From d807208f63d2aaeb3f4c284478977c8e487423b9 Mon Sep 17 00:00:00 2001 From: Saul Beck Date: Fri, 28 Aug 2026 14:48:18 +0100 Subject: [PATCH 1/8] CI: Fix zizmor warnings and bump deps --- .github/workflows/dev_dbt.yaml | 4 ++++ ...dev_jupyter-pyspark-with-alibi-detect.yaml | 4 ++++ .../dev_jupyterhub-keycloak-spark.yaml | 4 ++++ .github/workflows/dev_nifi.yaml | 4 ++++ .github/workflows/pr_pre-commit.yml | 9 ++++---- .github/workflows/reusable_build_image.yaml | 22 ++++++++++++------- 6 files changed, 35 insertions(+), 12 deletions(-) diff --git a/.github/workflows/dev_dbt.yaml b/.github/workflows/dev_dbt.yaml index 3395e2eb..aaaa4aa0 100644 --- a/.github/workflows/dev_dbt.yaml +++ b/.github/workflows/dev_dbt.yaml @@ -1,5 +1,6 @@ --- name: Build and publish dbt-demo +permissions: {} on: workflow_dispatch: @@ -17,6 +18,9 @@ jobs: build_image: name: Reusable Workflow uses: ./.github/workflows/reusable_build_image.yaml + permissions: + contents: read + id-token: write # Needed for cosign keyless signing in the reusable workflow secrets: harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_DEMOS_GITHUB_ACTION_BUILD_SECRET }} slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }} diff --git a/.github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml b/.github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml index 3216ef36..97d2a6df 100644 --- a/.github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml +++ b/.github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml @@ -1,5 +1,6 @@ --- name: Build and publish jupyter-pyspark-with-alibi-detect +permissions: {} on: workflow_dispatch: @@ -17,6 +18,9 @@ jobs: build_image: name: Reusable Workflow uses: ./.github/workflows/reusable_build_image.yaml + permissions: + contents: read + id-token: write # Needed for cosign keyless signing in the reusable workflow secrets: harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_DEMOS_GITHUB_ACTION_BUILD_SECRET }} slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }} diff --git a/.github/workflows/dev_jupyterhub-keycloak-spark.yaml b/.github/workflows/dev_jupyterhub-keycloak-spark.yaml index 97e3c241..a6d7aeef 100644 --- a/.github/workflows/dev_jupyterhub-keycloak-spark.yaml +++ b/.github/workflows/dev_jupyterhub-keycloak-spark.yaml @@ -1,5 +1,6 @@ --- name: Build and publish Spark for jupyterhub-keycloak demo +permissions: {} on: workflow_dispatch: @@ -18,6 +19,9 @@ jobs: build_image: name: Reusable Workflow uses: ./.github/workflows/reusable_build_image.yaml + permissions: + contents: read + id-token: write # Needed for cosign keyless signing in the reusable workflow secrets: harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_DEMOS_GITHUB_ACTION_BUILD_SECRET }} slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }} diff --git a/.github/workflows/dev_nifi.yaml b/.github/workflows/dev_nifi.yaml index b7598bf1..a765a763 100644 --- a/.github/workflows/dev_nifi.yaml +++ b/.github/workflows/dev_nifi.yaml @@ -1,5 +1,6 @@ --- name: Build and publish NiFi for signal-processing demo +permissions: {} on: workflow_dispatch: @@ -18,6 +19,9 @@ jobs: build_image: name: Reusable Workflow uses: ./.github/workflows/reusable_build_image.yaml + permissions: + contents: read + id-token: write # Needed for cosign keyless signing in the reusable workflow secrets: harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_DEMOS_GITHUB_ACTION_BUILD_SECRET }} slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }} diff --git a/.github/workflows/pr_pre-commit.yml b/.github/workflows/pr_pre-commit.yml index b66abb08..2377f3f4 100644 --- a/.github/workflows/pr_pre-commit.yml +++ b/.github/workflows/pr_pre-commit.yml @@ -1,18 +1,19 @@ --- name: pre-commit +permissions: {} on: pull_request: merge_group: -permissions: {} - jobs: pre-commit: runs-on: ubuntu-latest + permissions: + contents: read steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 - - uses: stackabletech/actions/run-pre-commit@4bfd3b65f22af597fe784599c077dc34bf5894a7 # v0.8.0 + - uses: stackabletech/actions/run-pre-commit@0fe048f952bee522474903a925ea48dc706a0bb4 # v0.17.5 diff --git a/.github/workflows/reusable_build_image.yaml b/.github/workflows/reusable_build_image.yaml index a35bf813..84e70e97 100644 --- a/.github/workflows/reusable_build_image.yaml +++ b/.github/workflows/reusable_build_image.yaml @@ -19,11 +19,14 @@ on: description: The Slack token used to post failure notifications required: true +permissions: {} + jobs: build: name: Build/Publish ${{ inputs.image-version }}-${{ matrix.runner.arch }} Image permissions: - id-token: write + contents: read + id-token: write # Needed for cosign keyless signing in publish-image runs-on: ${{ matrix.runner.name }} strategy: matrix: @@ -32,7 +35,7 @@ jobs: - {name: "ubicloud-standard-8-arm", arch: "arm64"} steps: - name: Checkout Repository - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -42,7 +45,7 @@ jobs: CONTAINERFILE_PATH: ${{ inputs.containerfile-path }} IMAGE_VERSION: ${{ inputs.image-version }} IMAGE_NAME: ${{ inputs.image-name }} - uses: stackabletech/actions/build-container-image@4bfd3b65f22af597fe784599c077dc34bf5894a7 # v0.8.0 + uses: stackabletech/actions/build-container-image@0fe048f952bee522474903a925ea48dc706a0bb4 # v0.17.5 with: image-name: ${{ env.IMAGE_NAME }} image-index-manifest-tag: ${{ env.IMAGE_VERSION }} @@ -51,7 +54,7 @@ jobs: - name: Publish Container Image on oci.stackable.tech env: IMAGE_NAME: ${{ inputs.image-name }} - uses: stackabletech/actions/publish-image@4bfd3b65f22af597fe784599c077dc34bf5894a7 # v0.8.0 + uses: stackabletech/actions/publish-image@0fe048f952bee522474903a925ea48dc706a0bb4 # v0.17.5 with: image-registry-uri: oci.stackable.tech image-registry-username: robot$demos+github-action-build @@ -64,11 +67,12 @@ jobs: name: Build/Publish Manifest needs: [build] permissions: - id-token: write + contents: read + id-token: write # Needed for cosign keyless signing in publish-image-index-manifest runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -76,7 +80,7 @@ jobs: env: IMAGE_VERSION: ${{ inputs.image-version }} IMAGE_NAME: ${{ inputs.image-name }} - uses: stackabletech/actions/publish-index-manifest@4bfd3b65f22af597fe784599c077dc34bf5894a7 # v0.8.0 + uses: stackabletech/actions/publish-image-index-manifest@0fe048f952bee522474903a925ea48dc706a0bb4 # v0.17.5 with: image-registry-uri: oci.stackable.tech image-registry-username: robot$demos+github-action-build @@ -87,10 +91,12 @@ jobs: notify: name: Failure Notification needs: [build, publish_manifests] + permissions: {} runs-on: ubuntu-latest if: failure() steps: - - uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0 # v1.27.0 + # Pinned to the latest v1.x patch, not v4 (latest): v2+ has breaking changes + - uses: slackapi/slack-github-action@fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3 # v1.27.1 with: channel-id: "C07UG6JH44F" # notifications-container-images payload: | From f884729bc8505f4ce526e8ca9d2c4f921559281d Mon Sep 17 00:00:00 2001 From: Techassi Date: Tue, 1 Sep 2026 14:52:33 +0200 Subject: [PATCH 2/8] ci: Use stackabletech/actions/send-slack-notification --- .github/workflows/reusable_build_image.yaml | 41 +++------------------ 1 file changed, 6 insertions(+), 35 deletions(-) diff --git a/.github/workflows/reusable_build_image.yaml b/.github/workflows/reusable_build_image.yaml index 84e70e97..80e9107c 100644 --- a/.github/workflows/reusable_build_image.yaml +++ b/.github/workflows/reusable_build_image.yaml @@ -91,42 +91,13 @@ jobs: notify: name: Failure Notification needs: [build, publish_manifests] - permissions: {} runs-on: ubuntu-latest - if: failure() + if: failure() || (github.run_attempt > 1 && !cancelled()) steps: - # Pinned to the latest v1.x patch, not v4 (latest): v2+ has breaking changes - - uses: slackapi/slack-github-action@fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3 # v1.27.1 + - uses: stackabletech/actions/send-slack-notification@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 with: + publish-manifests-result: ${{ needs.publish_manifests.result }} + build-result: ${{ needs.build.result }} + slack-token: ${{ secrets.slack-token }} + type: container-image-build channel-id: "C07UG6JH44F" # notifications-container-images - payload: | - { - "text": "*${{ github.workflow }}* failed (attempt ${{ github.run_attempt }})", - "attachments": [ - { - "pretext": "See the details below for a summary of which job(s) failed.", - "color": "#aa0000", - "fields": [ - { - "title": "Build/Publish Image", - "short": true, - "value": "${{ needs.build.result }}" - }, - { - "title": "Build/Publish Manifests", - "short": true, - "value": "${{ needs.publish_manifests.result }}" - } - ], - "actions": [ - { - "type": "button", - "text": "Go to workflow run", - "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}" - } - ] - } - ] - } - env: - SLACK_BOT_TOKEN: ${{ secrets.slack-token }} From 5fe40861c0178aa2132f17bcca8d9e69c74da599 Mon Sep 17 00:00:00 2001 From: Techassi Date: Tue, 1 Sep 2026 14:53:11 +0200 Subject: [PATCH 3/8] ci: YAML formatting --- .github/workflows/reusable_build_image.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/reusable_build_image.yaml b/.github/workflows/reusable_build_image.yaml index 80e9107c..2ad49964 100644 --- a/.github/workflows/reusable_build_image.yaml +++ b/.github/workflows/reusable_build_image.yaml @@ -31,8 +31,8 @@ jobs: strategy: matrix: runner: - - {name: "ubuntu-latest", arch: "amd64"} - - {name: "ubicloud-standard-8-arm", arch: "arm64"} + - { name: "ubuntu-latest", arch: "amd64" } + - { name: "ubicloud-standard-8-arm", arch: "arm64" } steps: - name: Checkout Repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 From e1168b4f8cc82a0c2ea25d4f1ba3ec49a623dd60 Mon Sep 17 00:00:00 2001 From: Techassi Date: Tue, 1 Sep 2026 14:53:27 +0200 Subject: [PATCH 4/8] ci: Trigger image builds on underlying workflow change --- .github/workflows/dev_dbt.yaml | 1 + .github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml | 1 + .github/workflows/dev_jupyterhub-keycloak-spark.yaml | 1 + .github/workflows/dev_nifi.yaml | 1 + 4 files changed, 4 insertions(+) diff --git a/.github/workflows/dev_dbt.yaml b/.github/workflows/dev_dbt.yaml index aaaa4aa0..fca4a7ae 100644 --- a/.github/workflows/dev_dbt.yaml +++ b/.github/workflows/dev_dbt.yaml @@ -13,6 +13,7 @@ on: - demos/airflow-scheduled-job/dbt/Dockerfile - demos/airflow-scheduled-job/dbt/requirements.txt - .github/workflows/dev_dbt.yaml + - .github/workflows/reusable_build_image.yaml jobs: build_image: diff --git a/.github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml b/.github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml index 97d2a6df..b29f4335 100644 --- a/.github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml +++ b/.github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml @@ -13,6 +13,7 @@ on: - demos/signal-processing/Dockerfile-jupyter - demos/signal-processing/requirements.txt - .github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml + - .github/workflows/reusable_build_image.yaml jobs: build_image: diff --git a/.github/workflows/dev_jupyterhub-keycloak-spark.yaml b/.github/workflows/dev_jupyterhub-keycloak-spark.yaml index a6d7aeef..74ea2d2e 100644 --- a/.github/workflows/dev_jupyterhub-keycloak-spark.yaml +++ b/.github/workflows/dev_jupyterhub-keycloak-spark.yaml @@ -14,6 +14,7 @@ on: paths: - demos/jupyterhub-keycloak/Dockerfile - .github/workflows/dev_jupyterhub-keycloak-spark.yaml + - .github/workflows/reusable_build_image.yaml jobs: build_image: diff --git a/.github/workflows/dev_nifi.yaml b/.github/workflows/dev_nifi.yaml index a765a763..0d8c5447 100644 --- a/.github/workflows/dev_nifi.yaml +++ b/.github/workflows/dev_nifi.yaml @@ -14,6 +14,7 @@ on: paths: - demos/signal-processing/Dockerfile-nifi - .github/workflows/dev_nifi.yaml + - .github/workflows/reusable_build_image.yaml jobs: build_image: From ec6e5a013a79d5bd2d9b60c736b133f60b2d7220 Mon Sep 17 00:00:00 2001 From: Techassi Date: Tue, 1 Sep 2026 15:05:40 +0200 Subject: [PATCH 5/8] ci: Bump stackabletech/actions to 0.18.0 --- .github/workflows/pr_pre-commit.yml | 2 +- .github/workflows/reusable_build_image.yaml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/pr_pre-commit.yml b/.github/workflows/pr_pre-commit.yml index 2377f3f4..3b4452d9 100644 --- a/.github/workflows/pr_pre-commit.yml +++ b/.github/workflows/pr_pre-commit.yml @@ -16,4 +16,4 @@ jobs: with: persist-credentials: false fetch-depth: 0 - - uses: stackabletech/actions/run-pre-commit@0fe048f952bee522474903a925ea48dc706a0bb4 # v0.17.5 + - uses: stackabletech/actions/run-pre-commit@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 diff --git a/.github/workflows/reusable_build_image.yaml b/.github/workflows/reusable_build_image.yaml index 2ad49964..75558365 100644 --- a/.github/workflows/reusable_build_image.yaml +++ b/.github/workflows/reusable_build_image.yaml @@ -45,7 +45,7 @@ jobs: CONTAINERFILE_PATH: ${{ inputs.containerfile-path }} IMAGE_VERSION: ${{ inputs.image-version }} IMAGE_NAME: ${{ inputs.image-name }} - uses: stackabletech/actions/build-container-image@0fe048f952bee522474903a925ea48dc706a0bb4 # v0.17.5 + uses: stackabletech/actions/build-container-image@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 with: image-name: ${{ env.IMAGE_NAME }} image-index-manifest-tag: ${{ env.IMAGE_VERSION }} @@ -54,7 +54,7 @@ jobs: - name: Publish Container Image on oci.stackable.tech env: IMAGE_NAME: ${{ inputs.image-name }} - uses: stackabletech/actions/publish-image@0fe048f952bee522474903a925ea48dc706a0bb4 # v0.17.5 + uses: stackabletech/actions/publish-image@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 with: image-registry-uri: oci.stackable.tech image-registry-username: robot$demos+github-action-build @@ -80,7 +80,7 @@ jobs: env: IMAGE_VERSION: ${{ inputs.image-version }} IMAGE_NAME: ${{ inputs.image-name }} - uses: stackabletech/actions/publish-image-index-manifest@0fe048f952bee522474903a925ea48dc706a0bb4 # v0.17.5 + uses: stackabletech/actions/publish-image-index-manifest@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 with: image-registry-uri: oci.stackable.tech image-registry-username: robot$demos+github-action-build From 5c0f79dfff0739f273fb81a37e9c6bca52885d5a Mon Sep 17 00:00:00 2001 From: Techassi Date: Tue, 1 Sep 2026 15:06:18 +0200 Subject: [PATCH 6/8] ci: Switch from pre-commit to prek --- .github/workflows/{pr_pre-commit.yml => pr_prek.yml} | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename .github/workflows/{pr_pre-commit.yml => pr_prek.yml} (68%) diff --git a/.github/workflows/pr_pre-commit.yml b/.github/workflows/pr_prek.yml similarity index 68% rename from .github/workflows/pr_pre-commit.yml rename to .github/workflows/pr_prek.yml index 3b4452d9..8c618ce1 100644 --- a/.github/workflows/pr_pre-commit.yml +++ b/.github/workflows/pr_prek.yml @@ -1,5 +1,5 @@ --- -name: pre-commit +name: prek permissions: {} on: @@ -7,7 +7,7 @@ on: merge_group: jobs: - pre-commit: + prek: runs-on: ubuntu-latest permissions: contents: read @@ -16,4 +16,4 @@ jobs: with: persist-credentials: false fetch-depth: 0 - - uses: stackabletech/actions/run-pre-commit@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 + - uses: stackabletech/actions/run-prek@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 From 97c5ce7f468410be1438f51f4f98d95131a2dad1 Mon Sep 17 00:00:00 2001 From: Techassi Date: Wed, 2 Sep 2026 16:53:45 +0200 Subject: [PATCH 7/8] chore: Apply suggestions Co-authored-by: Lukas Krug --- .github/workflows/reusable_build_image.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/reusable_build_image.yaml b/.github/workflows/reusable_build_image.yaml index 75558365..092b05d8 100644 --- a/.github/workflows/reusable_build_image.yaml +++ b/.github/workflows/reusable_build_image.yaml @@ -61,7 +61,8 @@ jobs: image-registry-password: ${{ secrets.harbor-robot-secret }} image-repository: demos/${{ env.IMAGE_NAME }} image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }} - source-image-uri: ${{ steps.build.outputs.image-manifest-uri }} +canonical-image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }} +canonical-source-image-uri: ${{ steps.build.outputs.image-manifest-uri }} publish_manifests: name: Build/Publish Manifest @@ -86,7 +87,7 @@ jobs: image-registry-username: robot$demos+github-action-build image-registry-password: ${{ secrets.harbor-robot-secret }} image-repository: demos/${{ env.IMAGE_NAME }} - image-index-manifest-tag: ${{ env.IMAGE_VERSION }} + canonical-image-index-manifest-tag: ${{ env.IMAGE_VERSION }} notify: name: Failure Notification From 3758c831c99de854e8b5cdf034b902cd0a570229 Mon Sep 17 00:00:00 2001 From: Techassi Date: Wed, 2 Sep 2026 16:55:10 +0200 Subject: [PATCH 8/8] ci: Fix indentation of previous suggestion --- .github/workflows/reusable_build_image.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/reusable_build_image.yaml b/.github/workflows/reusable_build_image.yaml index 092b05d8..1544e57f 100644 --- a/.github/workflows/reusable_build_image.yaml +++ b/.github/workflows/reusable_build_image.yaml @@ -61,8 +61,8 @@ jobs: image-registry-password: ${{ secrets.harbor-robot-secret }} image-repository: demos/${{ env.IMAGE_NAME }} image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }} -canonical-image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }} -canonical-source-image-uri: ${{ steps.build.outputs.image-manifest-uri }} + canonical-image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }} + canonical-source-image-uri: ${{ steps.build.outputs.image-manifest-uri }} publish_manifests: name: Build/Publish Manifest