mirrors/external-secrets
1
0
Fork 0
mirror of https://github.com/external-secrets/external-secrets.git synced 2024-12-14 11:57:59 +00:00
Code Activity

fix: further restrict token permissions on helm action steps (#4129)

Browse source 
* fix: further restrict token permissions on helm action steps

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>

* pin cosign to a specific hash

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>

---------

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>
This commit is contained in:
Gergely Brautigam 2024-11-20 12:07:42 +01:00 committed by GitHub
parent dc7c2ab443
commit f61580e0dd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
.github/workflows/helm.yml vendored
View file

@ -69,8 +69,7 @@ jobs:
release:
permissions:
contents: write # for helm/chart-releaser-action to push chart release and create a release
packages: write # to push OCI chart package to GitHub Registry
contents: read
runs-on: ubuntu-latest
if: |
github.ref == 'refs/heads/main' ||
@ -97,6 +96,9 @@ jobs:
echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --dearmor --output keyring.gpg
echo -n "${{ secrets.GPG_PASSPHRASE }}" > passphrase-file.txt
- name: Run chart-releaser
permissions:
contents: write # for helm/chart-releaser-action to push chart release and create a release
packages: write # to push OCI chart package to GitHub Registry
uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
env:
CR_KEY: external-secrets <external-secrets@external-secrets.io>
@ -123,7 +125,7 @@ jobs:
password: ${{ secrets.GITHUB_TOKEN }}
- name: Install cosign
uses: sigstore/cosign-installer@v3.7.0
uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
with:
cosign-release: 'v2.4.1'
@ -158,7 +160,10 @@ jobs:
done
- name: Generate provenance attestation and push to OCI registry
uses: actions/attest-build-provenance@v1.4.4
permissions:
attestation: write
packages: write
uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
with:
push-to-registry: true
subject-name: ${{ steps.push_chart.outputs.registry }}/${{ steps.push_chart.outputs.chart_name }}