Skip to content

Commit

Permalink
Remove use of web proxy in workflows
Browse files Browse the repository at this point in the history
The use of a proxy causes the calls to the AWS API that pull Assessor
Workbench files from an S3 bucket to fail.  This is because the AWS
CLI and boto3 both verify all certificates by default, and this is
impossible with a proxy between them and AWS.
  • Loading branch information
jsf9k committed Dec 13, 2024
1 parent e63ba29 commit aed1661
Show file tree
Hide file tree
Showing 3 changed files with 24 additions and 12 deletions.
12 changes: 8 additions & 4 deletions .github/workflows/build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -244,10 +244,14 @@ jobs:
# - arm64
- x86_64
steps:
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
with:
# Uses the organization variable unless overridden
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
# If we use this proxy then the calls to the AWS API to retrieve
# Assessor Workbench files from an S3 bucket fail. For example, this
# Ansible task fails:
# https://github.com/cisagov/ansible-role-assessor-workbench/blob/26ef0a5e7d282f7656eb9687ddb1667b2e386f1b/tasks/main.yml#L11-L18
# - uses: GitHubSecurityLab/actions-permissions/monitor@v1
# with:
# # Uses the organization variable unless overridden
# config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
- id: harden-runner
name: Harden the runner
uses: step-security/harden-runner@v2
Expand Down
12 changes: 8 additions & 4 deletions .github/workflows/prerelease.yml
Original file line number Diff line number Diff line change
Expand Up @@ -51,10 +51,14 @@ jobs:
# - arm64
- x86_64
steps:
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
with:
# Uses the organization variable unless overridden
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
# If we use this proxy then the calls to the AWS API to retrieve
# Assessor Workbench files from an S3 bucket fail. For example, this
# Ansible task fails:
# https://github.com/cisagov/ansible-role-assessor-workbench/blob/26ef0a5e7d282f7656eb9687ddb1667b2e386f1b/tasks/main.yml#L11-L18
# - uses: GitHubSecurityLab/actions-permissions/monitor@v1
# with:
# # Uses the organization variable unless overridden
# config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
- id: harden-runner
name: Harden the runner
uses: step-security/harden-runner@v2
Expand Down
12 changes: 8 additions & 4 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -58,10 +58,14 @@ jobs:
# - arm64
- x86_64
steps:
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
with:
# Uses the organization variable unless overridden
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
# If we use this proxy then the calls to the AWS API to retrieve
# Assessor Workbench files from an S3 bucket fail. For example, this
# Ansible task fails:
# https://github.com/cisagov/ansible-role-assessor-workbench/blob/26ef0a5e7d282f7656eb9687ddb1667b2e386f1b/tasks/main.yml#L11-L18
# - uses: GitHubSecurityLab/actions-permissions/monitor@v1
# with:
# # Uses the organization variable unless overridden
# config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
- id: harden-runner
name: Harden the runner
uses: step-security/harden-runner@v2
Expand Down

0 comments on commit aed1661

Please sign in to comment.