fix: hardening for CI runners (#139)

* fix: allow all subdomains for githubusercontent.com
epam · Dec 20, 2024 · 26f4caa · 26f4caa
1 parent 6047685
commit 26f4caa
Show file tree

Hide file tree

Showing 15 changed files with 39 additions and 39 deletions.
diff --git a/.github/workflows/generic_docker_pr.yml b/.github/workflows/generic_docker_pr.yml
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           image_name: ghcr.io/${{ env.IMAGE_NAME }}
           image_tag: test

diff --git a/.github/workflows/generic_docker_release.yml b/.github/workflows/generic_docker_release.yml
@@ -65,7 +65,7 @@ jobs:
       is_latest: ${{ steps.semantic_versioning.outputs.is_latest }}
       latest_tag: ${{ steps.semantic_versioning.outputs.latest_tag }}
     steps:
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         id: semantic_versioning
 
   release:
@@ -78,14 +78,14 @@ jobs:
       - calculate_version
       - test
     steps:
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           latest_tag: ${{ needs.calculate_version.outputs.latest_tag }}
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
           token: ${{ secrets.ACTIONS_BOT_TOKEN }}
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           ghcr_username: ${{ github.actor }}
           ghcr_password: ${{ secrets.ACTIONS_BOT_TOKEN }}
@@ -102,7 +102,7 @@ jobs:
             ${{ github.ref == 'refs/heads/development' && format('{0}/{1}:{2}', 'ghcr.io', env.IMAGE_NAME, 'development') || ''}}
             ${{ startsWith(github.ref, 'refs/heads/release-') && needs.calculate_version.outputs.is_latest == 'true' && format('{0}:{1}', env.IMAGE_NAME, 'latest') || ''}}
             ${{ startsWith(github.ref, 'refs/heads/release-') && needs.calculate_version.outputs.is_latest == 'true' && format('{0}/{1}:{2}', 'ghcr.io', env.IMAGE_NAME, 'latest') || ''}}
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           tag_version: ${{ needs.calculate_version.outputs.next_version }}
           changelog_file: "/tmp/my_changelog" # comes from generate_release_notes step; TODO: beautify
diff --git a/.github/workflows/java_dependency_review.yml b/.github/workflows/java_dependency_review.yml
@@ -35,15 +35,15 @@ jobs:
             api.github.com:443
             api.securityscorecards.dev:443
             github.com:443
-            github-cloud.githubusercontent.com:443
+            *.githubusercontent.com:443
             *.gradle.org:443
             repo.maven.apache.org:443
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           java_version: ${{ inputs.java_version }}
           java_distribution: ${{ inputs.java_distribution }}

diff --git a/.github/workflows/java_pr.yml b/.github/workflows/java_pr.yml
@@ -76,7 +76,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           java_version: ${{ inputs.java_version }}
           java_distribution: ${{ inputs.java_distribution }}
@@ -88,7 +88,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           image_name: ghcr.io/${{ env.IMAGE_NAME }}
           image_tag: test

diff --git a/.github/workflows/java_release.yml b/.github/workflows/java_release.yml
@@ -77,7 +77,7 @@ jobs:
       is_latest: ${{ steps.semantic_versioning.outputs.is_latest }}
       latest_tag: ${{ steps.semantic_versioning.outputs.latest_tag }}
     steps:
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         id: semantic_versioning
 
   release:
@@ -90,22 +90,22 @@ jobs:
       - calculate_version
       - test
     steps:
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           latest_tag: ${{ needs.calculate_version.outputs.latest_tag }}
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
           token: ${{ secrets.ACTIONS_BOT_TOKEN }}
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           java_version: ${{ inputs.java_version }}
           java_distribution: ${{ inputs.java_distribution }}
       - name: Set version
         shell: bash
         run: |
           sed -i -E "s/^([ \t]*version[ \t]*=[ \t]*)[\"'].*[\"']/\1\"${{ needs.calculate_version.outputs.next_version }}\"/g" build.gradle
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           ghcr_username: ${{ github.actor }}
           ghcr_password: ${{ secrets.ACTIONS_BOT_TOKEN }}
@@ -123,7 +123,7 @@ jobs:
             ${{ startsWith(github.ref, 'refs/heads/release-') && needs.calculate_version.outputs.is_latest == 'true' && format('{0}:{1}', env.IMAGE_NAME, 'latest') || ''}}
             ${{ startsWith(github.ref, 'refs/heads/release-') && needs.calculate_version.outputs.is_latest == 'true' && format('{0}/{1}:{2}', 'ghcr.io', env.IMAGE_NAME, 'latest') || ''}}
       - uses: gradle/actions/dependency-submission@cc4fc85e6b35bafd578d5ffbc76a5518407e1af0 # v4.2.1
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           tag_version: ${{ needs.calculate_version.outputs.next_version }}
           changelog_file: "/tmp/my_changelog" # comes from generate_release_notes step; TODO: beautify

diff --git a/.github/workflows/java_test.yml b/.github/workflows/java_test.yml
@@ -52,7 +52,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           java_version: ${{ inputs.java_version }}
           java_distribution: ${{ inputs.java_distribution }}
@@ -69,7 +69,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           java_version: ${{ inputs.java_version }}
           java_distribution: ${{ inputs.java_distribution }}

diff --git a/.github/workflows/node_pr.yml b/.github/workflows/node_pr.yml
@@ -81,7 +81,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           image_name: ghcr.io/${{ env.IMAGE_NAME }}
           image_tag: test

diff --git a/.github/workflows/node_release.yml b/.github/workflows/node_release.yml
@@ -86,7 +86,7 @@ jobs:
       is_latest: ${{ steps.semantic_versioning.outputs.is_latest }}
       latest_tag: ${{ steps.semantic_versioning.outputs.latest_tag }}
     steps:
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         id: semantic_versioning
 
   release:
@@ -99,14 +99,14 @@ jobs:
       - calculate_version
       - test
     steps:
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           latest_tag: ${{ needs.calculate_version.outputs.latest_tag }}
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
           token: ${{ secrets.ACTIONS_BOT_TOKEN }}
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           node_version: ${{ inputs.node_version }}
           clean_install: true
@@ -115,7 +115,7 @@ jobs:
         shell: bash
         run: |
           npm version ${{ needs.calculate_version.outputs.next_version }} --no-git-tag-version || true # upstream branch may already be updated
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           ghcr_username: ${{ github.actor }}
           ghcr_password: ${{ secrets.ACTIONS_BOT_TOKEN }}
@@ -155,7 +155,7 @@ jobs:
           IS_LATEST: ${{ needs.calculate_version.outputs.is_latest == 'true' }}
           IS_DEVELOPMENT_BRANCH: ${{ github.ref == 'refs/heads/development' }}
           IS_RELEASE_BRANCH: ${{ startsWith(github.ref, 'refs/heads/release-') }}
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           tag_version: ${{ needs.calculate_version.outputs.next_version }}
           changelog_file: "/tmp/my_changelog" # comes from generate_release_notes step; TODO: beautify

diff --git a/.github/workflows/node_test.yml b/.github/workflows/node_test.yml
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           node_version: ${{ inputs.node_version }}
           clean_install: "true"
@@ -73,7 +73,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           node_version: ${{ inputs.node_version }}
           clean_install: "true"
@@ -90,7 +90,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           node_version: ${{ inputs.node_version }}
           clean_install: "true"

diff --git a/.github/workflows/python_docker_pr.yml b/.github/workflows/python_docker_pr.yml
@@ -71,7 +71,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           image_name: ghcr.io/${{ env.IMAGE_NAME }}
           image_tag: test

diff --git a/.github/workflows/python_docker_release.yml b/.github/workflows/python_docker_release.yml
@@ -73,7 +73,7 @@ jobs:
       is_latest: ${{ steps.semantic_versioning.outputs.is_latest }}
       latest_tag: ${{ steps.semantic_versioning.outputs.latest_tag }}
     steps:
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         id: semantic_versioning
 
   release:
@@ -86,7 +86,7 @@ jobs:
       - calculate_version
       - test
     steps:
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           latest_tag: ${{ needs.calculate_version.outputs.latest_tag }}
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -97,7 +97,7 @@ jobs:
         shell: bash
         run: |
           sed -i "s/^version = .*/version = \"${{ needs.calculate_version.outputs.non_semver_next_version }}\"/g" pyproject.toml
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           ghcr_username: ${{ github.actor }}
           ghcr_password: ${{ secrets.ACTIONS_BOT_TOKEN }}
@@ -114,7 +114,7 @@ jobs:
             ${{ github.ref == 'refs/heads/development' && format('{0}/{1}:{2}', 'ghcr.io', env.IMAGE_NAME, 'development') || ''}}
             ${{ startsWith(github.ref, 'refs/heads/release-') && needs.calculate_version.outputs.is_latest == 'true' && format('{0}:{1}', env.IMAGE_NAME, 'latest') || ''}}
             ${{ startsWith(github.ref, 'refs/heads/release-') && needs.calculate_version.outputs.is_latest == 'true' && format('{0}/{1}:{2}', 'ghcr.io', env.IMAGE_NAME, 'latest') || ''}}
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           tag_version: ${{ needs.calculate_version.outputs.next_version }}
           changelog_file: "/tmp/my_changelog" # comes from generate_release_notes step; TODO: beautify

diff --git a/.github/workflows/python_docker_test.yml b/.github/workflows/python_docker_test.yml
@@ -48,7 +48,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           python_version: ${{ inputs.python_version }}
       - name: Test
@@ -64,7 +64,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           python_version: ${{ inputs.python_version }}
       - name: Test

diff --git a/.github/workflows/python_package_pr.yml b/.github/workflows/python_package_pr.yml
@@ -78,7 +78,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           python_version: ${{ inputs.python_version }}
       - run: make build
diff --git a/.github/workflows/python_package_release.yml b/.github/workflows/python_package_release.yml
@@ -75,7 +75,7 @@ jobs:
       non_semver_next_version: ${{ steps.semantic_versioning.outputs.non_semver_next_version }}
       latest_tag: ${{ steps.semantic_versioning.outputs.latest_tag }}
     steps:
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         id: semantic_versioning
 
   release:
@@ -88,14 +88,14 @@ jobs:
       - calculate_version
       - test
     steps:
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           latest_tag: ${{ needs.calculate_version.outputs.latest_tag }}
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
           token: ${{ secrets.ACTIONS_BOT_TOKEN }}
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           python_version: ${{ inputs.python_version }}
       - name: Set version
@@ -109,7 +109,7 @@ jobs:
           make publish
         env:
           PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           tag_version: ${{ needs.calculate_version.outputs.non_semver_next_version }}
           changelog_file: "/tmp/my_changelog" # comes from generate_release_notes step; TODO: beautify

diff --git a/.github/workflows/python_package_test.yml b/.github/workflows/python_package_test.yml
@@ -72,7 +72,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           python_version: ${{ inputs.python_version }}
       - name: Test
@@ -92,7 +92,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: true
-      - uses: epam/ai-dial-ci/actions/[email protected].1
+      - uses: epam/ai-dial-ci/actions/[email protected].2
         with:
           python_version: ${{ matrix.python-version }}
       - name: Test