Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Fixed ref-version-mismatch zizmor check (#46901)

Browse Source 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41198 


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated GitHub Actions dependencies to latest stable versions across
CI/CD workflows for improved reliability, security, and performance.
* Enhanced build provenance attestation configuration for macOS, Linux,
and Windows builds.

* **Security**
* Strengthened workflow validation by removing override exception for
build artifact version mismatch rules, ensuring stricter security
compliance.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This commit is contained in:
Victor Lyuboslavsky
2026-06-05 20:39:53 +01:00
committed by GitHub
parent 1e9f3807a1
commit 5550d01611
19 changed files with 44 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-fleetctl-msi.yml
+1 -1
View File
@@ -199,7 +199,7 @@ jobs:
- name: Attest MSI
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: dist/fleetctl_v${{ steps.extract_version.outputs.msi_version }}_windows_${{ matrix.arch }}.msi
push-to-registry: false
.github/workflows/build-fleetctl-pkg.yml
+1 -1
View File
@@ -219,7 +219,7 @@ jobs:
retention-days: 7
- name: Attest package
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: dist/fleetctl_v${{ steps.extract_version.outputs.version }}_mac.pkg
push-to-registry: false
.github/workflows/build-fleetd-base-msi.yml
+2 -2
View File
@@ -65,7 +65,7 @@ jobs:
mv fleet-osquery*.msi fleetd-base.msi
- name: Upload fleetd-base.msi for code signing
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: unsigned-windows
path: fleetd-base.msi
@@ -117,7 +117,7 @@ jobs:
jq -e . >/dev/null 2>&1 <<< $(cat meta.json)
- name: Upload meta.json
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: meta.json
path: meta.json
.github/workflows/check-automated-doc.yml
+1 -1
View File
@@ -41,7 +41,7 @@ jobs:
egress-policy: audit
- name: Checkout Code
uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
.github/workflows/code-sign-windows.yml
+2 -2
View File
@@ -100,12 +100,12 @@ jobs:
- name: Attest binary
if: ${{ inputs.attest }}
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: ${{ inputs.filename }}
- name: Upload signed artifact
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: ${{ inputs.upload_name }}
path: ${{ inputs.filename }}
.github/workflows/collect-eng-metrics-test.yml
+2 -2
View File
@@ -37,12 +37,12 @@ jobs:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- name: Setup Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: '24.14.0'
cache: 'npm'
.github/workflows/collect-eng-metrics.yml
+2 -2
View File
@@ -28,12 +28,12 @@ jobs:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- name: Set up Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: '24.14.0'
cache: 'npm'
.github/workflows/db-upgrade-test.yml
+1 -1
View File
@@ -31,7 +31,7 @@ jobs:
egress-policy: audit
- name: Checkout Code
uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
.github/workflows/docs.yml
+1 -1
View File
@@ -47,7 +47,7 @@ jobs:
fi
- name: Check links
uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec # v1.0.15
uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec # 1.0.15
with:
use-quiet-mode: 'yes'
config-file: .github/workflows/config/markdown-link-check-config.json
.github/workflows/fleetd-tuf.yml
+1 -1
View File
@@ -31,7 +31,7 @@ jobs:
egress-policy: audit
- name: Checkout Code
uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false
.github/workflows/generate-desktop-targets.yml
+8 -8
View File
@@ -92,7 +92,7 @@ jobs:
- name: Attest binary
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: "extracted/Fleet\ Desktop.app/Contents/MacOS/*"
@@ -102,7 +102,7 @@ jobs:
tar -czf ../desktop.app.tar.gz ./*
- name: Upload desktop.app.tar.gz
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: desktop.app.tar.gz
path: desktop.app.tar.gz
@@ -134,7 +134,7 @@ jobs:
make desktop-windows
- name: Upload fleet-desktop.exe
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: unsigned-windows
path: fleet-desktop.exe
@@ -184,7 +184,7 @@ jobs:
make desktop-windows-arm64
- name: Upload fleet-desktop.exe
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: unsigned-windows-arm64
path: fleet-desktop.exe
@@ -240,12 +240,12 @@ jobs:
- name: Attest binary
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: "desktop.tar.gz"
- name: Upload desktop.tar.gz
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: desktop.tar.gz
path: desktop.tar.gz
@@ -282,12 +282,12 @@ jobs:
- name: Attest binary
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: 'desktop.tar.gz'
- name: Upload desktop.tar.gz
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: desktop-arm64.tar.gz
path: desktop.tar.gz
.github/workflows/generate-osqueryd-targets.yml
+5 -5
View File
@@ -59,7 +59,7 @@ jobs:
- name: Attest binary
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: "extracted/osquery.app/Contents/MacOS/*"
@@ -101,7 +101,7 @@ jobs:
- name: Attest binary
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: "opt/osquery/bin/osqueryd"
@@ -142,7 +142,7 @@ jobs:
- name: Attest binary
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: "opt/osquery/bin/osqueryd"
@@ -181,7 +181,7 @@ jobs:
- name: Attest binary
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: C:\temp\osquery\osqueryd\osqueryd.exe
@@ -224,7 +224,7 @@ jobs:
- name: Attest binary
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: osqueryd.exe
.github/workflows/goreleaser-fleet.yaml
+5 -5
View File
@@ -96,7 +96,7 @@ jobs:
APPLE_APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APPLE_APP_STORE_CONNECT_ISSUER_ID }}
- name: Attest binaries and archives
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: "dist/**"
@@ -117,7 +117,7 @@ jobs:
echo "digest_fleetctl=$digest_fleetctl" >> "$GITHUB_OUTPUT"
- name: Attest Fleet image
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
continue-on-error: true
with:
subject-digest: ${{steps.image_digests.outputs.digest_fleet}}
@@ -125,7 +125,7 @@ jobs:
push-to-registry: true
- name: Attest FleetCtl image
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
continue-on-error: true
with:
subject-digest: ${{steps.image_digests.outputs.digest_fleetctl}}
@@ -276,7 +276,7 @@ jobs:
- name: Attest package
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: dist/fleetctl_v*_mac.pkg
@@ -385,7 +385,7 @@ jobs:
- name: Attest MSI
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path:
dist/fleetctl_v${{ steps.version.outputs.version }}_windows_${{
.github/workflows/goreleaser-orbit.yaml
+8 -8
View File
@@ -70,12 +70,12 @@ jobs:
- name: Attest binary
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: "dist/orbit-macos_darwin_all/orbit"
- name: Upload
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: orbit-macos
path: dist/orbit-macos_darwin_all/orbit
@@ -118,12 +118,12 @@ jobs:
- name: Attest binary
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: "dist/orbit_linux_amd64_v1/orbit"
- name: Upload
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: orbit-linux
path: dist/orbit_linux_amd64_v1/orbit
@@ -163,12 +163,12 @@ jobs:
- name: Attest binary
continue-on-error: true
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
with:
subject-path: "dist/orbit_linux_arm64_v8.0/orbit"
- name: Upload
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: orbit-linux-arm64
path: dist/orbit_linux_arm64_v8.0/orbit
@@ -207,7 +207,7 @@ jobs:
run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-windows.yml # v2.4.4
- name: Upload
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: unsigned-windows
path: dist/orbit_windows_amd64_v1/orbit.exe
@@ -264,7 +264,7 @@ jobs:
run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-windows-arm64.yml # v2.4.4
- name: Upload
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: unsigned-windows-arm64
path: dist/orbit_windows_arm64_v8.0/orbit.exe
.github/workflows/release-fleetd-base.yml
+1 -1
View File
@@ -251,7 +251,7 @@ jobs:
mv fleet-osquery*.msi fleetd-base.msi
- name: Upload fleetd-base.msi for code signing
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: unsigned-windows
path: fleetd-base.msi
.github/workflows/test-db-changes.yml
+1 -1
View File
@@ -36,7 +36,7 @@ jobs:
egress-policy: audit
- name: Checkout Code
uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false
.github/workflows/test-mock-changes.yml
+1 -1
View File
@@ -35,7 +35,7 @@ jobs:
egress-policy: audit
- name: Checkout Code
uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false
.github/workflows/test-puppet.yml
+1 -1
View File
@@ -37,7 +37,7 @@ jobs:
run: brew install --cask puppetlabs/puppet/pdk
- name: Checkout Code
uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false