Ci hardening

.github/workflows/generate_prs.yml

@@ -25,6 +25,8 @@ permissions: {}
 jobs:
   create-prs:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: ${{ inputs.fail-fast }}
       matrix:
@@ -48,10 +50,10 @@ jobs:
           - trino-operator
           - zookeeper-operator
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31.8.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
       - name: Install Ansible
         env:
           DEBIAN_FRONTEND: noninteractive
@@ -77,32 +79,35 @@ jobs:
         run: pip install -r requirements.txt
 
       # Create commit message depending on whether this is run manually or due to a scheduled run
-      - name: Set commit message for manual dispatch
-        if: ${{ github.event_name == 'workflow_dispatch' }}
-        env:
-          REASON: ${{ github.event.inputs.message }}
-          AUTHOR: ${{ github.event.sender.login }}
-        run: |
-          echo "AUTHOR=$AUTHOR" >> "$GITHUB_ENV"
-          echo "REASON=$REASON" >> "$GITHUB_ENV"
-      - name: Set commit message for schedule
-        if: ${{ github.event_name == 'schedule' }}
-        run: |
-          echo "AUTHOR=stackabletech/developers"
-          echo "REASON=Daily run triggered" >> "$GITHUB_ENV"
-
       - name: Run playbook
         env:
           CUSTOM_PR_TITLE: ${{ inputs.custom-pr-title }}
           GH_ACCESS_TOKEN: ${{ secrets.gh_access_token }}
           REPOSITORY: ${{ matrix.repository }}
-          # tags local excludes all actions that actually generate PRs
           DRY_RUN_FLAGS: ${{ inputs.dry-run && '--tags=local' || '' }}
-        # shellsheck disable=SC2086
+          INPUT_MESSAGE: ${{ inputs.message }}
+          SENDER_LOGIN: ${{ github.event.sender.login }}
+          EVENT_NAME: ${{ github.event_name }}
         run: |
-          echo '{}' | jq '{commit_hash: $ENV.GITHUB_SHA, author: $ENV.AUTHOR, reason: $ENV.REASON, custom_pr_title: $ENV.CUSTOM_PR_TITLE, base_dir: $pwd, gh_access_token: $ENV.GH_ACCESS_TOKEN, shard_repositories: [$ENV.REPOSITORY]} | with_entries(select(.value != null and .value != ""))' --arg pwd "$(pwd)" > vars.json
-          # $DRY_RUN_FLAGS is intentionally not quoted, since we need to avoid
-          # passing an argument if we're not in dry mode.
-          # This is safe, since it always has one of two hard-coded values.
+          if [ "$EVENT_NAME" = "schedule" ]; then
+            AUTHOR="stackabletech/developers"
+            REASON="Weekly run triggered"
+          else
+            AUTHOR="$SENDER_LOGIN"
+            REASON="$INPUT_MESSAGE"
+          fi
+
+          # Encode parameters using jq, without serializing the GH_ACCESS_TOKEN
+          jq -n \
+            --arg commit_hash "$GITHUB_SHA" \
+            --arg author "$AUTHOR" \
+            --arg reason "$REASON" \
+            --arg custom_pr_title "$CUSTOM_PR_TITLE" \
+            --arg base_dir "$(pwd)" \
+            --arg repository "$REPOSITORY" \
+            '{commit_hash: $commit_hash, author: $author, reason: $reason, custom_pr_title: $custom_pr_title, base_dir: $base_dir, shard_repositories: [$repository]} | with_entries(select(.value != null and .value != ""))' > vars.json
+
+          # Run the Ansible playbook. The token is read directly from the GH_ACCESS_TOKEN environment variable.
+          # $DRY_RUN_FLAGS is intentionally unquoted (empty or one fixed flag)
           # shellcheck disable=SC2086
           ansible-playbook playbook/playbook.yaml --extra-vars "@vars.json" $DRY_RUN_FLAGS

.github/workflows/pr_prek.yml

@@ -12,8 +12,10 @@ permissions: {}
 jobs:
   prek:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0

playbook/playbook.yaml

@@ -2,6 +2,8 @@
 - name: Synchronize operator template files with operator repositories
   hosts: localhost
   connection: local
+  vars:
+    gh_access_token: "{{ lookup('env', 'GH_ACCESS_TOKEN') }}"
 
   tasks:
     - name: Include data which repositories to check

template/.github/workflows/build.yaml.j2

@@ -39,9 +39,11 @@ jobs:
   detect-changes:
     name: Detect relevant changed files
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -57,8 +59,9 @@ jobs:
             - 'deploy/**'
             - '.cargo/**'
             - 'docker/**'
-            - 'Cargo.*'
-            - '*.rs'
+            - '**/Cargo.toml'
+            - 'Cargo.lock'
+            - '**/*.rs'
     outputs:
       detected: ${{ steps.check.outputs.detected }}
 
@@ -67,17 +70,19 @@ jobs:
     if: needs.detect-changes.outputs.detected == 'true'
     needs: [detect-changes]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       RUSTC_BOOTSTRAP: 1
     steps:
       - name: Install host dependencies
-        uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
           packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
           version: ubuntu-latest
 
       - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -93,16 +98,20 @@ jobs:
           key: udeps
 
       - name: Install cargo-udeps
-        uses: stackabletech/cargo-install-action@8f7dbbcd2ebe22717efc132d0dd61e80841994b9 # cargo-udeps
+        uses: stackabletech/cargo-install-action@e3e2dcf8d0f0e5bdbc619bf6ee7560dd68152d3c # cargo-udeps
 
       - name: Run cargo-udeps
         run: cargo udeps --workspace --all-targets
 
   build-container-image:
     name: Build/Publish ${{ matrix.runner.arch }} Image
-    if: (github.event_name != 'merge_group') && needs.detect-changes.outputs.detected == 'true'
+    if: |
+      github.repository_owner == 'stackabletech'
+      && (github.event_name != 'merge_group')
+      && needs.detect-changes.outputs.detected == 'true'
     needs: [detect-changes]
     permissions:
+      contents: read
       id-token: write
     strategy:
       fail-fast: false
@@ -115,13 +124,13 @@ jobs:
       operator-version: ${{ steps.version.outputs.OPERATOR_VERSION }}
     steps:
       - name: Install host dependencies
-        uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
           packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
           version: ${{ matrix.runner.name }}
 
       - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -156,7 +165,7 @@ jobs:
           echo "OPERATOR_VERSION=$NEW_VERSION" | tee -a "$GITHUB_OUTPUT"
 
       - name: Install Nix
-        uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31.5.2
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain
         shell: bash
@@ -196,21 +205,23 @@ jobs:
   publish-index-manifest:
     name: Publish/Sign ${{ needs.build-container-image.outputs.operator-version }} Index
     if: |
-      (github.event_name != 'merge_group')
+      github.repository_owner == 'stackabletech'
+      && (github.event_name != 'merge_group')
       && needs.detect-changes.outputs.detected == 'true'
       && !github.event.pull_request.head.repo.fork
     needs:
       - detect-changes
       - build-container-image
     permissions:
+      contents: read
       id-token: write
     runs-on: ubuntu-latest
     outputs:
       oci-index-digest: ${{ steps.publish-oci.outputs.image-index-manifest-digest }}
       quay-index-digest: ${{ steps.publish-quay.outputs.image-index-manifest-digest }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -241,7 +252,8 @@ jobs:
   provenance-oci:
     name: Generate Provenance for ${{ needs.build-container-image.outputs.operator-version }} (oci.stackable.tech)
     if: |
-      (github.event_name != 'merge_group')
+      github.repository_owner == 'stackabletech'
+      && (github.event_name != 'merge_group')
       && needs.detect-changes.outputs.detected == 'true'
       && !github.event.pull_request.head.repo.fork
     needs:
@@ -268,7 +280,8 @@ jobs:
   provenance-quay:
     name: Generate Provenance for ${{ needs.build-container-image.outputs.operator-version }} (quay.io)
     if: |
-      (github.event_name != 'merge_group')
+      github.repository_owner == 'stackabletech'
+      && (github.event_name != 'merge_group')
       && needs.detect-changes.outputs.detected == 'true'
       && !github.event.pull_request.head.repo.fork
     needs:
@@ -295,17 +308,20 @@ jobs:
   publish-helm-chart:
     name: Package/Publish ${{ needs.build-container-image.outputs.operator-version }} Helm Chart
     if: |
-      (github.event_name != 'merge_group')
+      github.repository_owner == 'stackabletech'
+      && (github.event_name != 'merge_group')
       && needs.detect-changes.outputs.detected == 'true'
+      && !github.event.pull_request.head.repo.fork
     needs:
       - detect-changes
       - build-container-image
     permissions:
+      contents: read
       id-token: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -338,7 +354,8 @@ jobs:
   openshift-preflight-check:
     name: Run OpenShift Preflight Check for ${{ needs.build-container-image.outputs.operator-version }}-${{ matrix.arch }}
     if: |
-      (github.event_name != 'merge_group')
+      github.repository_owner == 'stackabletech'
+      && (github.event_name != 'merge_group')
       && needs.detect-changes.outputs.detected == 'true'
       && !github.event.pull_request.head.repo.fork
     needs:
@@ -372,35 +389,48 @@ jobs:
     # WARNING: Do not change the name unless you will also be changing the
     # Required Checks (in branch protections) in GitHub settings.
     name: Finished Build and Publish
+    if: always()
     needs:
+      - detect-changes
       - cargo-udeps
+      - build-container-image
+      - publish-index-manifest
       - openshift-preflight-check
       - publish-helm-chart
+      - provenance-oci
+      - provenance-quay
     runs-on: ubuntu-latest
     steps:
-      - run: echo "We are done here"
+      - name: Fail if a required job failed or was cancelled
+        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+        run: |
+          echo "One or more required jobs failed or were cancelled."
+          exit 1
+
+      - name: Finished
+        run: echo "All required jobs succeeded or were intentionally skipped."
 
   notify:
     name: Failure Notification
     if: |
-      (failure() || github.run_attempt > 1)
+      !cancelled()
+      && github.repository_owner == 'stackabletech'
+      && (contains(needs.*.result, 'failure') || github.run_attempt > 1)
       && github.event_name != 'merge_group'
       && needs.detect-changes.outputs.detected == 'true'
       && !github.event.pull_request.head.repo.fork
     needs:
       - detect-changes
+      - cargo-udeps
       - build-container-image
       - publish-index-manifest
       - provenance-oci
       - provenance-quay
       - publish-helm-chart
+      - openshift-preflight-check
+      - finished
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
-
       - name: Send Notification
         uses: stackabletech/actions/send-slack-notification@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3
         with:

template/.github/workflows/general_daily_security.yml

@@ -15,8 +15,11 @@ permissions: {}
 jobs:
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0

template/.github/workflows/integration-test.yml

@@ -16,7 +16,7 @@ on:
           - custom
       test-mode-input:
         description: |
-          The profile or the runner used. Eg: `smoke-latest` or `amd64` (see test/interu.yaml)
+          The profile or the runner used. Eg: `smoke-latest` or `amd64` (see tests/interu.yaml)
         required: true
       test-suite:
         description: Name of the test-suite. Only used if test-mode is `custom`
@@ -29,13 +29,15 @@ jobs:
   test:
     name: Run Integration Test
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     # services:
     #   otel-collector:
     #     image: ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector-k8s:0.131.1
     #     volumes:
     #       - .:/mnt
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive

template/.github/workflows/pr_prek.yaml.j2

@@ -17,13 +17,15 @@ env:
 jobs:
   prek:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Install host dependencies
-        uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
           packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
           version: ubuntu-latest
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive

test.sh

@@ -2,4 +2,4 @@
 
 rm -fr work || true
 mkdir -p work
-ansible-playbook playbook/playbook.yaml --tags="local" --extra-vars "gh_access_token=unneeded base_dir=$(pwd) commit_hash=12345 reason='original message'" "$@"
+GH_ACCESS_TOKEN=unneeded ansible-playbook playbook/playbook.yaml --tags="local" --extra-vars "base_dir=$(pwd) commit_hash=12345 reason='original message'" "$@"