Victor Lyuboslavsky
9f80b9b07a
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41198 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated security hardening tools across multiple GitHub Actions workflows to the latest available version for enhanced CI/CD infrastructure protection and resilience. * Enabled additional security validation rules in workflow configuration to strengthen infrastructure oversight and improve vulnerability detection capabilities across build and deployment pipelines. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
29 lines
861 B
YAML
29 lines
861 B
YAML
name: Secret sync to confidential
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
# This allows a subsequently queued workflow run to interrupt previous runs
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
sync_secrets:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
with:
|
|
egress-policy: audit
|
|
- uses: jpoehnelt/secrets-sync-action@7840777f242539d96b60477b66aa1c179e7644ea # v1.10.0
|
|
name: Sync secrets to confidential
|
|
with:
|
|
SECRETS: |
|
|
^DIGICERT_.*
|
|
^APPLE_.*
|
|
REPOSITORIES: |
|
|
fleetdm/confidential
|
|
DRY_RUN: true
|
|
GITHUB_TOKEN: ${{ secrets.SECRETS_GITHUB_PAT }}
|
|
CONCURRENCY: 10
|