diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2ef7b4f2548..194e25c36ae 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -30,3 +30,8 @@ updates:
schedule:
interval: "weekly"
labels: [ "changelog:dependencies" ]
+
+ - package-ecosystem: docker
+ directory: /
+ schedule:
+ interval: daily
diff --git a/.github/workflows/ci-label-check.yml b/.github/workflows/ci-label-check.yml
index d3897ffb0bf..9ebfff08ba9 100644
--- a/.github/workflows/ci-label-check.yml
+++ b/.github/workflows/ci-label-check.yml
@@ -14,6 +14,11 @@ jobs:
check-label:
runs-on: ubuntu-latest
steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+ with:
+ egress-policy: audit
+
- name: Check PR author
id: check_author
run: echo "::set-output name=is_dependabot::$(echo ${{ github.event.pull_request.user.login }} | grep -o 'dependabot')"
diff --git a/.github/workflows/ci-lint-checks.yaml b/.github/workflows/ci-lint-checks.yaml
new file mode 100644
index 00000000000..bfa304eec77
--- /dev/null
+++ b/.github/workflows/ci-lint-checks.yaml
@@ -0,0 +1,37 @@
+name: Lint Checks
+
+on:
+ push:
+ branches: [main]
+
+ pull_request:
+ branches: [main]
+
+concurrency:
+ group: ${{ github.workflow }}-${{ (github.event.pull_request && github.event.pull_request.number) || github.ref || github.run_id }}
+ cancel-in-progress: true
+
+# See https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
+permissions: # added using https://github.com/step-security/secure-workflows
+ contents: read
+
+jobs:
+ lint:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423
+ with:
+ egress-policy: audit # TODO: change to 'egress-policy: block' after a couple of runs
+
+ - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+
+ - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe
+ with:
+ go-version: 1.21.x
+
+ - name: Install tools
+ run: make install-test-tools
+
+ - name: Lint
+ run: make lint
\ No newline at end of file
diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml
index f332b684fa5..b6c68a28f5f 100644
--- a/.github/workflows/ci-release.yml
+++ b/.github/workflows/ci-release.yml
@@ -63,7 +63,7 @@ jobs:
- name: Configure GPG Key
id: import_gpg
- uses: crazy-max/ghaction-import-gpg@v6
+ uses: crazy-max/ghaction-import-gpg@82a020f1f7f605c65dd2449b392a52c3fcfef7ef # v6.0.0
with:
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
passphrase: ${{ secrets.GPG_PASSPHRASE }}
diff --git a/.github/workflows/ci-unit-tests.yml b/.github/workflows/ci-unit-tests.yml
index 164b4ccbe1f..44cf00a0ad0 100644
--- a/.github/workflows/ci-unit-tests.yml
+++ b/.github/workflows/ci-unit-tests.yml
@@ -36,9 +36,6 @@ jobs:
with:
go-version: 1.21.x
- - name: Install tools
- run: make install-test-tools
-
- name: Run unit tests
run: make test-ci
@@ -50,6 +47,3 @@ jobs:
flags: unittests
fail_ci_if_error: true
token: ${{ env.CODECOV_TOKEN }}
-
- - name: Lint
- run: make lint
diff --git a/.github/workflows/ci-validation-of-shell-scripts.yml b/.github/workflows/ci-validation-of-shell-scripts.yml
index d9b6ad33c67..e4fdd821d02 100644
--- a/.github/workflows/ci-validation-of-shell-scripts.yml
+++ b/.github/workflows/ci-validation-of-shell-scripts.yml
@@ -7,13 +7,21 @@ on:
pull_request:
branches: [main]
+permissions:
+ contents: read
+
jobs:
validation-of-shell-scripts:
runs-on: ubuntu-latest
steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+ with:
+ egress-policy: audit
+
- name: check out code
- uses: actions/checkout@v4
+ uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Install shellcheck
run: sudo apt-get install shellcheck
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 3db3a5b246f..cecd4feb570 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -31,6 +31,11 @@ jobs:
# actions: read
steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+ with:
+ egress-policy: audit
+
- name: "Checkout code"
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
diff --git a/cmd/query/app/fixture/index.html b/cmd/query/app/fixture/index.html
index 0bce65817e0..322c925ede2 100644
--- a/cmd/query/app/fixture/index.html
+++ b/cmd/query/app/fixture/index.html
@@ -1,12 +1,14 @@
-
-