Commit graph

111 commits

Author SHA1 Message Date
Milos Gajdos
4f506663d3
Update dockerhub-readme GH Action
We were missing GitHub checkout step before running the update.

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
2023-10-14 18:16:01 +01:00
Milos Gajdos
dc07c42810
Move dockerhub-readme workflow to the correct path
We've incorrectly added the dockerhub-readme workflow into .github
path from where it can not be triggered:

https://docs.github.com/en/actions/using-workflows/triggering-a-workflow

This commit addresses it and update the workflow paths.

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
2023-10-13 11:05:12 +01:00
David Karlsson
a66f6c37cb ci: add github pages workflow for docs
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
2023-10-12 13:44:58 +02:00
Milos Gajdos
f2a72d7f77
Update Docker Hub README and keep it in sync with this repository.
This commit
* adds a new docs page (`dockerhub.md`) that contains Docker Hub README
* updates the default config that gets backed into the docker image
* updates CI with a new workflow job that keeps Docker Hub README in
  sync with the contents of the `docs/dockerhub.md` file

Co-authored-by: CrazyMax <github@crazymax.dev>
Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
2023-10-02 22:03:35 +01:00
Sebastiaan van Stijn
23115ff634
update to go1.20.8
go1.20.8 (released 2023-09-06) includes two security fixes to the html/template
package, as well as bug fixes to the compiler, the go command, the runtime,
and the crypto/tls, go/types, net/http, and path/filepath packages. See the
Go 1.20.8 milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.20.8+label%3ACherryPickApproved

full diff: https://github.com/golang/go/compare/go1.20.7...go1.20.8

From the security mailing:

[security] Go 1.21.1 and Go 1.20.8 are released

Hello gophers,

We have just released Go versions 1.21.1 and 1.20.8, minor point releases.

These minor releases include 4 security fixes following the security policy:

- cmd/go: go.mod toolchain directive allows arbitrary execution
  The go.mod toolchain directive, introduced in Go 1.21, could be leveraged to
  execute scripts and binaries relative to the root of the module when the "go"
  command was executed within the module. This applies to modules downloaded using
  the "go" command from the module proxy, as well as modules downloaded directly
  using VCS software.

  Thanks to Juho Nurminen of Mattermost for reporting this issue.

  This is CVE-2023-39320 and Go issue https://go.dev/issue/62198.

- html/template: improper handling of HTML-like comments within script contexts
  The html/template package did not properly handle HMTL-like "<!--" and "-->"
  comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may
  cause the template parser to improperly interpret the contents of <script>
  contexts, causing actions to be improperly escaped. This could be leveraged to
  perform an XSS attack.

  Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this
  issue.

  This is CVE-2023-39318 and Go issue https://go.dev/issue/62196.

- html/template: improper handling of special tags within script contexts
  The html/template package did not apply the proper rules for handling occurrences
  of "<script", "<!--", and "</script" within JS literals in <script> contexts.
  This may cause the template parser to improperly consider script contexts to be
  terminated early, causing actions to be improperly escaped. This could be
  leveraged to perform an XSS attack.

  Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this
  issue.

  This is CVE-2023-39319 and Go issue https://go.dev/issue/62197.

- crypto/tls: panic when processing post-handshake message on QUIC connections
  Processing an incomplete post-handshake message for a QUIC connection caused a panic.

  Thanks to Marten Seemann for reporting this issue.

  This is CVE-2023-39321 and CVE-2023-39322 and Go issue https://go.dev/issue/62266.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-09-12 00:07:34 +02:00
James Hewitt
1a3e73cb84
Handle rand deprecations in go 1.20
Signed-off-by: James Hewitt <james.hewitt@uk.ibm.com>
2023-08-28 09:33:12 +01:00
James Hewitt
0eb8fee87e
Update to go 1.20
Signed-off-by: James Hewitt <james.hewitt@uk.ibm.com>
2023-08-27 10:32:00 +01:00
Joyce Brum
10b8a247e4 fix: upgrade scorecard action to 2.0.6
Signed-off-by: Joyce Brum <joycebrum@google.com>
2023-08-18 18:16:42 +00:00
Joyce Brum
7723935626 chore: enable scorecard action and badge
Signed-off-by: Joyce Brum <joycebrumu.u@gmail.com>
2023-08-18 18:16:38 +00:00
Milos Gajdos
0e18af15f8
Merge pull request #3741 from sashashura/patch-1
GitHub Workflows security hardening
2023-08-14 19:21:28 +01:00
Milos Gajdos
b3ca53dfe6
Update OCI conformance workflow check
Pin the OCI conformance check workflow GHA to v1.0.1

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
2023-08-02 18:02:23 +01:00
Ben Manuel
36dd5b79ca
Update to golang 1.19.10
This addresses CVE-2023-29402, CVE-2023-29403, CVE-2023-29404, CVE-2023-29405
which were patched in 1.19.10.

Signed-off-by: Ben Manuel <ben.manuel@procore.com>
2023-06-29 15:49:27 -05:00
Sebastiaan van Stijn
322eb4eecf
update to go1.19.9
Added back minor versions in these, so that we have a somewhat more
reproducible state in the repository when tagging releases.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-05-09 17:29:31 +02:00
Sora Morimoto
165fd5f9ac Update fossa-contrib/fossa-action action to v2
Signed-off-by: Sora Morimoto <sora@morimoto.io>
2023-02-14 01:43:23 +09:00
CrazyMax
b91c9a22f4
ci: add concurrency check
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-11-26 16:09:46 +01:00
CrazyMax
2400718d81
ci: update github actions
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-11-26 16:09:46 +01:00
Gábor Lipták
8cc5b4f5aa
Add Go 1.19 to GHA
Signed-off-by: Gábor Lipták gliptak@gmail.com
Signed-off-by: Gábor Lipták <gliptak@gmail.com>
2022-10-09 16:52:41 -04:00
Alex
10975deab8 build: harden codeql-analysis.yml permissions
Signed-off-by: Alex <aleksandrosansan@gmail.com>
2022-09-24 08:57:02 +02:00
Alex
e09a9f2dc2 build: harden e2e.yml permissions
Signed-off-by: Alex <aleksandrosansan@gmail.com>
2022-09-24 08:56:40 +02:00
Alex
c26fe145ca build: harden conformance.yml permissions
Signed-off-by: Alex <aleksandrosansan@gmail.com>
2022-09-24 08:56:30 +02:00
Alex
1ca9af0184 build: harden fossa.yml permissions
Signed-off-by: Alex <aleksandrosansan@gmail.com>
2022-09-24 08:53:15 +02:00
Alex
feaa75c529 build: harden validate.yml permissions
Signed-off-by: Alex <aleksandrosansan@gmail.com>
2022-09-24 08:52:57 +02:00
Alex
1667a66856 build: harden build.yml permissions
Signed-off-by: Alex <aleksandrosansan@gmail.com>
2022-09-24 08:52:44 +02:00
CrazyMax
7e546784a4
ci: move test step to build workflow and remove ci workflow
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-07-20 14:18:27 +02:00
CrazyMax
1a905ab966
ci: git validation target
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-07-20 14:18:27 +02:00
CrazyMax
8b2c54bf57
ci: remove dco check (dco bot already does this)
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-07-20 14:10:24 +02:00
Sebastiaan van Stijn
6e8dd268a8
update to go 1.18 (continue testing against 1.17)
Go 1.16 reached end of life, so update to the current version of Go, but also
run CI on the previous version (which is still supported).

We should probably also decide wether or not we want the Dockerfiles to pin to
a specific minor version; this makes the releases more deterministic.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-05 10:36:28 +02:00
CrazyMax
7548c315f8
cleanup old check behavior
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-05-04 11:12:19 +02:00
CrazyMax
26a586cf39
lint target and workflow job
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-05-04 11:12:19 +02:00
CrazyMax
87f93ede9e
Dockerfile: switch to xx
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-05-03 20:07:07 +02:00
CrazyMax
de240721ff
cleanup old vendor validation behavior
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-04-22 16:24:54 +02:00
CrazyMax
ffa3019c1f
validate and update vendor target
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-04-22 15:32:01 +02:00
Milos Gajdos
dc7f44b613
Merge pull request #3112 from dmcgowan/update-coc 2022-04-01 23:31:22 +01:00
CrazyMax
ea65fe2ea4
update build workflow
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-21 20:07:08 +01:00
CrazyMax
936d7eda01
ci: upload conformance test results
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-11 16:41:16 +01:00
CrazyMax
6332e9631e
ci: fix conformance and e2e workflows
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-11 16:41:16 +01:00
CrazyMax
4941d83cc7
ci: build workflow to release artifacts and multi-platform image
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-11 16:41:15 +01:00
Wang Yan
3f4c558dac bump up golang v1.17
Signed-off-by: Wang Yan <wangyan@vmware.com>
2021-10-27 15:51:30 +08:00
Sebastiaan van Stijn
a07b54eb68
Update to go 1.16, and run CI on 1.15.x and 1.16.x
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-10 12:12:28 +02:00
Milos Gajdos
351b260774
Fix OCI conformance workflow report and README badge
Signed-off-by: Milos Gajdos <milosgajdos83@gmail.com>
2021-06-30 15:37:18 +01:00
Milos Gajdos
21ffbdbedd
Change GH workflows job names
Make workflow jobs unique soe we can manage which ones are required to
pass the build.

Signed-off-by: Milos Gajdos <milosgajdos83@gmail.com>
2021-06-30 08:20:39 +01:00
Wang Yan
aaca79bfcf add oci conformance test gitaction
Signed-off-by: Wang Yan <wangyan@vmware.com>
2021-06-04 12:09:30 +08:00
Ihor Dvoretskyi
df39a779dd FOSSA scan enabled
Signed-off-by: Ihor Dvoretskyi <ihor@linux.com>
2021-05-20 13:02:28 +03:00
Wang Yan
6affafd1f0
Merge pull request #3386 from milosgajdos/release-tag
Add docker image release workflow
2021-03-30 11:30:24 +08:00
Milos Gajdos
1b3c5c71ef
Merge pull request #3341 from distribution/add-codeql-security
Add CodeQL Security Scanning
2021-03-29 18:49:07 +01:00
Chris Aniszczyk
62fc5c8a33
Remove autobuild
Signed-off-by: Chris Aniszczyk <caniszczyk@gmail.com>
2021-03-29 12:39:10 -05:00
Milos Gajdos
a0aad57208
Make workflow name shorter.
Signed-off-by: Milos Gajdos <milosgajdos83@gmail.com>
2021-03-25 10:24:30 +00:00
Milos Gajdos
23b570272b
Add docker image release workflow
Signed-off-by: Milos Gajdos <milosgajdos83@gmail.com>
2021-03-23 19:25:58 +00:00
Wang Yan
68ce15863a fix CI dependency error
Fix the failure reported by git action

Package python-minimal is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
However the following packages replace it:
  python2-minimal

E: Package 'python-minimal' has no installation candidate

Signed-off-by: Wang Yan <wangyan@vmware.com>
2021-03-23 18:04:17 +08:00
Derek McGowan
8ad732972e
Remove duplicate code of conduct
A code of conduct file has already been added to the root which
can replace this

Signed-off-by: Derek McGowan <derek@mcg.dev>
2021-03-01 12:22:06 -08:00
Derek McGowan
1c65757158
Merge pull request #3348 from wy65701436/e2e
Add a basic e2e test for CI
2021-03-01 09:34:29 -08:00
olegburov
49f7426dcb
Bump Golang to 1.15 and Alpine to 3.12.
Signed-off-by: olegburov <oleg.burov@outlook.com>
2021-02-21 14:56:54 -08:00
Sebastiaan van Stijn
1d33874951
go.mod: change imports to github.com/distribution/distribution/v3
Go 1.13 and up enforce import paths to be versioned if a project
contains a go.mod and has released v2 or up.

The current v2.x branches (and releases) do not yet have a go.mod,
and therefore are still allowed to be imported with a non-versioned
import path (go modules add a `+incompatible` annotation in that case).

However, now that this project has a `go.mod` file, incompatible
import paths will not be accepted by go modules, and attempting
to use code from this repository will fail.

This patch uses `v3` for the import-paths (not `v2`), because changing
import paths itself is a breaking change, which means that  the
next release should increment the "major" version to comply with
SemVer (as go modules dictate).

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-02-08 18:30:46 +01:00
Wang Yan
9886800868 Add a basic e2e test for CI
Signed-off-by: Wang Yan <wangyan@vmware.com>
2021-02-01 16:15:45 +08:00
Chris Patterson
402d3c943a Fixing push workflow
Signed-off-by: Chris Patterson <chrispat@github.com>
2021-01-29 15:48:07 -05:00
Chris Patterson
b659eb060f
Update ci.yml 2021-01-29 15:42:19 -05:00
Chris Patterson
da9a88bc97 Fixing push workflow
Signed-off-by: Chris Patterson <chrispat@github.com>
2021-01-29 15:38:04 -05:00
Chris Patterson
64874d17b1 First draft of actions based ci
Signed-off-by: Chris Patterson <chrispat@github.com>
2021-01-29 14:40:09 -05:00
Chris Aniszczyk
a63bd4d3f1
Add CodeQL Security Scanning
Signed-off-by: Chris Aniszczyk <caniszczyk@gmail.com>
2021-01-28 11:38:29 -06:00
CrazyMax
07b948ea67
Dummy workflow to enable GitHub Actions
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2020-12-19 00:35:45 +01:00
Derek McGowan
1e25ecefe4
Update governance and maintainers
Update format of governance and bring in language from containerd.
Update maintainers to reflect active maintainers.

Signed-off-by: Derek McGowan <derek@mcgstyle.net>
2020-03-04 10:04:38 -08:00