.github/.github/workflows/updatecli.yaml at main · neuvector/.github · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
---
name: Updatecli
on:
  release:
  workflow_dispatch:
  schedule:
    - cron: 0 12 */14 * *
permissions: {}
jobs:
  updatecli:
    runs-on: ubuntu-latest
    permissions:
      contents: "read"
    steps:
      - name: "Checkout"
        uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
        with:
          persist-credentials: false
      - name: "Setup updatecli"
        uses: "updatecli/updatecli-action@2efa15cbae1751f532f9bfc88f56adafd6d1faed" # v3.8.0
      - name: "Setup zizmor"
        env:
          ZIZMOR_VERSION: "1.30.1"
          # Used by "gh attestation verify" to fetch zizmor build provenance.
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          curl --fail --silent --show-error --location \
            --output zizmor.tar.gz \
            "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz"
          gh attestation verify zizmor.tar.gz --repo zizmorcore/zizmor
          tar --extract --gzip --file zizmor.tar.gz --directory "${RUNNER_TEMP}" zizmor
          rm zizmor.tar.gz
          echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
          "${RUNNER_TEMP}/zizmor" --version
      - name: "Run updatecli"
        run: updatecli compose apply --clean-git-branches=true --experimental
        env:
          UPDATECLI_GITHUB_APP_CLIENT_ID: ${{ secrets.UPDATECLI_GITHUB_APP_CLIENT_ID }}
          UPDATECLI_GITHUB_APP_PRIVATE_KEY: ${{ secrets.UPDATECLI_GITHUB_APP_PRIVATE_KEY }}
          UPDATECLI_GITHUB_APP_INSTALLATION_ID: ${{ secrets.UPDATECLI_GITHUB_APP_INSTALLATION_ID }}
          UPDATECLI_UDASH_API_URL: ${{ secrets.UPDATECLI_UDASH_API_URL }}
          UPDATECLI_UDASH_ACCESS_TOKEN: ${{ secrets.UPDATECLI_UDASH_ACCESS_TOKEN }}
          UPDATECLI_UDASH_URL: ${{ secrets.UPDATECLI_UDASH_URL }}
          ## The Github token is needed by Zizmor
          # https://github.com/updatecli/policies/blob/main/updatecli/policies/zizmor/githubaction/scaffold/updatecli.d/default.yaml#L106
          # Adding for now just for testing
          GITHUB_TOKEN: " ${{ secrets.GITHUB_TOKEN }}"