From cfb17417adbb371ae7a5618804ebb86d036fc847 Mon Sep 17 00:00:00 2001 From: Bill Riehl Date: Wed, 15 Jul 2026 12:59:45 -0400 Subject: [PATCH 1/4] update GHA to use inherited github info --- .github/workflows/build_and_push_image.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build_and_push_image.yml b/.github/workflows/build_and_push_image.yml index 9deae61428..e4fb95b178 100644 --- a/.github/workflows/build_and_push_image.yml +++ b/.github/workflows/build_and_push_image.yml @@ -13,6 +13,9 @@ jobs: docker_build_image: if: github.event.pull_request.draft == false runs-on: ubuntu-latest + permissions: + contents: read + packages: write steps: - name: Check out GitHub Repo @@ -48,8 +51,8 @@ jobs: uses: docker/login-action@master with: registry: ghcr.io - username: ${{ secrets.GHCR_USERNAME }} - password: ${{ secrets.GHCR_TOKEN }} + username: ${{ github.actor }} + password: ${{ github.token }} - name: Build narrative image uses: docker/build-push-action@master @@ -68,7 +71,7 @@ jobs: - name: Build version image uses: docker/build-push-action@master - if: ${{ github.base_ref }} == 'main' || ${{ github.base_ref }} == 'develop' + if: ${{ github.base_ref == 'main' || github.base_ref == 'develop' }} with: context: . push: true From f0bc4ce9ea6edf818efd45355a74f8e512cf9bf4 Mon Sep 17 00:00:00 2001 From: Bill Riehl Date: Thu, 16 Jul 2026 17:36:13 -0400 Subject: [PATCH 2/4] move rest of workflows away from github secret tokens for pulling images --- .github/workflows/integration_test.yml | 4 ++-- .github/workflows/tag_latest_image.yaml | 4 ++-- .github/workflows/unit_test.yml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/integration_test.yml b/.github/workflows/integration_test.yml index c63e97545a..1537a04e5c 100644 --- a/.github/workflows/integration_test.yml +++ b/.github/workflows/integration_test.yml @@ -19,8 +19,8 @@ jobs: uses: docker/login-action@master with: registry: ghcr.io - username: ${{ secrets.GHCR_USERNAME }} - password: ${{ secrets.GHCR_TOKEN }} + username: ${{ github.actor }} + password: ${{ github.token }} - name: Repo checkout uses: actions/checkout@master diff --git a/.github/workflows/tag_latest_image.yaml b/.github/workflows/tag_latest_image.yaml index bf3350bca2..c186b17fc2 100644 --- a/.github/workflows/tag_latest_image.yaml +++ b/.github/workflows/tag_latest_image.yaml @@ -22,8 +22,8 @@ jobs: uses: docker/login-action@master with: registry: ghcr.io - username: ${{ secrets.GHCR_USERNAME }} - password: ${{ secrets.GHCR_TOKEN }} + username: ${{ github.actor }} + password: ${{ github.token }} - name: Set up environment run: | diff --git a/.github/workflows/unit_test.yml b/.github/workflows/unit_test.yml index 25d5ae1bb5..4dd411eab0 100644 --- a/.github/workflows/unit_test.yml +++ b/.github/workflows/unit_test.yml @@ -19,8 +19,8 @@ jobs: uses: docker/login-action@master with: registry: ghcr.io - username: ${{ secrets.GHCR_USERNAME }} - password: ${{ secrets.GHCR_TOKEN }} + username: ${{ github.actor }} + password: ${{ github.token }} - name: Repo checkout uses: actions/checkout@master From 692296a4f93a62ad5651ef4b5377add7b3f8537b Mon Sep 17 00:00:00 2001 From: Bill Riehl Date: Thu, 23 Jul 2026 11:38:06 -0400 Subject: [PATCH 3/4] fix flaws in GHA workflows found by copilot and sonarcloud, some quite ancient --- .github/workflows/build_and_push_image.yml | 17 ++++++----------- .github/workflows/integration_test.yml | 10 ++++------ .github/workflows/tag_latest_image.yaml | 4 +++- .github/workflows/unit_test.yml | 10 ++++------ 4 files changed, 17 insertions(+), 24 deletions(-) diff --git a/.github/workflows/build_and_push_image.yml b/.github/workflows/build_and_push_image.yml index e4fb95b178..3a7f9aaa63 100644 --- a/.github/workflows/build_and_push_image.yml +++ b/.github/workflows/build_and_push_image.yml @@ -3,11 +3,6 @@ name: Build and push narrative images on: workflow_call: - secrets: - GHCR_USERNAME: - required: true - GHCR_TOKEN: - required: true jobs: docker_build_image: @@ -45,17 +40,17 @@ jobs: run: echo "date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT - name: Set up Docker Buildx - uses: docker/setup-buildx-action@master + uses: docker/setup-buildx-action@v4 - name: Log in to the Container registry - uses: docker/login-action@master + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ github.token }} - name: Build narrative image - uses: docker/build-push-action@master + uses: docker/build-push-action@v7 with: context: . file: ./Dockerfile @@ -64,13 +59,13 @@ jobs: tags: ${{ env.APP_IMAGE_TAG }} build-args: | BRANCH=${{ github.head_ref }} - BUILD_DATE=${{ steps.date.output.date }} + BUILD_DATE=${{ steps.date.outputs.date }} NARRATIVE_VERSION=${{ env.NARRATIVE_VERSION }} VCS_REF=${{ github.sha }} TAG='${{ github.ref }}' - name: Build version image - uses: docker/build-push-action@master + uses: docker/build-push-action@v7 if: ${{ github.base_ref == 'main' || github.base_ref == 'develop' }} with: context: . @@ -79,7 +74,7 @@ jobs: tags: ${{ env.APP_VERSION_IMAGE_TAG }} build-args: | BRANCH=${{ github.head_ref }} - BUILD_DATE=${{ steps.date.output.date }} + BUILD_DATE=${{ steps.date.outputs.date }} NARRATIVE_VERSION=${{ env.NARRATIVE_VERSION }} NARRATIVE_GIT_HASH=${{ env.NARRATIVE_GIT_HASH }} VCS_REF=${{ github.sha }} diff --git a/.github/workflows/integration_test.yml b/.github/workflows/integration_test.yml index 1537a04e5c..06364ff3fc 100644 --- a/.github/workflows/integration_test.yml +++ b/.github/workflows/integration_test.yml @@ -3,27 +3,25 @@ name: CI integration testing on: workflow_call: secrets: - GHCR_USERNAME: - required: true - GHCR_TOKEN: - required: true NARRATIVE_TEST_TOKEN: required: true jobs: run_integration_tests: runs-on: ubuntu-latest + permissions: + packages: read steps: - name: Log in to the Container registry - uses: docker/login-action@master + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ github.token }} - name: Repo checkout - uses: actions/checkout@master + uses: actions/checkout@main - name: Set up environment run: | diff --git a/.github/workflows/tag_latest_image.yaml b/.github/workflows/tag_latest_image.yaml index c186b17fc2..efce3de741 100644 --- a/.github/workflows/tag_latest_image.yaml +++ b/.github/workflows/tag_latest_image.yaml @@ -12,6 +12,8 @@ jobs: docker_tag: if: github.event.pull_request.merged == true runs-on: ubuntu-latest + permissions: + packages: write steps: - name: Check out GitHub Repo with: @@ -19,7 +21,7 @@ jobs: uses: actions/checkout@master - name: Log in to the Container registry - uses: docker/login-action@master + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/unit_test.yml b/.github/workflows/unit_test.yml index 4dd411eab0..17ca68aed9 100644 --- a/.github/workflows/unit_test.yml +++ b/.github/workflows/unit_test.yml @@ -3,20 +3,18 @@ name: CI unit testing on: workflow_call: secrets: - GHCR_USERNAME: - required: true - GHCR_TOKEN: - required: true CODECOV_TOKEN: required: true jobs: run_unit_tests: runs-on: ubuntu-latest + permissions: + packages: read steps: - name: Log in to the Container registry - uses: docker/login-action@master + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} @@ -76,7 +74,7 @@ jobs: - name: Send to Codecov id: send_to_codecov - uses: codecov/codecov-action@main + uses: codecov/codecov-action@v7 continue-on-error: true with: token: ${{ secrets.CODECOV_TOKEN }} From 6c5e320824ada220c61f32e7962bc849c5f7d44a Mon Sep 17 00:00:00 2001 From: Bill Riehl Date: Thu, 23 Jul 2026 11:46:09 -0400 Subject: [PATCH 4/4] remove refs to GHCR_* secrets from other workflows --- .github/workflows/build_prodrc_pr.yaml | 7 ------- .github/workflows/build_test_pr.yaml | 7 ------- 2 files changed, 14 deletions(-) diff --git a/.github/workflows/build_prodrc_pr.yaml b/.github/workflows/build_prodrc_pr.yaml index 2d0fd53416..33c55a808b 100644 --- a/.github/workflows/build_prodrc_pr.yaml +++ b/.github/workflows/build_prodrc_pr.yaml @@ -12,22 +12,15 @@ on: jobs: run_build_and_push: uses: ./.github/workflows/build_and_push_image.yml - secrets: - GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }} - GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }} run_unit_tests: uses: ./.github/workflows/unit_test.yml needs: run_build_and_push secrets: - GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }} - GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }} CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} run_integration_tests: uses: ./.github/workflows/integration_test.yml needs: run_build_and_push secrets: - GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }} - GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }} NARRATIVE_TEST_TOKEN: ${{ secrets.NARRATIVE_TEST_TOKEN }} diff --git a/.github/workflows/build_test_pr.yaml b/.github/workflows/build_test_pr.yaml index e4c10a5a21..683eab3d0e 100644 --- a/.github/workflows/build_test_pr.yaml +++ b/.github/workflows/build_test_pr.yaml @@ -12,9 +12,6 @@ on: jobs: run_build_and_push: uses: ./.github/workflows/build_and_push_image.yml - secrets: - GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }} - GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }} trivy-scans: if: (github.base_ref == 'develop' || github.base_ref == 'main' ) && github.event.pull_request.merged == false @@ -25,14 +22,10 @@ jobs: uses: ./.github/workflows/unit_test.yml needs: run_build_and_push secrets: - GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }} - GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }} CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} run_integration_tests: uses: ./.github/workflows/integration_test.yml needs: run_build_and_push secrets: - GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }} - GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }} NARRATIVE_TEST_TOKEN: ${{ secrets.NARRATIVE_TEST_TOKEN }}