From fbfad0dddd4f0be6b9c1d964e8837be3f350137d Mon Sep 17 00:00:00 2001 From: Olivier Vernin Date: Thu, 10 Sep 2026 12:08:04 +0200 Subject: [PATCH] fix: updatecli gha workflows Signed-off-by: Olivier Vernin --- updatecli-compose.yaml | 59 ++++++------------------------- updatecli/updatecli-compose.yaml | 45 +++++++++++------------ updatecli/updatecli.d/zizmor.yaml | 57 ----------------------------- 3 files changed, 30 insertions(+), 131 deletions(-) delete mode 100644 updatecli/updatecli.d/zizmor.yaml diff --git a/updatecli-compose.yaml b/updatecli-compose.yaml index fd26abd..b1bd493 100644 --- a/updatecli-compose.yaml +++ b/updatecli-compose.yaml @@ -1,17 +1,18 @@ --- +name: Updatecli policies + valuesinline: scm: enabled: true - kind: githubsearch - search: | - org:neuvector - archived:false - fork:false - is:public - branch: "^main$|^master$" + kind: github + owner: neuvector + repository: .github + branch: main commitusingapi: true - user: updateclibot - limit: 0 + user: "updatecli-bot" + email: "neuvector-bot@users.noreply.github.com" + commitmessage: + footers: "Signed-off-by: NeuVector bot " include: - "updatecli/updatecli-compose.yaml" @@ -21,43 +22,3 @@ policies: id: local config: - "updatecli/updatecli.d" - values: - - - name: Update Updatecli policies - id: updatecli_policy - policy: ghcr.io/updatecli/policies/updatecli/autodiscovery:0.8.1@sha256:f8edda1a6cbf0d7274e2b847ede29fc4dc70dd5302ccb8575ae21b069cc0d8a0 - valuesinline: - pipeline: - labels: - ecosystem: updatecli - monitor: active - - - name: Handle Updatecli version in GitHub action - id: updatecli - policy: ghcr.io/updatecli/policies/updatecli/githubaction:0.9.1@sha256:49c07d724474ff7976f7ad5ecb0db9aa46448b456d08f82717913b403a0f02d8 - valuesinline: - pipeline: - labels: - ecosystem: updatecli - monitor: active - - - name: Install Zizmor - id: zizmor - policy: ghcr.io/updatecli/policies/zizmor/githubaction/scaffold:0.8.0@sha256:bacfadbe8803346402b059bc265e6c9d989d25143ed92a5dedf6012b0183650a - valuesinline: - config: - rules: - secrets-outside-env: - disable: true - autofix: - enabled: true - mode: all - - - name: Bump zizmor version used in the Updatecli workflow - id: zizmor_version - config: - - updatecli/updatecli.d/zizmor.yaml - - - name: Install Typos everywhere - id: typos - policy: ghcr.io/updatecli/policies/typos/githubaction:0.1.2@sha256:bd052609cded659c90dd1d3a60ebc5f1368b0f93aac5adf8ff13c3250e97f161 diff --git a/updatecli/updatecli-compose.yaml b/updatecli/updatecli-compose.yaml index 0c93036..a88e9e6 100644 --- a/updatecli/updatecli-compose.yaml +++ b/updatecli/updatecli-compose.yaml @@ -4,31 +4,31 @@ name: Updatecli policies applied to neuvector/.github valuesinline: scm: enabled: true - kind: github - owner: neuvector - repository: .github - branch: main + kind: githubsearch + # Right the github runner disk space is too small to clone + # all GitHub repository in the Neuvector organisation + # so we restrict the number of repository but at some + # point, we should be using `org:neuvector` to ensure + # that any new repositories contains the required gha workflows + search: | + repo:neuvector/.github + repo:neuvector/neuvector + repo:neuvector/helm + repo:neuvector/docs + repo:neuvector/neuvector-runtime-enforcer-policy-converter + repo:neuvector/neuvector-runtime-enforcer-policy-converter + archived:false + fork:false + is:public + branch: "^main$|^master$" commitusingapi: true - user: "updatecli-bot" + user: updateclibot + limit: 0 email: "neuvector-kubewarden-policy-converter-bot@users.noreply.github.com" commitmessage: footers: "Signed-off-by: NeuVectorKubewardenPolicyConverter bot " policies: - - name: Local policies - id: local - config: - - "updatecli.d" - - - name: Update Updatecli policies - id: updatecli_policy - policy: ghcr.io/updatecli/policies/updatecli/autodiscovery:0.8.1@sha256:f8edda1a6cbf0d7274e2b847ede29fc4dc70dd5302ccb8575ae21b069cc0d8a0 - valuesinline: - pipeline: - labels: - ecosystem: updatecli - monitor: active - - name: Handle Updatecli version in GitHub action id: updatecli policy: ghcr.io/updatecli/policies/updatecli/githubaction:0.9.1@sha256:49c07d724474ff7976f7ad5ecb0db9aa46448b456d08f82717913b403a0f02d8 @@ -50,11 +50,6 @@ policies: enabled: true mode: all - - name: Bump zizmor version used in the Updatecli workflow - id: zizmor_version - config: - - updatecli/updatecli.d/zizmor.yaml - - - name: Install Typos everywhere + - name: Install Typos id: typos policy: ghcr.io/updatecli/policies/typos/githubaction:0.1.2@sha256:bd052609cded659c90dd1d3a60ebc5f1368b0f93aac5adf8ff13c3250e97f161 diff --git a/updatecli/updatecli.d/zizmor.yaml b/updatecli/updatecli.d/zizmor.yaml deleted file mode 100644 index fd53cc0..0000000 --- a/updatecli/updatecli.d/zizmor.yaml +++ /dev/null @@ -1,57 +0,0 @@ ---- -name: "deps(github): bump zizmor version in the Updatecli workflow" - -labels: - ecosystem: zizmor - -sources: - version: - name: "Get the latest zizmor release" - kind: githubrelease - spec: - owner: "zizmorcore" - repository: "zizmor" - url: "https://github.com" - versionfilter: - kind: semver - transformers: - - trimprefix: "v" - -targets: - version: - name: 'Update ZIZMOR_VERSION to {{ source "version" }}' - kind: file - scmid: default - sourceid: version - spec: - files: - - ".github/workflows/updatecli.yaml" - - ".github/workflows/updatecli_test.yaml" - - ".github/workflows/updatecli_update.yaml" - matchpattern: 'ZIZMOR_VERSION: "[0-9]+\.[0-9]+\.[0-9]+"' - replacepattern: 'ZIZMOR_VERSION: "{{ source "version" }}"' - -actions: - default: - kind: github/pullrequest - scmid: default - spec: - automerge: false - mergemethod: squash - labels: - - "chore" - - "dependencies" - -scms: - default: - kind: github - spec: - user: "{{ .scm.user }}" - email: "{{ .scm.email }}" - owner: "{{ .scm.owner }}" - repository: "{{ .scm.repository }}" - branch: "{{ .scm.branch }}" - commitusingapi: true - commitmessage: - type: "chore" - scope: deps