mirror of https://github.com/grafana/grafana
Actions: Reject GH secrets (#105289)
Mariell Hoversholm
2 months ago
committed by
GitHub
parent
65ac0ed3e9
commit
99273f15eb
@ -1,32 +0,0 @@ |
||||
{ |
||||
"queries": [ |
||||
{ |
||||
"name": "type_bug", |
||||
"query": "label:\"type/bug\" is:issue is:open" |
||||
}, |
||||
{ |
||||
"name": "type_docs", |
||||
"query": "label:\"type/docs\" is:issue is:open" |
||||
}, |
||||
{ |
||||
"name": "needs_investigation", |
||||
"query": "label:\"needs investigation\" is:issue is:open" |
||||
}, |
||||
{ |
||||
"name": "needs_more_info", |
||||
"query": "label:\"needs more info\" is:issue is:open" |
||||
}, |
||||
{ |
||||
"name": "triage_needs_confirmation", |
||||
"query": "label:\"triage/needs-confirmation\" is:issue is:open" |
||||
}, |
||||
{ |
||||
"name": "unlabeled", |
||||
"query": "is:open is:issue no:label" |
||||
}, |
||||
{ |
||||
"name": "open_prs", |
||||
"query": "is:open is:pull-request" |
||||
} |
||||
] |
||||
} |
||||
@ -1,54 +0,0 @@ |
||||
# |
||||
# When triggered by the cron job it will also collect metrics for: |
||||
# * number of issues without label |
||||
# * number of issues with "needs more info" |
||||
# * number of issues with "needs investigation" |
||||
# * number of issues with label type/bug |
||||
# * number of open issues in current milestone |
||||
# |
||||
# https://github.com/grafana/grafana-github-actions/blob/main/metrics-collector/index.ts |
||||
# |
||||
name: Github issue metrics collection |
||||
on: |
||||
schedule: |
||||
- cron: "*/10 * * * *" |
||||
issues: |
||||
types: [opened, closed] |
||||
|
||||
permissions: |
||||
contents: read |
||||
|
||||
jobs: |
||||
config: |
||||
runs-on: "ubuntu-latest" |
||||
outputs: |
||||
has-secrets: ${{ steps.check.outputs.has-secrets }} |
||||
steps: |
||||
- name: "Check for secrets" |
||||
id: check |
||||
shell: bash |
||||
run: | |
||||
if [ -n "${{ (secrets.GRAFANA_MISC_STATS_API_KEY != '') || '' }}" ]; then |
||||
echo "has-secrets=1" >> "$GITHUB_OUTPUT" |
||||
fi |
||||
|
||||
main: |
||||
needs: config |
||||
if: needs.config.outputs.has-secrets |
||||
runs-on: ubuntu-latest |
||||
steps: |
||||
- name: Checkout Actions |
||||
uses: actions/checkout@v4 # v4.2.2 |
||||
with: |
||||
repository: "grafana/grafana-github-actions" |
||||
path: ./actions |
||||
ref: main |
||||
persist-credentials: false |
||||
- name: Install Actions |
||||
run: npm install --production --prefix ./actions |
||||
- name: Run metrics collector |
||||
uses: ./actions/metrics-collector |
||||
with: |
||||
metricsWriteAPIKey: ${{secrets.GRAFANA_MISC_STATS_API_KEY}} |
||||
token: ${{secrets.GITHUB_TOKEN}} |
||||
configPath: "metrics-collector" |
||||
@ -0,0 +1,31 @@ |
||||
name: Reject GitHub secrets |
||||
|
||||
on: |
||||
pull_request: |
||||
types: [opened, synchronize, reopened] |
||||
push: |
||||
branches: |
||||
- main |
||||
- release-* |
||||
|
||||
permissions: {} |
||||
|
||||
jobs: |
||||
reject-gh-secrets: |
||||
runs-on: ubuntu-latest |
||||
permissions: |
||||
contents: read |
||||
|
||||
steps: |
||||
- name: Checkout |
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 |
||||
with: |
||||
persist-credentials: false |
||||
|
||||
- name: Grep for secrets accesses |
||||
run: | |
||||
if grep -E '\$\{\{\s*secrets\s*\.\s*[a-zA-Z0-9_\-]+\s*\}\}' .github/workflows/*.yml | grep -vF 'secrets.GITHUB_TOKEN' | grep -vF '# nolint:reject-gh-secrets'; then |
||||
echo "Found secrets access in the codebase. Please remove it in favour of Vault secrets." |
||||
echo "If you are sure this is correct, add '# nolint:reject-gh-secrets' to the end of the line. Be VERY careful with this." |
||||
exit 1 |
||||
fi |
||||
Loading…
Reference in new issue