Add Sonar cpd input and replace some external actions - #24
Merged
Conversation
Replaced the three external actions with self-hosted composite actions that download official release binaries directly and verify SHA256 checksums (same pattern already used by actions/cosign/sign in this repo), removing the third-party marketplace dependency: ┌───────────────────────────────────────┬───────────────────────────────────────────────────────────────────────────────┐ │ New action │ Replaces │ ├───────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┤ │ actions/terraform/setup/action.yml │ hashicorp/setup-terraform │ ├───────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┤ │ actions/tflint/setup/action.yml │ terraform-linters/setup-tflint │ ├───────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┤ │ actions/syft/generate-sbom/action.yml │ anchore/sbom-action (the two # TODO: replace with a more secure action spots) │ └───────────────────────────────────────┴───────────────────────────────────────────────────────────────────────────────┘ I ran each install script for real (curl'd the actual releases, verified checksums, ran the binaries) to confirm the URLs/filenames are right before wiring them in — all three work. Updated the four reusable workflows that used them (reusable-terraform-quality.yml, reusable-terraform-deployment.yml, reusable-container-publication.yml, reusable-dotnet-quality.yml), adding a workflow-parts-version input + "checkout workflow parts" step to reusable-terraform-quality.yml (it didn't have one yet, needed to reach the local composite actions). Persisted tests in ci.yml (not thrown away after manual verification, per your note): - test-terraform-setup, test-tflint-setup, test-syft-generate-sbom — call each new composite action directly and assert the tool actually works. - test-terraform-quality — calls reusable-terraform-quality.yml end-to-end against a new minimal fixture at test/fixtures/terraform/, exercising terraform+tflint together plus Checkov/Trivy. Verified locally: terraform fmt/init/validate and a Trivy config scan both pass clean against the fixture.
1. Trivy replacement — added actions/trivy/scan/action.yml (same download-and-verify pattern as the others) and wired it into both call sites:
- reusable-container-scan.yml — blocking image scan (exit-code: 1)
- reusable-terraform-quality.yml — non-blocking config/IaC scan → SARIF
I tested both scan types for real, including against your devprofr/terraform-backend-mongodb:latest image (pulled it, ran the exact composite-action command — found real CVEs in the .NET runtime layer, as expected). One correction along the way: the original config-scan call passed ignore-unfixed: true, but current Trivy CLI actually errors on that flag for config scans (it's vuln-scan-only) — I dropped it there rather than silently replicate a flag that doesn't apply. I also added test-trivy-scan to ci.yml, using your real image for the image-scan test rather than a throwaway public one.
2. workflow-parts-version — better fix, applied to all 5 reusable workflows: default changed from the floating "main" to "", with the checkout step now doing ref: ${{ inputs.workflow-parts-version || github.workflow_sha }}. github.workflow_sha is populated by GitHub Actions to the exact commit of the reusable workflow file currently executing — so a caller pinning @v2.3.1 automatically gets composite actions checked out at that same v2.3.1, with zero extra config. Previously, even a caller pinning a release tag would silently get whatever's on main internally — a real reproducibility gap. I left ci.yml's own self-test (test-terraform-quality) with an explicit github.ref override since that job calls the reusable workflow via a local ./ path, and I couldn't verify workflow_sha's behavior for same-repo local calls without an actual GitHub Actions run.
What went wrong: github.workflow_sha isn't scoped per reusable-workflow-call the way I claimed — it's tied to the top-level triggering run, shared across the whole run including every nested reusable workflow. So inside github-workflow-parts' own reusable workflow, it resolved to keeptrack's commit SHA (the caller), not a commit in github-workflow-parts — hence not our ref. I trusted a single WebFetch summary of GitHub's docs on a point that was easy to get backwards, and didn't cross-check before shipping it. That's on me, and I should have verified against an actual test run before recommending it as a fix rather than reasoning from documentation alone.
Fix applied: reverted all 5 workflows to the original, known-working behavior — workflow-parts-version defaults back to "main", and the checkout step uses ref: ${{ inputs.workflow-parts-version }} directly, no fallback expression. I also caught and fixed a second bug from my own revert script: a blind string-replace had corrupted custom-commands's default ("" → "main") in reusable-terraform-deployment.yml since it matched the same pattern earlier in that file — fixed and re-verified with yamllint + a YAML parse of all 6 files.
The reproducibility problem is real (a caller pinning @v2.3.1 still gets internal composite actions from main), but there's no reliable expression-based fix for it — it would need callers to explicitly pass workflow-parts-version matching their pin (documented via the input description now), or a heavier OIDC-claim-based approach, which isn't worth the complexity here. Recommend merging this revert to unblock keeptrack PR #467 before anything else.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.