Enable 3rd party github actions

[Madhu-1]

Currently 3rd party github actions will be replaced with in place third party tools installed in the github actions, This is because we had a security audit in ceph and we should not be using 3rd party githhub action if they dont use the SHA based downloads etc. This is to bring back the 3rd party later on.

#234

[obnoxxx]

Currently 3rd party github actions will be replaced with in place third party tools installed in the github actions, This is because we had a security audit in ceph and we should not be using 3rd party githhub action if they dont use the SHA based downloads etc. This is to bring back the 3rd party later on.

@Madhu-1, I am trying to understand what exactly is the task here.

while the title says Enable 3rd party github actions, the description rather seems to mean to me that we should stop using actions in the CI workflows unless they can use the SHA-based download methods
and we should either switch the workflows to use the SHA-based download for the actions or instead invoke the corresponding tools directly which would require installation of the tools in the workflow files.

@Madhu-1 can you confirm this understanding?

And could you give a list of workflows that need to be adjusted?

[Madhu-1]

while the title says Enable 3rd party github actions, the discription rather seems to mean to me that we should stop using actions in the CI workflows unless they can use the SHA-based download methods
and we should either switch the workflows to use the SHA-based download for the actions or instead invoke the corresponding tools directly which would require installation of the tools in the workflow files.

@obnoxxx as discussion With current action we are installing the tools in the github action they are not security complaint (required for the ceph org). We need to make it complaint and get it approved by ceph security team and later we can switch back to the third party github actions directly instead of we installing the tool.

[obnoxxx]

@Madhu-1 wrote:

while the title says Enable 3rd party github actions, the discription rather seems to mean to me that we should stop using actions in the CI workflows unless they can use the SHA-based download methods
and we should either switch the workflows to use the SHA-based download for the actions or instead invoke the corresponding tools directly which would require installation of the tools in the workflow files.

@obnoxxx as discussion With current action we are installing the tools in the github action they are not security complaint (required for the ceph org). We need to make it complaint and get it approved by ceph security team and later we can switch back to the third party github actions directly instead of we installing the tool.

OK, I think I get it now. It is a multi-stage process:

our workflows should be changed temporarily to install tools to manual invocation and use of actions should be removed.

But the goal is to eventually change back to (SHA-based use of actions.

Right?

Your PR #234 already covers the lint workflow and replaces the shellcheck and codespell actions.

Questions:

Which other workflow files need to be be changed?

Looking through the workflow files, nothing jumped at me ...

Which actions should be avoided?
I can hardly imagine that the common actions checkout and setup-go should or even can be avoided everywhere. They also use SHA already.

[Madhu-1]

@Madhu-1 wrote:

while the title says Enable 3rd party github actions, the discription rather seems to mean to me that we should stop using actions in the CI workflows unless they can use the SHA-based download methods
and we should either switch the workflows to use the SHA-based download for the actions or instead invoke the corresponding tools directly which would require installation of the tools in the workflow files.

@obnoxxx as discussion With current action we are installing the tools in the github action they are not security complaint (required for the ceph org). We need to make it complaint and get it approved by ceph security team and later we can switch back to the third party github actions directly instead of we installing the tool.

OK, I think I get it now. It is a multi-stage process:

our workflows should be changed temporarily to install tools to manual invocation and use of actions should be removed.

But the goal is to eventually change back to (SHA-based use of actions.

Right?

Your PR #234 already covers the lint workflow and replaces the shellcheck and codespell actions.

Questions:

Which other workflow files need to be be changed?

Currently we dont have any workflow that need to be changed.

Looking through the workflow files, nothing jumped at me ...

Which actions should be avoided? I can hardly imagine that the common actions checkout and setup-go should or even can be avoided everywhere. They also use SHA already.

yes thats not possible and we are good with it as its provided by github.

This issue is a tracker to go back to the third party github action instead of installing by us as its hard to manage it and keep it updated all the time.

[obnoxxx]

@BlaineEXE just had a good point in a discussion:
Any action should support the SHA-method by simply specifying an appropriate git hash from the action's code repo. The main remaining challenge would be to identify a good hash to use for each action in use.

So why can't we keep using those actions by switching to SHA for all of them right now? - @Madhu-1

[Madhu-1]

@BlaineEXE just had a good point in a discussion: Any action should support the SHA-method by simply specifying an appropriate git hash from the action's code repo. The main remaining challenge would be to identify a good hash to use for each action in use.

So why can't we keep using those actions by switching to SHA for all of them right now? - @Madhu-1

There are problem within the actions where they download some packages with version not with SHA as well.

[obnoxxx]

@Madhu-1 wrote:

@BlaineEXE just had a good point in a discussion: Any action should support the SHA-method by simply specifying an appropriate git hash from the action's code repo. The main remaining challenge would be to identify a good hash to use for each action in use.
So why can't we keep using those actions by switching to SHA for all of them right now? - @Madhu-1

There are problem within the actions where they download some packages with version not with SHA as well.

That is still rather vague. can we be more specific here, with an explicit list of problematic actions?

[Madhu-1]

reviewdog/action-misspell, codespell-project/actions-codespell and ludeeus/action-shellcheck where they are installing few tools without hash.