From 7527e53a99cc3c83c0761e419cde3dd7c04efcad Mon Sep 17 00:00:00 2001 From: Aslan Carlos Date: Wed, 27 May 2026 21:23:29 -0300 Subject: [PATCH 1/5] Enable Dependabot with weekly schedule and grouped minor+patch PRs --- .github/dependabot.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..7629a45 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,10 @@ +version: 2 +updates: + - package-ecosystem: "docker" + directory: "/" + schedule: + interval: "weekly" + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" From 490166f0e95f7a5b31696cc4794c82721ad453a7 Mon Sep 17 00:00:00 2001 From: Aslan Carlos Date: Wed, 27 May 2026 21:32:31 -0300 Subject: [PATCH 2/5] Harden Dockerfiles: drop root user, remove sudo, slim apt install - Main Dockerfile: add chown 1001:0 + USER 1001 (was running as root) - bin/Dockerfile.act: remove sudo (process is already root in the build layer, sudo was redundant and flagged as CRITICAL by trivy DS-0010); add --no-install-recommends to apt-get install; clean apt lists --- Dockerfile | 6 +++++- bin/Dockerfile.act | 8 ++++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index 1bc8617..e955158 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,8 +11,12 @@ COPY entrypoint.sh /conjur-action/entrypoint.sh COPY CHANGELOG.md /conjur-action/CHANGELOG.md -RUN chmod +x /conjur-action/entrypoint.sh +RUN chown -R 1001:0 /conjur-action \ + && chmod -R g=u /conjur-action \ + && chmod ug+x /conjur-action/entrypoint.sh WORKDIR /conjur-action +USER 1001 + ENTRYPOINT ["/conjur-action/entrypoint.sh"] diff --git a/bin/Dockerfile.act b/bin/Dockerfile.act index bfda410..238538f 100644 --- a/bin/Dockerfile.act +++ b/bin/Dockerfile.act @@ -3,21 +3,21 @@ FROM debian:stable-slim ENV DEBIAN_FRONTEND=noninteractive RUN apt-get update && \ - apt-get install -y \ + apt-get install -y --no-install-recommends \ wget \ curl \ jq \ git \ - sudo \ ca-certificates \ build-essential \ python3 \ python3-pip \ docker.io \ - && apt-get clean + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* RUN wget -qO act.tar.gz https://github.com/nektos/act/releases/latest/download/act_Linux_x86_64.tar.gz && \ - sudo tar xf act.tar.gz -C /usr/local/bin act && \ + tar xf act.tar.gz -C /usr/local/bin act && \ rm -rf act.tar.gz WORKDIR /conjur-action-git \ No newline at end of file From 0f4f40b5deb0aa9e617aebcacb32c1d9419d32b0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 27 May 2026 21:52:34 -0300 Subject: [PATCH 3/5] Bump actions/checkout from 4 to 6 (#3) Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/main.yml | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index cf639c0..80e0777 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -24,7 +24,7 @@ jobs: contents: 'read' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Retrieve secret from Conjur via JWT uses: ./ @@ -58,7 +58,7 @@ jobs: contents: 'read' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Retrieve multiple secrets from Conjur uses: ./ @@ -99,7 +99,7 @@ jobs: contents: 'read' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Retrieve database credentials from Conjur uses: ./ @@ -138,7 +138,7 @@ jobs: contents: 'read' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: "BAD PRACTICE: hardcoded credential (connection will fail)" run: | @@ -185,7 +185,7 @@ jobs: contents: 'read' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: "Retrieve authorized secret (should succeed)" uses: ./ @@ -236,7 +236,7 @@ jobs: contents: 'read' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Retrieve database credentials from Conjur uses: ./ @@ -281,7 +281,7 @@ jobs: contents: 'read' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Retrieve credentials from Conjur (run 1) uses: ./ @@ -326,7 +326,7 @@ jobs: contents: 'read' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Retrieve dev secrets from Conjur uses: ./ @@ -356,7 +356,7 @@ jobs: contents: 'read' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Retrieve staging secrets from Conjur uses: ./ @@ -386,7 +386,7 @@ jobs: contents: 'read' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Retrieve prod secrets from Conjur uses: ./ @@ -424,7 +424,7 @@ jobs: contents: 'read' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Retrieve SSH credentials from Conjur uses: ./ @@ -465,7 +465,7 @@ jobs: contents: 'read' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Retrieve Docker Hub credentials from Conjur uses: ./ @@ -516,7 +516,7 @@ jobs: contents: 'read' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Authenticate with Conjur to obtain session token run: | From 2666e15be12131c16bbdaed2757ab6ae7f7bcbfd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 27 May 2026 21:52:38 -0300 Subject: [PATCH 4/5] Bump AutoModality/action-clean from 1.1.0 to 1.1.1 (#2) Bumps [AutoModality/action-clean](https://github.com/automodality/action-clean) from 1.1.0 to 1.1.1. - [Release notes](https://github.com/automodality/action-clean/releases) - [Commits](https://github.com/automodality/action-clean/compare/v1.1.0...v1.1.1) --- updated-dependencies: - dependency-name: AutoModality/action-clean dependency-version: 1.1.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/main.yml | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 80e0777..c681f0d 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -40,7 +40,7 @@ jobs: echo "Value (masked): $APP_USERNAME" - name: Clean Workspace - uses: AutoModality/action-clean@v1.1.0 + uses: AutoModality/action-clean@v1.1.1 # ============================================================ # STAGE 2 - Multiple Secrets & Masking Demo @@ -81,7 +81,7 @@ jobs: echo "Password: $APP_PASSWORD" - name: Clean Workspace - uses: AutoModality/action-clean@v1.1.0 + uses: AutoModality/action-clean@v1.1.1 # ============================================================ # STAGE 3 - Database Credentials from Conjur @@ -120,7 +120,7 @@ jobs: --execute="SELECT current_user(), database(), now();" - name: Clean Workspace - uses: AutoModality/action-clean@v1.1.0 + uses: AutoModality/action-clean@v1.1.1 # ============================================================ # STAGE 4 - Hardcoded vs Conjur (Before / After) @@ -167,7 +167,7 @@ jobs: --execute="SELECT 'connected!' AS status;" - name: Clean Workspace - uses: AutoModality/action-clean@v1.1.0 + uses: AutoModality/action-clean@v1.1.1 # ============================================================ # STAGE 5 - Least Privilege / Access Denied @@ -218,7 +218,7 @@ jobs: fi - name: Clean Workspace - uses: AutoModality/action-clean@v1.1.0 + uses: AutoModality/action-clean@v1.1.1 # ============================================================ # STAGE 6 - Real Query & Data Retrieval @@ -262,7 +262,7 @@ jobs: --execute="SELECT current_user() AS logged_in_as, now() AS query_time;" - name: Clean Workspace - uses: AutoModality/action-clean@v1.1.0 + uses: AutoModality/action-clean@v1.1.1 # ============================================================ # STAGE 7 - Credential Rotation (Zero Pipeline Changes) @@ -303,7 +303,7 @@ jobs: echo "--- This pipeline needs zero changes to keep working ---" - name: Clean Workspace - uses: AutoModality/action-clean@v1.1.0 + uses: AutoModality/action-clean@v1.1.1 # ============================================================ # STAGE 8 - Environment Promotion (dev → staging → prod) @@ -343,7 +343,7 @@ jobs: echo "DEV deployment complete." - name: Clean Workspace - uses: AutoModality/action-clean@v1.1.0 + uses: AutoModality/action-clean@v1.1.1 stage-8-promote-staging: name: "Stage 8b - Promote: staging" @@ -373,7 +373,7 @@ jobs: echo "STAGING deployment complete." - name: Clean Workspace - uses: AutoModality/action-clean@v1.1.0 + uses: AutoModality/action-clean@v1.1.1 stage-8-promote-prod: name: "Stage 8c - Promote: prod (requires approval)" @@ -403,7 +403,7 @@ jobs: echo "PRODUCTION deployment complete." - name: Clean Workspace - uses: AutoModality/action-clean@v1.1.0 + uses: AutoModality/action-clean@v1.1.1 # ============================================================ # STAGE 9 - SSH Deploy with Credentials from Conjur @@ -444,7 +444,7 @@ jobs: "echo 'Connected via credentials from Conjur — host: \$(hostname), date: \$(date)'" - name: Clean Workspace - uses: AutoModality/action-clean@v1.1.0 + uses: AutoModality/action-clean@v1.1.1 # ============================================================ # STAGE 10 - Docker Registry Login with Conjur Credentials @@ -494,7 +494,7 @@ jobs: run: docker logout docker.io - name: Clean Workspace - uses: AutoModality/action-clean@v1.1.0 + uses: AutoModality/action-clean@v1.1.1 # ============================================================ # STAGE 11 - Audit Trail @@ -565,4 +565,4 @@ jobs: echo "Zero credentials stored in this repository." - name: Clean Workspace - uses: AutoModality/action-clean@v1.1.0 + uses: AutoModality/action-clean@v1.1.1 From 34e00c6ee5274e66eb8f1c8ec605009bd8848662 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 11 Jun 2026 08:34:21 +0000 Subject: [PATCH 5/5] Bump alpine from 3.23 to 3.24 Bumps alpine from 3.23 to 3.24. --- updated-dependencies: - dependency-name: alpine dependency-version: '3.24' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index e955158..f30c2e8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.23 +FROM alpine:3.24 LABEL org.opencontainers.image.authors="CyberArk Software Ltd."