Env.IS_PR_BUILD "true" }}{{ .Major }}.{{ .Minor }}{{ end }}' + - '{{ if ne .Env.IS_PR_BUILD "true" }}{{ .Major }}{{ end }}' + - '{{ if ne .Env.IS_PR_BUILD "true" }}latest{{ end }}' + platforms: + - linux/amd64 + - linux/arm64 + labels: + org.opencontainers.image.title: "{{ .ProjectName }}-alt" + org.opencontainers.image.version: "{{ .Version }}" + org.opencontainers.image.revision: "{{ .FullCommit }}" + org.opencontainers.image.created: "{{ .Date }}" + org.opencontainers.image.source: https://github.com/OpenCHAMI/github-actions-testbed nfpms: - id: testbed-quadlet From 1cbb6266663901e9cc0924062a737c74ccaab257 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Mon, 12 Oct 2026 13:24:14 -0600 Subject: [PATCH 7/7] chore: bump shas Signed-off-by: Sean Tronsen --- .github/workflows/build.yml | 4 ++-- .github/workflows/cleanup.yml | 2 +- .github/workflows/dependency-review.yml | 2 +- .github/workflows/govulncheck.yml | 2 +- .github/workflows/lint.yml | 4 ++-- .github/workflows/release.yml | 8 ++++---- .github/workflows/reuse.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/stale.yml | 2 +- .github/workflows/test.yml | 2 +- 10 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 7d519aa..09b04e0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -14,13 +14,13 @@ permissions: jobs: goreleaser: - uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod validate: needs: goreleaser - uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - name: testbed-quadlet* diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index 48ec3a5..b30808a 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -14,4 +14,4 @@ permissions: jobs: cleanup: - uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 4ff954f..2f42c1f 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -10,7 +10,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout pull-requests: write # summary comment on the PR diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index 89daebb..472a931 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -13,7 +13,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) govulncheck: if: ${{ always() }} diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 44b7bc4..27451c7 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -16,12 +16,12 @@ permissions: jobs: lint-go: - uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod lint-ci: - uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout security-events: write # zizmor SARIF upload to GHAS diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0476d5e..ae4a60a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -43,7 +43,7 @@ jobs: packages: write # image push, container provenance id-token: write # Sigstore signing (attest-build-provenance) attestations: write # build provenance attestations - uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod secrets: @@ -53,7 +53,7 @@ jobs: # Fork PRs build but don't push, so there is no image to scan. needs: goreleaser if: ${{ needs.goreleaser.outputs.digest != '' }} - uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout security-events: write # SARIF upload to GHAS @@ -65,7 +65,7 @@ jobs: # PR builds produce no packages (they're validated in build.yml). if: ${{ github.event_name == 'push' }} needs: goreleaser - uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - name: testbed-quadlet* @@ -91,4 +91,4 @@ jobs: needs: [goreleaser, validate] permissions: contents: write # publish the draft GitHub Release - uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index 3a9fd98..8bea6d5 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -12,7 +12,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) reuse: if: ${{ always() }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ab384f7..32d83d0 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -19,7 +19,7 @@ jobs: contents: read # baseline for checkout security-events: write # SARIF upload to GHAS id-token: write # publish results to the OpenSSF dashboard - uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) scorecard: if: ${{ always() }} diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index dd89a47..a8ac2f9 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -12,7 +12,7 @@ permissions: jobs: stale: - uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) permissions: issues: write # label, comment on, and close stale issues pull-requests: write # label, comment on, and close stale PRs diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 30f9c68..276392c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -18,7 +18,7 @@ permissions: jobs: test-unit-go: - uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@ebefc849e9e8069cf53b97e7fdd4b4ac8d3c2067 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod coverage: true