Skip to content

Commit 5d702f7

Browse files
doublethinkdoublethink
committed
ci: explicit permission and quote user definable input in actions
1 parent 8510360 commit 5d702f7

12 files changed

+69
-28
lines changed

Diff for: ‎.github/workflows/ami-release-nix.yml

+6-6
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ on:
1111
- 'ansible/vars.yml'
1212
workflow_dispatch:
1313

14+
permissions:
15+
contents: read
16+
id-token: write
17+
1418
jobs:
1519
prepare:
1620
runs-on: ubuntu-latest
@@ -41,10 +45,6 @@ jobs:
4145
mcpu: neoverse-n1
4246
runs-on: ${{ matrix.runner }}
4347
timeout-minutes: 150
44-
permissions:
45-
contents: write
46-
packages: write
47-
id-token: write
4848

4949
steps:
5050
- name: Checkout Repo
@@ -56,7 +56,7 @@ jobs:
5656
if: ${{ github.event_name == 'workflow_dispatch' }}
5757
run: |
5858
SUFFIX=$(sudo nix run nixpkgs#yq -- ".postgres_release[\"postgres${{ matrix.postgres_version }}\"]" ansible/vars.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
59-
if [[ -z $SUFFIX ]] ; then
59+
if [[ -z "$SUFFIX" ]] ; then
6060
echo "Version must include non-numeric characters if built manually."
6161
exit 1
6262
fi
@@ -67,7 +67,7 @@ jobs:
6767
- name: Generate common-nix.vars.pkr.hcl
6868
run: |
6969
PG_VERSION=$(sudo nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
70-
PG_VERSION=$(echo $PG_VERSION | tr -d '"') # Remove any surrounding quotes
70+
PG_VERSION=$(echo "$PG_VERSION" | tr -d '"') # Remove any surrounding quotes
7171
echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
7272
# Ensure there's a newline at the end of the file
7373
echo "" >> common-nix.vars.pkr.hcl

Diff for: ‎.github/workflows/check-shellscripts.yml

+3
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
pull_request:
88
workflow_dispatch:
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
build:
1215
runs-on: ubuntu-latest

Diff for: ‎.github/workflows/ci.yml

+3
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ name: Check merge requirements
33
on:
44
pull_request:
55

6+
permissions:
7+
contents: read
8+
69
jobs:
710
check-release-version:
811
timeout-minutes: 5

Diff for: ‎.github/workflows/dockerhub-release-matrix.yml

+9-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,11 @@ on:
99
- ".github/workflows/dockerhub-release-matrix.yml"
1010
- "ansible/vars.yml"
1111
workflow_dispatch:
12-
12+
13+
permissions:
14+
contents: read
15+
id-token: write
16+
1317
jobs:
1418
prepare:
1519
runs-on: ubuntu-latest
@@ -233,6 +237,10 @@ jobs:
233237
matrix: ${{ steps.combine.outputs.matrix }}
234238
publish:
235239
needs: combine_results
240+
permissions:
241+
contents: read
242+
packages: write
243+
id-token: write
236244
strategy:
237245
matrix: ${{ fromJson(needs.combine_results.outputs.matrix) }}
238246
uses: ./.github/workflows/mirror.yml

Diff for: ‎.github/workflows/manual-docker-release.yml

+8
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ on:
77
description: 'Optional. Postgres version to publish against, i.e. 15.1.1.78'
88
required: false
99

10+
permissions:
11+
id-token: write
12+
contents: read
13+
1014
jobs:
1115
prepare:
1216
runs-on: ubuntu-latest
@@ -241,6 +245,10 @@ jobs:
241245
outputs:
242246
matrix: ${{ steps.combine.outputs.matrix }}
243247
publish:
248+
permissions:
249+
contents: read
250+
packages: write
251+
id-token: write
244252
needs: combine_results
245253
strategy:
246254
matrix: ${{ fromJson(needs.combine_results.outputs.matrix) }}

Diff for: ‎.github/workflows/mirror-postgrest.yml

+3
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ on:
88
- ".github/workflows/mirror-postgrest.yml"
99
- "common.vars*"
1010

11+
permissions:
12+
contents: read
13+
1114
jobs:
1215
version:
1316
runs-on: ubuntu-latest

Diff for: ‎.github/workflows/mirror.yml

+3
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ on:
1313
required: true
1414
type: string
1515

16+
permissions:
17+
contents: read
18+
1619
jobs:
1720
mirror:
1821
runs-on: ubuntu-latest

Diff for: ‎.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml

+10-10
Original file line numberDiff line numberDiff line change
@@ -44,19 +44,19 @@ jobs:
4444
id: process_release_version
4545
run: |
4646
VERSION=$(nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
47-
VERSION=$(echo $VERSION | tr -d '"') # Remove any surrounding quotes
47+
VERSION=$(echo "$VERSION" | tr -d '"') # Remove any surrounding quotes
4848
if [[ "${{ inputs.postgresVersion }}" != "" ]]; then
49-
VERSION=${{ inputs.postgresVersion }}
49+
VERSION="${{ inputs.postgresVersion }}"
5050
fi
5151
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
5252
echo "major_version=$(echo $VERSION | cut -d'.' -f1)" >> "$GITHUB_OUTPUT"
5353
5454
- name: Create a tarball containing the latest nix flake version
5555
working-directory: /tmp/
5656
run: |
57-
mkdir -p ${{ steps.process_release_version.outputs.major_version }}
58-
echo $GITHUB_SHA > ${{ steps.process_release_version.outputs.major_version }}/nix_flake_version
59-
tar -czvf pg_upgrade_bin.tar.gz ${{ steps.process_release_version.outputs.major_version }}
57+
mkdir -p "${{ steps.process_release_version.outputs.major_version }}"
58+
echo "$GITHUB_SHA" > "${{ steps.process_release_version.outputs.major_version }}/nix_flake_version"
59+
tar -czvf pg_upgrade_bin.tar.gz "${{ steps.process_release_version.outputs.major_version }}"
6060
6161
- name: configure aws credentials - staging
6262
uses: aws-actions/configure-aws-credentials@v1
@@ -66,7 +66,7 @@ jobs:
6666

6767
- name: Upload pg_upgrade scripts to s3 staging
6868
run: |
69-
aws s3 cp /tmp/pg_upgrade_bin.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
69+
aws s3 cp /tmp/pg_upgrade_bin.tar.gz "s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz"
7070
7171
- name: Slack Notification on Failure
7272
if: ${{ failure() }}
@@ -101,9 +101,9 @@ jobs:
101101
- name: Create a tarball containing the latest nix flake version
102102
working-directory: /tmp/
103103
run: |
104-
mkdir -p ${{ steps.process_release_version.outputs.major_version }}
105-
echo $GITHUB_SHA > ${{ steps.process_release_version.outputs.major_version }}/nix_flake_version
106-
tar -czvf pg_upgrade_bin.tar.gz ${{ steps.process_release_version.outputs.major_version }}
104+
mkdir -p "${{ steps.process_release_version.outputs.major_version }}"
105+
echo "$GITHUB_SHA" > "${{ steps.process_release_version.outputs.major_version }}/nix_flake_version"
106+
tar -czvf pg_upgrade_bin.tar.gz "${{ steps.process_release_version.outputs.major_version }}"
107107
108108
- name: configure aws credentials - prod
109109
uses: aws-actions/configure-aws-credentials@v1
@@ -113,7 +113,7 @@ jobs:
113113

114114
- name: Upload pg_upgrade scripts to s3 prod
115115
run: |
116-
aws s3 cp /tmp/pg_upgrade_bin.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
116+
aws s3 cp /tmp/pg_upgrade_bin.tar.gz "s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz"
117117
118118
- name: Slack Notification on Failure
119119
if: ${{ failure() }}

Diff for: ‎.github/workflows/publish-nix-pgupgrade-scripts.yml

+6-6
Original file line numberDiff line numberDiff line change
@@ -51,9 +51,9 @@ jobs:
5151
id: process_release_version
5252
run: |
5353
VERSION=$(nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
54-
VERSION=$(echo $VERSION | tr -d '"') # Remove any surrounding quotes
54+
VERSION=$(echo "$VERSION" | tr -d '"') # Remove any surrounding quotes
5555
if [[ "${{ inputs.postgresVersion }}" != "" ]]; then
56-
VERSION=${{ inputs.postgresVersion }}
56+
VERSION="${{ inputs.postgresVersion }}"
5757
fi
5858
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
5959
@@ -71,7 +71,7 @@ jobs:
7171

7272
- name: Upload pg_upgrade scripts to s3 staging
7373
run: |
74-
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz
74+
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz "s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz"
7575
7676
- name: Slack Notification on Failure
7777
if: ${{ failure() }}
@@ -102,9 +102,9 @@ jobs:
102102
id: process_release_version
103103
run: |
104104
VERSION=$(nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
105-
VERSION=$(echo $VERSION | tr -d '"') # Remove any surrounding quotes
105+
VERSION=$(echo "$VERSION" | tr -d '"') # Remove any surrounding quotes
106106
if [[ "${{ inputs.postgresVersion }}" != "" ]]; then
107-
VERSION=${{ inputs.postgresVersion }}
107+
VERSION="${{ inputs.postgresVersion }}"
108108
fi
109109
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
110110
@@ -122,7 +122,7 @@ jobs:
122122

123123
- name: Upload pg_upgrade scripts to s3 prod
124124
run: |
125-
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz
125+
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz "s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz"
126126
127127
- name: Slack Notification on Failure
128128
if: ${{ failure() }}

Diff for: ‎.github/workflows/qemu-image-build.yml

+7-3
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ on:
1212
- 'ansible/vars.yml'
1313
workflow_dispatch:
1414

15+
permissions:
16+
contents: read
17+
id-token: write
18+
1519
jobs:
1620
prepare:
1721
runs-on: ubuntu-latest
@@ -68,7 +72,7 @@ jobs:
6872
run: |
6973
curl -L https://github.com/mikefarah/yq/releases/download/v4.45.1/yq_linux_arm64 -o yq && chmod +x yq
7074
PG_VERSION=$(./yq '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
71-
PG_VERSION=$(echo $PG_VERSION | tr -d '"') # Remove any surrounding quotes
75+
PG_VERSION=$(echo "$PG_VERSION" | tr -d '"') # Remove any surrounding quotes
7276
echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
7377
echo 'postgres-major-version = "'$POSTGRES_MAJOR_VERSION'"' >> common-nix.vars.pkr.hcl
7478
# Ensure there's a newline at the end of the file
@@ -122,8 +126,8 @@ jobs:
122126
REPOSITORY: postgres-vm-image
123127
IMAGE_TAG: ${{ steps.process_release_version.outputs.version }}
124128
run: |
125-
docker build -f Dockerfile-kubernetes -t $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG .
126-
docker push $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG
129+
docker build -f Dockerfile-kubernetes -t "$REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG" .
130+
docker push "$REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG"
127131
128132
# - name: Upload software manifest to s3 staging
129133
# run: |

Diff for: ‎.github/workflows/test.yml

+6-1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,11 @@ on:
55
- develop
66
pull_request:
77
workflow_dispatch:
8+
9+
permissions:
10+
contents: read
11+
id-token: write
12+
813
jobs:
914
prepare:
1015
runs-on: ubuntu-latest
@@ -57,7 +62,7 @@ jobs:
5762
run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.postgres_version }}" >> $GITHUB_ENV
5863
- name: Strip quotes from pg major and set env var
5964
run: |
60-
stripped_version=$(echo ${{ matrix.postgres_version }} | sed 's/^"\(.*\)"$/\1/')
65+
stripped_version=$(echo "${{ matrix.postgres_version }}" | sed 's/^"\(.*\)"$/\1/')
6166
echo "PGMAJOR=$stripped_version" >> $GITHUB_ENV
6267
- name: Generate common-nix.vars.pkr.hcl
6368
run: |

Diff for: ‎.github/workflows/testinfra-nix.yml

+5-1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ on:
44
pull_request:
55
workflow_dispatch:
66

7+
permissions:
8+
contents: read
9+
id-token: write
10+
711
jobs:
812
prepare:
913
runs-on: ubuntu-latest
@@ -66,7 +70,7 @@ jobs:
6670
- name: Generate common-nix.vars.pkr.hcl
6771
run: |
6872
PG_VERSION=$(sudo nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
69-
PG_VERSION=$(echo $PG_VERSION | tr -d '"') # Remove any surrounding quotes
73+
PG_VERSION=$(echo "$PG_VERSION" | tr -d '"') # Remove any surrounding quotes
7074
echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
7175
# Ensure there's a newline at the end of the file
7276
echo "" >> common-nix.vars.pkr.hcl

0 commit comments

Comments
 (0)