From e066355d7a2ec7291980b6ddec4f95243937339d Mon Sep 17 00:00:00 2001 From: Petr Ruzicka Date: Sun, 24 Mar 2024 12:06:00 +0530 Subject: [PATCH] feat(gh): add default GitHub repo files (#163) --- .github/renovate.json5 | 4 +++- .github/workflows/links.yml | 4 ++-- .github/workflows/mega-linter.yml | 5 +++-- .github/workflows/release-please.yml | 7 +++++++ .github/workflows/renovate.yml | 8 ++++---- .github/workflows/semantic-pull-request.yml | 9 ++++++++- .github/workflows/stale.yml | 1 + .github/workflows/vuepress-build.yml | 2 +- .trivyignore.yaml | 18 ++++++++---------- 9 files changed, 37 insertions(+), 21 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 1117e58a..1a306362 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -1,14 +1,16 @@ { $schema: "https://docs.renovatebot.com/renovate-schema.json", + // Keep the extends started with ":" at the end of the list to allow overriding extends: [ "config:recommended", "docker:pinDigests", "helpers:pinGitHubActionDigestsToSemver", "security:openssf-scorecard", ":disableDependencyDashboard", - ":docker", ":disableRateLimiting", + ":docker", ":enableVulnerabilityAlertsWithLabel(security)", + ":pinSkipCi", ], "git-submodules": { enabled: true, diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml index f2d07cf4..2535188b 100644 --- a/.github/workflows/links.yml +++ b/.github/workflows/links.yml @@ -24,7 +24,7 @@ jobs: uses: actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d # v4.0.0 - name: Restore lychee cache - uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1 + uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 with: path: .lycheecache key: cache-lychee-${{ github.sha }} @@ -35,5 +35,5 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} uses: lycheeverse/lychee-action@c053181aa0c3d17606addfe97a9075a32723548a # v1.9.3 with: - args: ". ${{ steps.pages.outputs.base_url }}" + args: ". --exclude-path CHANGELOG.md ${{ steps.pages.outputs.base_url }}" fail: true diff --git a/.github/workflows/mega-linter.yml b/.github/workflows/mega-linter.yml index 7cadbb91..40dbb65f 100644 --- a/.github/workflows/mega-linter.yml +++ b/.github/workflows/mega-linter.yml @@ -18,7 +18,7 @@ jobs: uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Restore lychee cache - uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1 + uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 with: path: .lycheecache key: cache-lychee-${{ github.sha }} @@ -41,5 +41,6 @@ jobs: uses: oxsecurity/megalinter@a7a0163b6c8ff7474a283d99a706e27483ddd80f # v7.10.0 env: GITHUB_COMMENT_REPORTER: false - GITHUB_STATUS_REPORTER: true + # Disabled due to error: [GitHub Status Reporter] Error posting Status for REPOSITORY with ...: 403 + GITHUB_STATUS_REPORTER: false GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 9a733f49..37664718 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -15,6 +15,13 @@ jobs: release-please: runs-on: ubuntu-latest steps: + - uses: actions/create-github-app-token@f2acddfb5195534d487896a656232b016a682f3c # v1.9.0 + id: app-token + with: + app-id: ${{ secrets.MY_RENOVATE_GITHUB_APP_ID }} + private-key: ${{ secrets.MY_RENOVATE_GITHUB_PRIVATE_KEY }} + - uses: google-github-actions/release-please-action@a37ac6e4f6449ce8b3f7607e4d97d0146028dc0b # v4.1.0 with: release-type: simple + token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 9ddb0a42..6af0cbbe 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -20,7 +20,7 @@ on: - main - "!renovate/*" schedule: - - cron: "0 0,2,4 * * 0" + - cron: "0 0-3 * * 0" env: # https://docs.renovatebot.com/troubleshooting/#log-debug-levels @@ -53,9 +53,9 @@ jobs: id: app-token with: app-id: ${{ secrets.MY_RENOVATE_GITHUB_APP_ID }} - private-key: "${{ secrets.MY_RENOVATE_GITHUB_PRIVATE_KEY }}" + private-key: ${{ secrets.MY_RENOVATE_GITHUB_PRIVATE_KEY }} - name: 💡 Self-hosted Renovate - uses: renovatebot/github-action@2d90417499f45ff78a09586f7b9874b19817dba3 # v40.1.0 + uses: renovatebot/github-action@89bd050bafa5a15de5d9383e3129edf210422004 # v40.1.5 with: - token: "${{ steps.app-token.outputs.token }}" + token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/semantic-pull-request.yml b/.github/workflows/semantic-pull-request.yml index fbaa8d15..c9783b38 100644 --- a/.github/workflows/semantic-pull-request.yml +++ b/.github/workflows/semantic-pull-request.yml @@ -2,6 +2,7 @@ name: semantic-pull-request on: + workflow_dispatch: pull_request_target: types: - opened @@ -15,6 +16,12 @@ jobs: semantic-pull-request: runs-on: ubuntu-latest steps: + - uses: actions/create-github-app-token@f2acddfb5195534d487896a656232b016a682f3c # v1.9.0 + id: app-token + with: + app-id: ${{ secrets.MY_RENOVATE_GITHUB_APP_ID }} + private-key: ${{ secrets.MY_RENOVATE_GITHUB_PRIVATE_KEY }} + - uses: amannn/action-semantic-pull-request@e9fabac35e210fea40ca5b14c0da95a099eff26f # v5.4.0 env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 6814ecff..5acceea8 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -2,6 +2,7 @@ name: stale on: + workflow_dispatch: schedule: - cron: "9 9 * * *" diff --git a/.github/workflows/vuepress-build.yml b/.github/workflows/vuepress-build.yml index d46379e2..44f82e1b 100644 --- a/.github/workflows/vuepress-build.yml +++ b/.github/workflows/vuepress-build.yml @@ -43,7 +43,7 @@ jobs: with: url: ${{ steps.pages.outputs.base_url }} pages_path: . - cmd_params: '--exclude=(mylabs.dev|localhost) --buffer-size=8192 --max-connections-per-host=5 --color=always --rate-limit=5 --header="User-Agent:Mozilla" --skip-tls-verification' + cmd_params: '--exclude=(mylabs.dev|localhost|stackoverflow.com) --buffer-size=8192 --max-connections-per-host=5 --color=always --rate-limit=5 --header="User-Agent:Mozilla" --skip-tls-verification' - name: Deploy uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3 diff --git a/.trivyignore.yaml b/.trivyignore.yaml index f8e349e6..245e73c2 100644 --- a/.trivyignore.yaml +++ b/.trivyignore.yaml @@ -1,17 +1,15 @@ vulnerabilities: - # │ glob-parent │ CVE-2020-28469 │ HIGH │ fixed │ 3.1.0 │ 5.1.2 │ Regular expression denial of service │ + # │ glob-parent │ CVE-2020-28469 │ HIGH │ fixed │ 3.1.0 │ 5.1.2 │ Regular expression denial of service │ - id: CVE-2020-28469 - # │ json5 │ CVE-2022-46175 │ HIGH │ fixed │ 0.5.1 │ 2.2.2, 1.0.2 │ json5: Prototype Pollution in JSON5 via Parse Method │ + # │ json5 │ CVE-2022-46175 │ HIGH │ fixed │ 0.5.1 │ 2.2.2, 1.0.2 │ json5: Prototype Pollution in JSON5 via Parse Method │ - id: CVE-2022-46175 - # │ loader-utils │ CVE-2022-37601 │ CRITICAL │ fixed │ 0.2.17 │ 2.0.3, 1.4.1 │ loader-utils: prototype pollution in function parseQuery in │ + # │ loader-utils │ CVE-2022-37601 │ CRITICAL │ fixed │ 0.2.17 │ 2.0.3, 1.4.1 │ loader-utils: prototype pollution in function parseQuery in │ - id: CVE-2022-37601 - # │ node-forge │ CVE-2022-24771 │ HIGH │ fixed │ 0.10.0 │ 1.3.0 │ node-forge: Signature verification leniency in checking │ + # │ node-forge │ CVE-2022-24771 │ HIGH │ fixed │ 0.10.0 │ 1.3.0 │ node-forge: Signature verification leniency in checking │ - id: CVE-2022-24771 - # │ node-forge │ CVE-2022-24772 │ HIGH │ fixed │ 0.10.0 │ 1.3.0 │ node-forge: Signature verification failing to check tailing │ + # │ node-forge │ CVE-2022-24772 │ HIGH │ fixed │ 0.10.0 │ 1.3.0 │ node-forge: Signature verification failing to check tailing │ - id: CVE-2022-24772 - # │ nth-check │ CVE-2021-3803 │ HIGH │ fixed │ 1.0.2 │ 2.0.1 │ inefficient regular expression complexity │ + # │ nth-check │ CVE-2021-3803 │ HIGH │ fixed │ 1.0.2 │ 2.0.1 │ inefficient regular expression complexity │ - id: CVE-2021-3803 - # | ip │ CVE-2023-42282 │ HIGH │ affected │ 1.1.8 │ │ An issue in NPM IP Package v.1.1.8 and before allows an │ - - id: CVE-2023-42282 - # │ normalize-url │ CVE-2021-33502 │ HIGH │ fixed │ 4.5.0 │ 4.5.1, 5.3.1, 6.0.1 │ ReDoS for data URLs │ - - id: CVE-2021-33502 + # │ webpack-dev-middleware │ CVE-2024-29180 │ HIGH │ fixed │ 3.7.3 │ 7.1.0, 6.1.2, 5.3.4 │ webpack-dev-middleware: lack of URL validation may lead to │ + - id: CVE-2024-29180