From c140036a1e24a97d6804d6ccaad9cf14f851c7e4 Mon Sep 17 00:00:00 2001 From: Bill Wagner Date: Wed, 28 Oct 2026 13:28:34 -0400 Subject: [PATCH 1/2] separate OPS status workflow Create a security boundary between creating the OPS status, and writing the updates on the target PR. --- .github/workflows/ops-build-publisher.yml | 45 +++++++++++++++++++++++ .github/workflows/ops-build-reporter.yml | 29 +++++++++------ 2 files changed, 63 insertions(+), 11 deletions(-) create mode 100644 .github/workflows/ops-build-publisher.yml diff --git a/.github/workflows/ops-build-publisher.yml b/.github/workflows/ops-build-publisher.yml new file mode 100644 index 00000000000..6943407ef16 --- /dev/null +++ b/.github/workflows/ops-build-publisher.yml @@ -0,0 +1,45 @@ +name: 'Publish OPS build report' + +on: + workflow_run: + workflows: ['OPS build reporter'] + types: [completed] + +permissions: + actions: read + pull-requests: write + checks: write + +jobs: + publish: + name: Publish OPS diagnostics and previews + if: >- + github.event.workflow_run.event == 'pull_request' && + (github.event.workflow_run.conclusion == 'success' || + github.event.workflow_run.conclusion == 'failure') + runs-on: ubuntu-latest + timeout-minutes: 10 + concurrency: + group: ops-publish-${{ github.repository }}-${{ github.event.workflow_run.head_repository.id }}-${{ github.event.workflow_run.head_branch }} + cancel-in-progress: false + steps: + - name: Harden Runner + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + with: + egress-policy: audit + + - name: Download producer report + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: ops-build-report + path: ${{ runner.temp }}/ops-build-report-download + run-id: ${{ github.event.workflow_run.id }} + github-token: ${{ github.token }} + + - name: Publish validated report + uses: dotnet/docs-actions/ops-build-reporter/publish@main + with: + repo_token: ${{ github.token }} + artifact_directory: ${{ runner.temp }}/ops-build-report-download + producer_workflow_file: .github/workflows/ops-build-reporter.yml + annotate_file_warnings: true diff --git a/.github/workflows/ops-build-reporter.yml b/.github/workflows/ops-build-reporter.yml index e043cacd8ad..a542fc8729d 100644 --- a/.github/workflows/ops-build-reporter.yml +++ b/.github/workflows/ops-build-reporter.yml @@ -1,28 +1,35 @@ name: 'OPS build reporter' on: - pull_request_target: + pull_request: types: [opened, synchronize, reopened] permissions: - contents: read + statuses: read jobs: - ops_build_reporter_job: - name: Add preview links and annotate files + report: + name: Collect OPS diagnostics and previews runs-on: ubuntu-latest - permissions: - statuses: read - checks: write - pull-requests: write + timeout-minutes: 65 steps: - name: Harden Runner uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: audit - - uses: dotnet/docs-actions/ops-build-reporter@cdb3719bab6025f7621b04044094048f597b1ae0 # main + - name: Produce report artifacts + id: report + uses: dotnet/docs-actions/ops-build-reporter@main with: - repo_token: ${{ secrets.GITHUB_TOKEN }} + repo_token: ${{ github.token }} max_wait_time_minutes: 40 - annotate_file_warnings: true + + - name: Upload report + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 + with: + name: ops-build-report + path: ${{ steps.report.outputs.artifact_path }} + if-no-files-found: error + retention-days: 7 + overwrite: true From 06c19caf09d97e744c373b50ba9f9baa82961440 Mon Sep 17 00:00:00 2001 From: Bill Wagner Date: Wed, 28 Oct 2026 13:30:58 -0400 Subject: [PATCH 2/2] pin actions to commit SHA Pin all actions to use the commit SHA. --- .github/workflows/check-for-build-warnings.yml | 2 +- .github/workflows/live-protection.yml | 2 +- .github/workflows/ops-build-publisher.yml | 2 +- .github/workflows/ops-build-reporter.yml | 2 +- .github/workflows/quest-bulk.yml | 6 +++--- .github/workflows/quest.yml | 8 ++++---- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/check-for-build-warnings.yml b/.github/workflows/check-for-build-warnings.yml index ad8c698a4c8..2cd2269d039 100644 --- a/.github/workflows/check-for-build-warnings.yml +++ b/.github/workflows/check-for-build-warnings.yml @@ -20,6 +20,6 @@ jobs: with: egress-policy: audit - - uses: dotnet/docs-actions/status-checker@cdb3719bab6025f7621b04044094048f597b1ae0 # main + - uses: dotnet/docs-actions/status-checker@e92e67a4b93ea5976eea3d65af4b2082818c7045 # main with: repo_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/live-protection.yml b/.github/workflows/live-protection.yml index 3177ee03d88..40b44b78393 100644 --- a/.github/workflows/live-protection.yml +++ b/.github/workflows/live-protection.yml @@ -15,7 +15,7 @@ jobs: with: egress-policy: audit - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # 3a2844b7e9c422d3c10d287c895573f7108da1b3 env: LIVE_BASE: ${{ github.base_ref == 'live' && github.head_ref != 'main' }} with: diff --git a/.github/workflows/ops-build-publisher.yml b/.github/workflows/ops-build-publisher.yml index 6943407ef16..d0507eef8f3 100644 --- a/.github/workflows/ops-build-publisher.yml +++ b/.github/workflows/ops-build-publisher.yml @@ -37,7 +37,7 @@ jobs: github-token: ${{ github.token }} - name: Publish validated report - uses: dotnet/docs-actions/ops-build-reporter/publish@main + uses: dotnet/docs-actions/ops-build-reporter/publish@e92e67a4b93ea5976eea3d65af4b2082818c7045 # main with: repo_token: ${{ github.token }} artifact_directory: ${{ runner.temp }}/ops-build-report-download diff --git a/.github/workflows/ops-build-reporter.yml b/.github/workflows/ops-build-reporter.yml index a542fc8729d..e6f3331fe46 100644 --- a/.github/workflows/ops-build-reporter.yml +++ b/.github/workflows/ops-build-reporter.yml @@ -20,7 +20,7 @@ jobs: - name: Produce report artifacts id: report - uses: dotnet/docs-actions/ops-build-reporter@main + uses: dotnet/docs-actions/ops-build-reporter@e92e67a4b93ea5976eea3d65af4b2082818c7045 # main with: repo_token: ${{ github.token }} max_wait_time_minutes: 40 diff --git a/.github/workflows/quest-bulk.yml b/.github/workflows/quest-bulk.yml index 8817f30e194..787287361b7 100644 --- a/.github/workflows/quest-bulk.yml +++ b/.github/workflows/quest-bulk.yml @@ -33,7 +33,7 @@ jobs: - name: Azure OpenID Connect id: azure-oidc-auth - uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main + uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main with: client-id: ${{ secrets.CLIENT_ID }} tenant-id: ${{ secrets.TENANT_ID }} @@ -41,7 +41,7 @@ jobs: - name: Azure DevOps OpenID Connect id: azure-devops-oidc-auth - uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main + uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main with: client-id: ${{ secrets.CLIENT_ID }} tenant-id: ${{ secrets.TENANT_ID }} @@ -49,7 +49,7 @@ jobs: - name: bulk-sequester id: bulk-sequester - uses: dotnet/docs-tools/.github/actions/sequester@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main + uses: dotnet/docs-tools/.github/actions/sequester@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main env: ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }} ImportOptions__ApiKeys__QuestAccessToken: ${{ steps.azure-devops-oidc-auth.outputs.access-token }} diff --git a/.github/workflows/quest.yml b/.github/workflows/quest.yml index a1ee12ce628..9e6b7a47f04 100644 --- a/.github/workflows/quest.yml +++ b/.github/workflows/quest.yml @@ -36,7 +36,7 @@ jobs: - name: Azure OpenID Connect id: azure-oidc-auth - uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main + uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main with: client-id: ${{ secrets.CLIENT_ID }} tenant-id: ${{ secrets.TENANT_ID }} @@ -44,7 +44,7 @@ jobs: - name: Azure DevOps OpenID Connect for manual test runs id: azure-devops-oidc-auth - uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main + uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main with: client-id: ${{ secrets.CLIENT_ID }} tenant-id: ${{ secrets.TENANT_ID }} @@ -54,7 +54,7 @@ jobs: - name: manual-sequester if: ${{ github.event_name == 'workflow_dispatch' }} id: manual-sequester - uses: dotnet/docs-tools/.github/actions/sequester@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main + uses: dotnet/docs-tools/.github/actions/sequester@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main env: ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }} ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }} @@ -70,7 +70,7 @@ jobs: - name: auto-sequester if: ${{ github.event_name != 'workflow_dispatch' }} id: auto-sequester - uses: dotnet/docs-tools/.github/actions/sequester@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main + uses: dotnet/docs-tools/.github/actions/sequester@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main env: ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }} ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }}