mirror of https://github.com/grafana/grafana
CI: remove unused worklow; use GITHUB_TOKEN where possible (#104657)
* remove unused worklow; use GITHUB_TOKEN where possible * pin usages of checkout and setup-go * Fix zizmor errors * add zizmor.yml * fix `changelog.yml` * fix `core-plugins-build-and-release.yml` * fix `release-comms.yml` * update release-pr.yml and run-e2e-suite.yml * Fix errors in files outside of .github/workflows * Remove path filter on zizmor.yml --------- Co-authored-by: Sven Grossmann <svennergr@gmail.com> Co-authored-by: joshhunt <josh.hunt@grafana.com>pull/104716/head
Kevin Minehart
3 months ago
committed by
GitHub
parent
97a1614cde
commit
97d10b5095
@ -1,44 +0,0 @@ |
||||
name: Close milestone |
||||
on: |
||||
workflow_dispatch: |
||||
inputs: |
||||
version: |
||||
required: true |
||||
description: Needs to match, exactly, the name of a milestone |
||||
workflow_call: |
||||
inputs: |
||||
version_call: |
||||
description: Needs to match, exactly, the name of a milestone |
||||
required: true |
||||
type: string |
||||
|
||||
jobs: |
||||
main: |
||||
if: github.repository == 'grafana/grafana' |
||||
runs-on: ubuntu-latest |
||||
steps: |
||||
- name: Checkout Actions |
||||
uses: actions/checkout@v4 |
||||
with: |
||||
repository: "grafana/grafana-github-actions" |
||||
path: ./actions |
||||
ref: main |
||||
- name: Install Actions |
||||
run: npm install --production --prefix ./actions |
||||
- name: "Generate token" |
||||
id: generate_token |
||||
uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92 |
||||
with: |
||||
app_id: ${{ secrets.GRAFANA_DELIVERY_BOT_APP_ID }} |
||||
private_key: ${{ secrets.GRAFANA_DELIVERY_BOT_APP_PEM }} |
||||
- name: Close milestone (manually invoked) |
||||
if: ${{ github.event.inputs.version != '' }} |
||||
uses: ./actions/close-milestone |
||||
with: |
||||
token: ${{ steps.generate_token.outputs.token }} |
||||
- name: Close milestone (workflow invoked) |
||||
if: ${{ inputs.version_call != '' }} |
||||
uses: ./actions/close-milestone |
||||
with: |
||||
version_call: ${{ inputs.version_call }} |
||||
token: ${{ steps.generate_token.outputs.token }} |
||||
@ -1,19 +0,0 @@ |
||||
name: Close Milestone |
||||
on: |
||||
workflow_dispatch: |
||||
inputs: |
||||
version_input: |
||||
description: 'The version to be released please respect: major.minor.patch, major.minor.patch-preview or major.minor.patch-preview<number> format. example: 7.4.3, 7.4.3-preview or 7.4.3-preview1' |
||||
required: true |
||||
jobs: |
||||
call-remove-milestone: |
||||
uses: grafana/grafana/.github/workflows/remove-milestone.yml@main |
||||
with: |
||||
version_call: ${{ github.event.inputs.version_input }} |
||||
secrets: inherit |
||||
call-close-milestone: |
||||
uses: grafana/grafana/.github/workflows/close-milestone.yml@main |
||||
with: |
||||
version_call: ${{ github.event.inputs.version_input }} |
||||
secrets: inherit |
||||
needs: call-remove-milestone |
||||
@ -1,60 +0,0 @@ |
||||
name: Remove milestone |
||||
on: |
||||
workflow_dispatch: |
||||
inputs: |
||||
version: |
||||
required: true |
||||
description: Needs to match, exactly, the name of a milestone |
||||
workflow_call: |
||||
inputs: |
||||
version_call: |
||||
description: Needs to match, exactly, the name of a milestone |
||||
required: true |
||||
type: string |
||||
|
||||
jobs: |
||||
config: |
||||
runs-on: "ubuntu-latest" |
||||
outputs: |
||||
has-secrets: ${{ steps.check.outputs.has-secrets }} |
||||
steps: |
||||
- name: "Check for secrets" |
||||
id: check |
||||
shell: bash |
||||
run: | |
||||
if [ -n "${{ (secrets.GRAFANA_DELIVERY_BOT_APP_ID != '' && secrets.GRAFANA_DELIVERY_BOT_APP_PEM != '') || '' }}" ]; then |
||||
echo "has-secrets=1" >> "$GITHUB_OUTPUT" |
||||
fi |
||||
|
||||
main: |
||||
needs: config |
||||
if: needs.config.outputs.has-secrets |
||||
permissions: |
||||
issues: write |
||||
runs-on: ubuntu-latest |
||||
steps: |
||||
- name: Checkout Actions |
||||
uses: actions/checkout@v4 |
||||
with: |
||||
repository: "grafana/grafana-github-actions" |
||||
path: ./actions |
||||
ref: main |
||||
- name: Install Actions |
||||
run: npm install --production --prefix ./actions |
||||
- name: "Generate token" |
||||
id: generate_token |
||||
uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92 |
||||
with: |
||||
app_id: ${{ secrets.GRAFANA_DELIVERY_BOT_APP_ID }} |
||||
private_key: ${{ secrets.GRAFANA_DELIVERY_BOT_APP_PEM }} |
||||
- name: Remove milestone from open issues (manually invoked) |
||||
if: ${{ github.event.inputs.version != '' }} |
||||
uses: ./actions/remove-milestone |
||||
with: |
||||
token: ${{ steps.generate_token.outputs.token }} |
||||
- name: Remove milestone from open issues (workflow invoked) |
||||
if: ${{ inputs.version_call != '' }} |
||||
uses: ./actions/remove-milestone |
||||
with: |
||||
version_call: ${{ inputs.version_call }} |
||||
token: ${{ steps.generate_token.outputs.token }} |
||||
@ -1,52 +0,0 @@ |
||||
name: Update changelog |
||||
on: |
||||
workflow_dispatch: |
||||
inputs: |
||||
version: |
||||
required: true |
||||
description: 'Needs to match, exactly, the name of a milestone. The version to be released please respect: major.minor.patch, major.minor.patch-preview or major.minor.patch-preview<number> format. example: 7.4.3, 7.4.3-preview or 7.4.3-preview1' |
||||
skip_pr: |
||||
required: false |
||||
default: "0" |
||||
skip_community_post: |
||||
required: false |
||||
default: "0" |
||||
jobs: |
||||
config: |
||||
runs-on: "ubuntu-latest" |
||||
outputs: |
||||
has-secrets: ${{ steps.check.outputs.has-secrets }} |
||||
steps: |
||||
- name: "Check for secrets" |
||||
id: check |
||||
shell: bash |
||||
run: | |
||||
if [ -n "${{ (secrets.GRAFANA_DELIVERY_BOT_APP_ID != '' && |
||||
secrets.GRAFANA_DELIVERY_BOT_APP_PEM != '' && |
||||
secrets.GRAFANA_MISC_STATS_API_KEY != '' && |
||||
secrets.GRAFANABOT_FORUM_KEY != '' |
||||
) || '' }}" ]; then |
||||
echo "has-secrets=1" >> "$GITHUB_OUTPUT" |
||||
fi |
||||
|
||||
main: |
||||
needs: config |
||||
if: needs.config.outputs.has-secrets |
||||
runs-on: ubuntu-latest |
||||
steps: |
||||
- name: "Generate token" |
||||
id: generate_token |
||||
uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92 |
||||
with: |
||||
app_id: ${{ secrets.GRAFANA_DELIVERY_BOT_APP_ID }} |
||||
private_key: ${{ secrets.GRAFANA_DELIVERY_BOT_APP_PEM }} |
||||
- name: Run update changelog (manually invoked) |
||||
uses: grafana/grafana-github-actions-go/update-changelog@main |
||||
with: |
||||
token: ${{ steps.generate_token.outputs.token }} |
||||
version: ${{ inputs.version }} |
||||
metrics_api_key: ${{ secrets.GRAFANA_MISC_STATS_API_KEY }} |
||||
community_api_key: ${{ secrets.GRAFANABOT_FORUM_KEY }} |
||||
community_api_username: grafanabot |
||||
skip_pr: ${{ inputs.skip_pr }} |
||||
skip_community_post: ${{ inputs.skip_community_post }} |
||||
@ -0,0 +1,31 @@ |
||||
rules: |
||||
unpinned-uses: |
||||
config: |
||||
policies: |
||||
"*": hash-pin |
||||
actions/*: any |
||||
github/*: any |
||||
grafana/*: any |
||||
forbidden-uses: |
||||
config: |
||||
deny: |
||||
# Policy-banned by our security team due to CVE-2025-30066 & CVE-2025-30154. |
||||
# https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction |
||||
# https://nvd.nist.gov/vuln/detail/cve-2025-30066 |
||||
# https://nvd.nist.gov/vuln/detail/cve-2025-30154 |
||||
- reviewdog/* |
||||
cache-poisoning: |
||||
ignore: |
||||
- backend-unit-tests.yml |
||||
- frontend-lint.yml |
||||
- pr-frontend-unit-tests.yml |
||||
- pr-test-integration.yml |
||||
- publish-kinds-release.yml |
||||
dangerous-triggers: |
||||
ignore: |
||||
- auto-milestone.yml |
||||
- backport.yml |
||||
- pr-checks.yml |
||||
- pr-commands.yml |
||||
- pr-patch-check-event.yml |
||||
- run-dashboard-search-e2e.yml |
||||
Loading…
Reference in new issue