Skip to content

Update gha #3733

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
briehl merged 5 commits into from
Jul 23, 2026
Merged

Update gha #3733

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
97bc661
Merge pull request #3706 from kbase/develop
briehl Aug 14, 2025
cfb1741
update GHA to use inherited github info
briehl Jul 15, 2026
f0bc4ce
move rest of workflows away from github secret tokens for pulling images
briehl Jul 16, 2026
692296a
fix flaws in GHA workflows found by copilot and sonarcloud, some quit…
briehl Jul 23, 2026
6c5e320
remove refs to GHCR_* secrets from other workflows
briehl Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 12 additions & 14 deletions .github/workflows/build_and_push_image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,16 +3,14 @@

on:
workflow_call:
secrets:
GHCR_USERNAME:
required: true
GHCR_TOKEN:
required: true

jobs:
docker_build_image:
if: github.event.pull_request.draft == false
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
Comment on lines +11 to +13
steps:
-
name: Check out GitHub Repo
Expand Down Expand Up @@ -42,17 +40,17 @@
run: echo "date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
-
name: Set up Docker Buildx
uses: docker/setup-buildx-action@master
uses: docker/setup-buildx-action@v4

Check failure on line 43 in .github/workflows/build_and_push_image.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=kbase_narrative&issues=AZ-Poa41qMHMw0ceJUfE&open=AZ-Poa41qMHMw0ceJUfE&pullRequest=3733

Check failure

Code scanning / SonarCloud

External GitHub Actions and workflows should be pinned to a commit hash High

Use full commit SHA hash for this dependency. See more on SonarQube Cloud
-
name: Log in to the Container registry
uses: docker/login-action@master
uses: docker/login-action@v4

Check failure on line 46 in .github/workflows/build_and_push_image.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=kbase_narrative&issues=AZ-Poa41qMHMw0ceJUfF&open=AZ-Poa41qMHMw0ceJUfF&pullRequest=3733

Check failure

Code scanning / SonarCloud

External GitHub Actions and workflows should be pinned to a commit hash High

Use full commit SHA hash for this dependency. See more on SonarQube Cloud
with:
registry: ghcr.io
username: ${{ secrets.GHCR_USERNAME }}
password: ${{ secrets.GHCR_TOKEN }}
username: ${{ github.actor }}
password: ${{ github.token }}
Comment on lines +49 to +50
-
name: Build narrative image
uses: docker/build-push-action@master
uses: docker/build-push-action@v7

Check failure on line 53 in .github/workflows/build_and_push_image.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=kbase_narrative&issues=AZ-Poa41qMHMw0ceJUfG&open=AZ-Poa41qMHMw0ceJUfG&pullRequest=3733

Check failure

Code scanning / SonarCloud

External GitHub Actions and workflows should be pinned to a commit hash High

Use full commit SHA hash for this dependency. See more on SonarQube Cloud
with:
context: .
file: ./Dockerfile
Expand All @@ -61,22 +59,22 @@
tags: ${{ env.APP_IMAGE_TAG }}
build-args: |
BRANCH=${{ github.head_ref }}
BUILD_DATE=${{ steps.date.output.date }}
BUILD_DATE=${{ steps.date.outputs.date }}
NARRATIVE_VERSION=${{ env.NARRATIVE_VERSION }}
VCS_REF=${{ github.sha }}
TAG='${{ github.ref }}'
-
name: Build version image
uses: docker/build-push-action@master
if: ${{ github.base_ref }} == 'main' || ${{ github.base_ref }} == 'develop'
uses: docker/build-push-action@v7

Check failure on line 68 in .github/workflows/build_and_push_image.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=kbase_narrative&issues=AZ-Poa41qMHMw0ceJUfH&open=AZ-Poa41qMHMw0ceJUfH&pullRequest=3733

Check failure

Code scanning / SonarCloud

External GitHub Actions and workflows should be pinned to a commit hash High

Use full commit SHA hash for this dependency. See more on SonarQube Cloud
if: ${{ github.base_ref == 'main' || github.base_ref == 'develop' }}
with:
Comment on lines 67 to 70
context: .
push: true
file: Dockerfile2
tags: ${{ env.APP_VERSION_IMAGE_TAG }}
build-args: |
BRANCH=${{ github.head_ref }}
BUILD_DATE=${{ steps.date.output.date }}
BUILD_DATE=${{ steps.date.outputs.date }}
NARRATIVE_VERSION=${{ env.NARRATIVE_VERSION }}
NARRATIVE_GIT_HASH=${{ env.NARRATIVE_GIT_HASH }}
VCS_REF=${{ github.sha }}
Expand Down
7 changes: 0 additions & 7 deletions .github/workflows/build_prodrc_pr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,22 +12,15 @@ on:
jobs:
run_build_and_push:
uses: ./.github/workflows/build_and_push_image.yml
secrets:
GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}

run_unit_tests:
uses: ./.github/workflows/unit_test.yml
needs: run_build_and_push
secrets:
GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

run_integration_tests:
uses: ./.github/workflows/integration_test.yml
needs: run_build_and_push
secrets:
GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
NARRATIVE_TEST_TOKEN: ${{ secrets.NARRATIVE_TEST_TOKEN }}
7 changes: 0 additions & 7 deletions .github/workflows/build_test_pr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,27 +12,20 @@
jobs:
run_build_and_push:
uses: ./.github/workflows/build_and_push_image.yml
secrets:
GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}

trivy-scans:
if: (github.base_ref == 'develop' || github.base_ref == 'main' ) && github.event.pull_request.merged == false
uses: kbase/.github/.github/workflows/reusable_trivy-scans.yml@main

Check failure on line 18 in .github/workflows/build_test_pr.yaml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=kbase_narrative&issues=AZ-PqQjIW6ZX7p0itQYX&open=AZ-PqQjIW6ZX7p0itQYX&pullRequest=3733
secrets: inherit

Check warning on line 19 in .github/workflows/build_test_pr.yaml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Only pass required secrets to this workflow. 


See more on https://sonarcloud.io/project/issues?id=kbase_narrative&issues=AZ-PqQjIW6ZX7p0itQYW&open=AZ-PqQjIW6ZX7p0itQYW&pullRequest=3733

run_unit_tests:
uses: ./.github/workflows/unit_test.yml
needs: run_build_and_push
secrets:
GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

run_integration_tests:
uses: ./.github/workflows/integration_test.yml
needs: run_build_and_push
secrets:
GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
NARRATIVE_TEST_TOKEN: ${{ secrets.NARRATIVE_TEST_TOKEN }}
14 changes: 6 additions & 8 deletions .github/workflows/integration_test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,27 +3,25 @@
on:
workflow_call:
secrets:
GHCR_USERNAME:
required: true
GHCR_TOKEN:
required: true
NARRATIVE_TEST_TOKEN:
required: true

jobs:
run_integration_tests:
runs-on: ubuntu-latest
permissions:
packages: read
steps:
-
name: Log in to the Container registry
uses: docker/login-action@master
uses: docker/login-action@v4

Check failure on line 17 in .github/workflows/integration_test.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=kbase_narrative&issues=AZ-Poa87qMHMw0ceJUfM&open=AZ-Poa87qMHMw0ceJUfM&pullRequest=3733

Check failure

Code scanning / SonarCloud

External GitHub Actions and workflows should be pinned to a commit hash High

Use full commit SHA hash for this dependency. See more on SonarQube Cloud
with:
registry: ghcr.io
username: ${{ secrets.GHCR_USERNAME }}
password: ${{ secrets.GHCR_TOKEN }}
username: ${{ github.actor }}
password: ${{ github.token }}
Comment on lines 19 to +21
-
name: Repo checkout
uses: actions/checkout@master
uses: actions/checkout@main
-
name: Set up environment
run: |
Expand Down Expand Up @@ -54,7 +52,7 @@
-
name: Install JS dependencies
run: |
npm ci

Check warning on line 55 in .github/workflows/integration_test.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--ignore-scripts" allows lifecycle scripts to run during package installation. 


See more on https://sonarcloud.io/project/issues?id=kbase_narrative&issues=AZ-Poa87qMHMw0ceJUfN&open=AZ-Poa87qMHMw0ceJUfN&pullRequest=3733
npm run install-npm
cp src/config.json kbase-extension/static/kbase/config/
-
Expand Down
8 changes: 5 additions & 3 deletions .github/workflows/tag_latest_image.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,18 +12,20 @@
docker_tag:
if: github.event.pull_request.merged == true
runs-on: ubuntu-latest
permissions:
packages: write
steps:
- name: Check out GitHub Repo
with:
ref: "${{ github.event.pull_request.head.sha }}"
uses: actions/checkout@master
-
name: Log in to the Container registry
uses: docker/login-action@master
uses: docker/login-action@v4

Check failure on line 24 in .github/workflows/tag_latest_image.yaml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=kbase_narrative&issues=AZ-Poa7IqMHMw0ceJUfI&open=AZ-Poa7IqMHMw0ceJUfI&pullRequest=3733

Check failure

Code scanning / SonarCloud

External GitHub Actions and workflows should be pinned to a commit hash High

Use full commit SHA hash for this dependency. See more on SonarQube Cloud
with:
registry: ghcr.io
username: ${{ secrets.GHCR_USERNAME }}
password: ${{ secrets.GHCR_TOKEN }}
username: ${{ github.actor }}
password: ${{ github.token }}
-
name: Set up environment
run: |
Expand Down
14 changes: 6 additions & 8 deletions .github/workflows/unit_test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,24 +3,22 @@
on:
workflow_call:
secrets:
GHCR_USERNAME:
required: true
GHCR_TOKEN:
required: true
CODECOV_TOKEN:
required: true

jobs:
run_unit_tests:
runs-on: ubuntu-latest
permissions:
packages: read
steps:
-
name: Log in to the Container registry
uses: docker/login-action@master
uses: docker/login-action@v4

Check failure on line 17 in .github/workflows/unit_test.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=kbase_narrative&issues=AZ-Poa7VqMHMw0ceJUfJ&open=AZ-Poa7VqMHMw0ceJUfJ&pullRequest=3733

Check failure

Code scanning / SonarCloud

External GitHub Actions and workflows should be pinned to a commit hash High

Use full commit SHA hash for this dependency. See more on SonarQube Cloud
with:
registry: ghcr.io
username: ${{ secrets.GHCR_USERNAME }}
password: ${{ secrets.GHCR_TOKEN }}
username: ${{ github.actor }}
password: ${{ github.token }}
Comment on lines 19 to +21
-
name: Repo checkout
uses: actions/checkout@master
Expand Down Expand Up @@ -64,7 +62,7 @@
-
name: Install JS dependencies
run: |
npm ci

Check warning on line 65 in .github/workflows/unit_test.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--ignore-scripts" allows lifecycle scripts to run during package installation. 


See more on https://sonarcloud.io/project/issues?id=kbase_narrative&issues=AZ-Poa7VqMHMw0ceJUfK&open=AZ-Poa7VqMHMw0ceJUfK&pullRequest=3733
npm run install-npm
cp src/config.json kbase-extension/static/kbase/config/
-
Expand All @@ -76,7 +74,7 @@
-
name: Send to Codecov
id: send_to_codecov
uses: codecov/codecov-action@main
uses: codecov/codecov-action@v7

Check failure on line 77 in .github/workflows/unit_test.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=kbase_narrative&issues=AZ-Poa7VqMHMw0ceJUfL&open=AZ-Poa7VqMHMw0ceJUfL&pullRequest=3733

Check failure

Code scanning / SonarCloud

External GitHub Actions and workflows should be pinned to a commit hash High

Use full commit SHA hash for this dependency. See more on SonarQube Cloud
continue-on-error: true
with:
token: ${{ secrets.CODECOV_TOKEN }}
Expand Down
Loading