-
Notifications
You must be signed in to change notification settings - Fork 5
Sub-workflow versioning feature #44
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Draft
sean-sype-simmons
wants to merge
4
commits into
main
Choose a base branch
from
sean-sype-simmons/versionallthings
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Draft
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -96,6 +96,21 @@ on: | |||||
| required: false | ||||||
| type: string | ||||||
| default: 'scc-complexity' | ||||||
| scc-version: | ||||||
| description: 'Version of SCC workflow to use (e.g., main, v1.0.7)' | ||||||
| required: false | ||||||
| type: string | ||||||
| default: 'main' | ||||||
| perform-dco-check: | ||||||
| description: 'Perform DCO (Developer Certificate of Origin) check on pull requests' | ||||||
| required: false | ||||||
| type: boolean | ||||||
| default: true | ||||||
| dco-version: | ||||||
| description: 'Version of DCO check workflow to use (e.g., main, v1.0.7)' | ||||||
| required: false | ||||||
| type: string | ||||||
| default: 'main' | ||||||
| perform-language-linting: | ||||||
| description: 'Perform language-specific linting and pre-compilation checks' | ||||||
| required: false | ||||||
|
|
@@ -111,6 +126,11 @@ on: | |||||
| required: false | ||||||
| type: boolean | ||||||
| default: true | ||||||
| trufflehog-version: | ||||||
| description: 'Version of Trufflehog workflow to use (e.g., main, v1.0.7)' | ||||||
| required: false | ||||||
| type: string | ||||||
| default: 'main' | ||||||
| perform-trivy-scan: | ||||||
| description: 'Perform Trivy scan' | ||||||
| required: false | ||||||
|
|
@@ -146,6 +166,11 @@ on: | |||||
| required: false | ||||||
| type: boolean | ||||||
| default: false | ||||||
| grype-version: | ||||||
| description: 'Version of Grype workflow to use (e.g., main, v1.0.7)' | ||||||
| required: false | ||||||
| type: string | ||||||
| default: 'main' | ||||||
| grype-image-fail-on-high: | ||||||
| description: 'Fail pipeline if Grype image scan finds HIGH vulnerabilities' | ||||||
| required: false | ||||||
|
|
@@ -166,6 +191,11 @@ on: | |||||
| required: false | ||||||
| type: boolean | ||||||
| default: false | ||||||
| grype-hab-workflow-version: | ||||||
| description: 'Version of Grype Habitat package scan workflow to use (e.g., main, v1.0.7)' | ||||||
| required: false | ||||||
| type: string | ||||||
| default: 'main' | ||||||
| grype-hab-build-package: | ||||||
| description: 'Build Habitat package from source before scanning (requires checkout)' | ||||||
| required: false | ||||||
|
|
@@ -248,6 +278,11 @@ on: | |||||
| required: false | ||||||
| type: boolean | ||||||
| default: false | ||||||
| polaris-version: | ||||||
| description: 'Version of Polaris SAST workflow to use (e.g., main, v1.0.7)' | ||||||
| required: false | ||||||
| type: string | ||||||
| default: 'main' | ||||||
| polaris-application-name: | ||||||
| description: 'Polaris application name, one of these {Chef-Agents | Chef-Automate | Chef-Chef360 | Chef-Habitat | Chef-Infrastructure-Server | Chef-Shared-Services}' | ||||||
| required: false | ||||||
|
|
@@ -347,7 +382,12 @@ on: | |||||
| description: 'Report Sonar test coverage and other metrics to Atlassian dashboard (Irfans QA dashboard)' | ||||||
| required: false | ||||||
| type: boolean | ||||||
| default: true | ||||||
| default: true | ||||||
| quality-dashboard-version: | ||||||
| description: 'Version of quality dashboard workflow to use (e.g., main, v1.0.7)' | ||||||
| required: false | ||||||
| type: string | ||||||
| default: 'main' | ||||||
|
sean-sype-simmons marked this conversation as resolved.
|
||||||
| quality-product-name: | ||||||
| description: 'Product name for quality reporting (Chef360, Courier, Inspec)' | ||||||
| required: false | ||||||
|
|
@@ -440,6 +480,11 @@ on: | |||||
| required: false | ||||||
| type: boolean | ||||||
| default: true | ||||||
| sbom-version: | ||||||
| description: 'Version of SBOM workflow to use (e.g., main, v1.0.7)' | ||||||
| required: false | ||||||
| type: string | ||||||
| default: 'main' | ||||||
| export-github-sbom: | ||||||
| description: 'Export SBOM to GitHub' | ||||||
| required: false | ||||||
|
|
@@ -734,7 +779,7 @@ jobs: | |||||
| scc: | ||||||
| name: 'Source code complexity checks' | ||||||
| if: ${{ inputs.perform-complexity-checks == true }} | ||||||
| uses: chef/common-github-actions/.github/workflows/scc.yml@main | ||||||
| uses: chef/common-github-actions/.github/workflows/scc.yml@${{ inputs.scc-version }} | ||||||
|
sean-sype-simmons marked this conversation as resolved.
sean-sype-simmons marked this conversation as resolved.
|
||||||
| uses: chef/common-github-actions/.github/workflows/scc.yml@${{ inputs.scc-version }} | |
| uses: chef/common-github-actions/.github/workflows/scc.yml@main |
sean-sype-simmons marked this conversation as resolved.
Copilot
AI
Mar 30, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
uses: for reusable workflows does not support interpolating the ref with expressions. This will not resolve trufflehog.yml at runtime and will fail workflow parsing/execution.
Suggested change
| uses: chef/common-github-actions/.github/workflows/trufflehog.yml@${{ inputs.trufflehog-version }} | |
| uses: chef/common-github-actions/.github/workflows/trufflehog.yml@main |
sean-sype-simmons marked this conversation as resolved.
Comment on lines
1026
to
1028
Copilot
AI
Mar 30, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
uses: for reusable workflows does not support dynamic refs via ${{ }}. This grype.yml@${{ inputs.grype-version }} reference will not resolve; refs must be static.
sean-sype-simmons marked this conversation as resolved.
Comment on lines
1037
to
1039
Copilot
AI
Mar 30, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
uses: refs can’t be built dynamically with ${{ }}. This grype-hab-package-scan.yml@${{ inputs.grype-hab-workflow-version }} call will not resolve as intended.
sean-sype-simmons marked this conversation as resolved.
Copilot
AI
Mar 30, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
uses: for reusable workflows requires a static ref; ${{ inputs.polaris-version }} won’t be expanded here. This will prevent the Polaris workflow from being called.
Suggested change
| uses: chef/common-github-actions/.github/workflows/polaris-sast.yml@${{ inputs.polaris-version }} | |
| uses: chef/common-github-actions/.github/workflows/polaris-sast.yml@main |
sean-sype-simmons marked this conversation as resolved.
Comment on lines
1615
to
1617
Copilot
AI
Mar 30, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
uses: for reusable workflows does not support interpolating the ref with ${{ }}. sbom.yml@${{ inputs.sbom-version }} will not resolve; the ref must be static.
sean-sype-simmons marked this conversation as resolved.
Copilot
AI
Mar 30, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
uses: refs for reusable workflows must be static; ${{ inputs.quality-dashboard-version }} will not be evaluated here. This will break the quality dashboard call.
Suggested change
| uses: chef/common-github-actions/.github/workflows/irfan-quality-dashboard.yml@${{ inputs.quality-dashboard-version }} | |
| uses: chef/common-github-actions/.github/workflows/irfan-quality-dashboard.yml@main |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,45 @@ | ||||||||||||||||||||||||||||||||||
| # DCO (Developer Certificate of Origin) Check | ||||||||||||||||||||||||||||||||||
| # | ||||||||||||||||||||||||||||||||||
| # Verifies that all commits in a pull request are signed off with DCO | ||||||||||||||||||||||||||||||||||
| # | ||||||||||||||||||||||||||||||||||
| # See https://developercertificate.org/ for more information about DCO | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| name: DCO Check | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||||||||||
| workflow_call: | ||||||||||||||||||||||||||||||||||
| inputs: | ||||||||||||||||||||||||||||||||||
| github-event-name: | ||||||||||||||||||||||||||||||||||
| description: 'GitHub event name (pass github.event_name from calling workflow)' | ||||||||||||||||||||||||||||||||||
| required: false | ||||||||||||||||||||||||||||||||||
| type: string | ||||||||||||||||||||||||||||||||||
| default: '' | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| permissions: {} | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||||||||||
| dco_check_job: | ||||||||||||||||||||||||||||||||||
| permissions: | ||||||||||||||||||||||||||||||||||
| contents: read | ||||||||||||||||||||||||||||||||||
| pull-requests: read | ||||||||||||||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||||||||||||||
| name: DCO Check | ||||||||||||||||||||||||||||||||||
| steps: | ||||||||||||||||||||||||||||||||||
| - name: Skip if not pull request | ||||||||||||||||||||||||||||||||||
| if: ${{ inputs.github-event-name != 'pull_request' && inputs.github-event-name != 'pull_request_target' }} | ||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||
| echo "DCO check only runs on pull_request events. Skipping..." | ||||||||||||||||||||||||||||||||||
| exit 0 | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| - name: Get PR Commits | ||||||||||||||||||||||||||||||||||
| if: ${{ inputs.github-event-name == 'pull_request' || inputs.github-event-name == 'pull_request_target' }} | ||||||||||||||||||||||||||||||||||
| uses: tim-actions/get-pr-commits@master | ||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||
| uses: tim-actions/get-pr-commits@master | |
| uses: tim-actions/get-pr-commits@49d9b403e5b8c9a0a2dd1a8c5cbd8768c2966ac5 |
Comment on lines
+36
to
+43
Copilot
AI
Mar 30, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This workflow pins a third-party action to @master, which is mutable and can change unexpectedly. Pin tim-actions/dco to an immutable tag or commit SHA to reduce supply-chain risk.
Suggested change
| uses: tim-actions/get-pr-commits@master | |
| id: 'get-pr-commits' | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: DCO Check | |
| if: ${{ inputs.github-event-name == 'pull_request' || inputs.github-event-name == 'pull_request_target' }} | |
| uses: tim-actions/dco@master | |
| uses: tim-actions/get-pr-commits@v1 | |
| id: 'get-pr-commits' | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: DCO Check | |
| if: ${{ inputs.github-event-name == 'pull_request' || inputs.github-event-name == 'pull_request_target' }} | |
| uses: tim-actions/dco@v1 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -48,6 +48,12 @@ jobs: | |
| with: | ||
| visibility: ${{ github.event.repository.visibility }} | ||
| language: 'go' # go, ruby, rust | ||
|
|
||
| # Optionally pin individual scan versions (all default to 'main') | ||
| # trufflehog-version: 'v1.0.7' | ||
| # grype-version: 'v1.0.7' | ||
| # sbom-version: 'v1.0.7' | ||
|
|
||
| perform-complexity-checks: true | ||
| perform-trufflehog-scan: true | ||
| perform-trivy-scan: true | ||
|
|
@@ -102,6 +108,45 @@ Tags follow semantic versioning: `v{MAJOR}.{MINOR}.{PATCH}` | |
|
|
||
| When code is merged to `main` in `common-github-actions`, a new patch tag is automatically created via the `create-release-tag.yml` workflow. Manual version bumps can be triggered via workflow dispatch. | ||
|
|
||
| ### Sub-Workflow Versioning (NEW) | ||
|
|
||
| **Each security scan can be pinned to its own version independently**, giving you fine-grained control over which scan versions to use: | ||
|
|
||
| ```yaml | ||
| jobs: | ||
| ci: | ||
| uses: chef/common-github-actions/.github/workflows/[email protected] | ||
| with: | ||
| # Pin individual scan versions | ||
| scc-version: 'v1.0.7' # Use stable SCC | ||
| dco-version: 'v1.0.7' # Use stable DCO check | ||
| trufflehog-version: 'v1.0.7' # Use stable TruffleHog | ||
| grype-version: 'main' # Use latest Grype | ||
| grype-hab-workflow-version: 'v1.0.6' # Use older Habitat scan | ||
| polaris-version: 'v1.0.7' # Use stable Polaris | ||
| sbom-version: 'v1.0.7' # Use stable SBOM | ||
| quality-dashboard-version: 'main' # Use latest dashboard | ||
|
sean-sype-simmons marked this conversation as resolved.
|
||
| ``` | ||
|
|
||
| **Benefits:** | ||
| - Pin versions that work well with your project | ||
| - Update individual scans without affecting others | ||
| - Test new scan versions without full pipeline upgrade | ||
| - Avoid breaking changes in production workflows | ||
| - Roll back specific scans if issues arise | ||
|
|
||
| **Available Version Inputs:** | ||
| - `scc-version` - Source code complexity checks | ||
| - `dco-version` - Developer Certificate of Origin check | ||
| - `trufflehog-version` - Secret scanning | ||
| - `grype-version` - Grype image/source scanning | ||
| - `grype-hab-workflow-version` - Grype Habitat package scanning | ||
| - `polaris-version` - BlackDuck Polaris SAST | ||
| - `sbom-version` - SBOM generation and BlackDuck SCA | ||
| - `quality-dashboard-version` - Quality dashboard reporting | ||
|
|
||
| **Default:** All sub-workflows default to `'main'` if not specified. | ||
|
|
||
| --- | ||
|
|
||
| ## Available Workflows | ||
|
|
@@ -166,6 +211,12 @@ jobs: | |
| version: '1.0.0' | ||
| build-profile: 'cli' | ||
|
|
||
| # Pin scan versions for stability (optional) | ||
| trufflehog-version: 'v1.0.7' | ||
| grype-version: 'v1.0.7' | ||
| polaris-version: 'v1.0.7' | ||
| sbom-version: 'v1.0.7' | ||
|
|
||
| # Code Quality | ||
| perform-complexity-checks: true | ||
| perform-language-linting: true | ||
|
|
@@ -259,6 +310,9 @@ jobs: | |
| visibility: ${{ github.event.repository.visibility }} | ||
| language: 'go' | ||
|
|
||
| # Use specific versions for critical scans | ||
| trufflehog-version: 'v1.0.7' # Pin to stable version | ||
|
|
||
| # Disable everything except security scans | ||
| perform-complexity-checks: false | ||
| perform-language-linting: false | ||
|
|
@@ -292,6 +346,7 @@ jobs: | |
| | Input | Type | Default | Description | | ||
| |-------|------|---------|-------------| | ||
| | `perform-complexity-checks` | boolean | `true` | Run SCC complexity checks | | ||
| | `perform-dco-check` | boolean | `true` | Run DCO (Developer Certificate of Origin) check on pull requests | | ||
| | `perform-language-linting` | boolean | `true` | Run language-specific linting | | ||
| | `perform-trufflehog-scan` | boolean | `true` | Run TruffleHog secret scan | | ||
| | `perform-trivy-scan` | boolean | `true` | Run Trivy vulnerability scan | | ||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
perform-dco-checkanddco-versionare defined as inputs but are not used anywhere in the jobs section (no job callsdco-check.yml, anddco-versionis never referenced). Either wire these into arun-dco-checkjob or remove the inputs/docs to avoid a no-op configuration.