Merge pull request #747 from raspberrypi/develop

Harden GitHub Actions and fix note/tip issue

Author: mudge

.github/actions/deploy-action/action.yml

@@ -32,27 +32,40 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Configure ssh-agent for subsequent steps
-      run: echo "SSH_AUTH_SOCK=${{ runner.temp }}/ssh_agent.sock" >> $GITHUB_ENV
-      shell: bash
-
     - name: Start ssh-agent with SSH key
+      env:
+        SSH_AUTH_SOCK: ${{ runner.temp }}/ssh_agent.sock
+        PRIVATE_SSH_KEY: ${{ inputs.private_ssh_key }}
       run: |
-        ssh-agent -a $SSH_AUTH_SOCK
-        ssh-add - <<< "${{ inputs.private_ssh_key }}"
+        ssh-agent -a "$SSH_AUTH_SOCK"
+        ssh-add - <<< "$PRIVATE_SSH_KEY"
       shell: bash
 
     - name: Populate known hosts
+      env:
+        KNOWN_HOSTS: ${{ inputs.known_hosts }}
       run: |
         mkdir -m 700 -p ~/.ssh
-        printf "${{ inputs.known_hosts }}" >> ~/.ssh/known_hosts
+        printf "$KNOWN_HOSTS" >> ~/.ssh/known_hosts
         chmod 600 ~/.ssh/known_hosts
       shell: bash
 
     - name: Deploy to primary server
-      run: rsync -avz --delete -e 'ssh -J ${{ inputs.bastion_host }}' ${{ inputs.source }} ${{ inputs.primary_host }}:${{ inputs.destination }}
+      env:
+        SSH_AUTH_SOCK: ${{ runner.temp }}/ssh_agent.sock
+        BASTION_HOST: ${{ inputs.bastion_host }}
+        HOST: ${{ inputs.primary_host }}
+        SOURCE: ${{ inputs.source }}
+        DESTINATION: ${{ inputs.destination }}
+      run: rsync -avz --delete -e "ssh -J $BASTION_HOST" "$SOURCE" "$HOST:$DESTINATION"
       shell: bash
 
     - name: Deploy to secondary server
-      run: rsync -avz --delete -e 'ssh -J ${{ inputs.bastion_host }}' ${{ inputs.source }} ${{ inputs.secondary_host }}:${{ inputs.destination }}
+      env:
+        SSH_AUTH_SOCK: ${{ runner.temp }}/ssh_agent.sock
+        BASTION_HOST: ${{ inputs.bastion_host }}
+        HOST: ${{ inputs.secondary_host }}
+        SOURCE: ${{ inputs.source }}
+        DESTINATION: ${{ inputs.destination }}
+      run: rsync -avz --delete -e "ssh -J $BASTION_HOST" "$SOURCE" "$HOST:$DESTINATION"
       shell: bash

.github/workflows/build-and-deploy.yml

@@ -14,27 +14,31 @@ on:
 jobs:
   build:
     runs-on: [self-hosted, web]
+    permissions:
+      contents: read
+    outputs:
+      artifact-id: ${{ steps.upload.outputs.artifact-id }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: 3.14
       - name: Install Python dependencies
         run: |
           pip3 install --upgrade pip setuptools wheel
           pip3 install -r ./requirements.txt
-      - uses: ruby/setup-ruby@984c0c890880bbf811283d6f09c4607c62d210a4
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
         with:
           ruby-version: 3.2
           bundler-cache: true
       - name: Install Ninja
         run: pip3 install ninja==1.10.2.4
       - name: Install arm-none-eabi-gcc GNU Arm Embedded Toolchain
         if: ${{ inputs.deploy }}
-        uses: carlosperate/arm-none-eabi-gcc-action@98c40e51546516419841748d3210c290df0d2c6c
+        uses: carlosperate/arm-none-eabi-gcc-action@98c40e51546516419841748d3210c290df0d2c6c # v1.13.0
       - name: Install Doxygen
         if: ${{ inputs.deploy }}
         run: |
@@ -49,7 +53,8 @@ jobs:
         run: make build_doxygen_adoc
       - name: Build documentation
         run: make -j 2
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        id: upload
         if: ${{ inputs.deploy }}
         with:
           name: documentation
@@ -62,20 +67,19 @@ jobs:
     needs: build
     if: ${{ inputs.deploy }}
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
     environment:
       name: ${{ inputs.environment }}
       url: ${{ inputs.url }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
-        with:
-          persist-credentials: false
-          sparse-checkout: .github/actions
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: documentation
           path: documentation/html
       - name: Deploy to Mythic Beasts
-        uses: ./.github/actions/deploy-action
+        uses: $/.github/actions/deploy-action
         with:
           private_ssh_key: ${{ secrets.DEPLOY_SSH_KEY }}
           known_hosts: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
@@ -84,3 +88,8 @@ jobs:
           secondary_host: ${{ secrets.DEPLOY_SECONDARY_HOST }}
           source: documentation/html/
           destination: /
+      - name: Delete the uploaded build
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ARTIFACT_ID: ${{ needs.build.outputs.artifact-id }}
+        run: gh api --method DELETE "repos/$GITHUB_REPOSITORY/actions/artifacts/$ARTIFACT_ID"

.github/workflows/build.yml

@@ -12,15 +12,24 @@ on:
       - develop
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
-    uses: ./.github/workflows/build-and-deploy.yml
+    uses: $/.github/workflows/build-and-deploy.yml
+    permissions:
+      contents: read
+      actions: write
     if: ${{ github.ref != 'refs/heads/develop' && github.ref != 'refs/heads/master' }}
     with:
       deploy: false
 
   staging-build:
-    uses: ./.github/workflows/build-and-deploy.yml
+    uses: $/.github/workflows/build-and-deploy.yml
+    permissions:
+      contents: read
+      actions: write
     if: ${{ github.ref == 'refs/heads/develop' }}
     with:
       deploy: true
@@ -29,7 +38,10 @@ jobs:
     secrets: inherit
 
   production-build:
-    uses: ./.github/workflows/build-and-deploy.yml
+    uses: $/.github/workflows/build-and-deploy.yml
+    permissions:
+      contents: read
+      actions: write
     if: ${{ github.ref == 'refs/heads/master' }}
     with:
       deploy: true

.github/workflows/check_cr.yml

@@ -4,12 +4,17 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check-line-endings:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Check line endings
         run: |

.github/workflows/mirror.yml

@@ -6,12 +6,14 @@ on:
       - master
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   mirror:
     runs-on: ubuntu-latest
     environment: mirror
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: master
           token: ${{ secrets.DOCUMENTATION_REPO_TOKEN }}

.github/workflows/stale.yml

@@ -13,7 +13,7 @@ jobs:
       pull-requests: write
 
     steps:
-    - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93
+    - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-issue-message: 'This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.'

.github/zizmor.yml

@@ -0,0 +1,7 @@
+rules:
+  secrets-inherit:
+    ignore:
+      - build.yml
+  artipacked:
+    ignore:
+      - mirror.yml

documentation/asciidoc/computers/linux_kernel/building.adoc

@@ -243,8 +243,9 @@ If you don't provide a matching filename, you must specify the ramdisk using an
 initramfs <filename> followkernel
 ----
 ====
+[NOTE]
 
-NOTE: Building and updating `initramfs` is considered an advanced technique that's undertaken only by experienced users. It isn't officially supported by Raspberry Pi and we therefore don't provide instructions for it.
+Building and updating `initramfs` is considered an advanced technique that's undertaken only by experienced users. It isn't officially supported by Raspberry Pi and we therefore don't provide instructions for it.
 
 === Cross-compile the kernel