15 commits

Author	SHA1	Message	Date
Alex Pyrgiotis	3eac00b873	ci: Work with image tarballs that are not tagged as 'latest' ... Now that our image tarball is not tagged as 'latest', we must first grab the image tag first, and then refer to it. We can grab the tag either from `share/image-id.txt` (if available) or with: docker load dangerzone.rocks/dangerzone --format {{ .Tag }}	2024-12-10 11:31:39 +02:00
Alexis Métaireau	9d69e3b261	CI: Do not scan release assets for mac silicon for now.	2024-11-25 18:54:46 +01:00
Alexis Métaireau	20354e7c11	CI: Use grep + cut rather than jq to get the version number ... Github macOS runners don't come with `jq` pre-installed.	2024-11-21 12:34:15 +01:00
Alexis Métaireau	944d58dd8d	CI: Update container scanning to account for the arm64 architecture.	2024-11-20 17:12:20 +01:00
Alex Pyrgiotis	96aa56a6dc	Remove version prefix v from container filename	2024-11-06 13:53:52 +02:00
Alex Pyrgiotis	91932046f5	ci: Use the new container filename in our assets ... The filename of the container image tarball that we published in our release assets has changed from `container.tar.gz` to `container-0.8.0-i686.tar.gz`. Change the scan action accordingly.	2024-11-06 13:41:37 +02:00
Alexis Métaireau	00480551ca	build: use the version-less container released-asset for now	2024-10-31 18:27:53 +01:00
Alexis Métaireau	f540a67d06	Update RELEASE.md to upload container.tar.gz for both i686 and arm64 architectures.	2024-10-30 19:11:24 +01:00
dependabot[bot]	941131f7a9	build(deps): bump anchore/scan-action from 4 to 5 ... Bumps [anchore/scan-action](https://github.com/anchore/scan-action) from 4 to 5. - [Release notes](https://github.com/anchore/scan-action/releases) - [Changelog](https://github.com/anchore/scan-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/anchore/scan-action/compare/v4...v5) --- updated-dependencies: - dependency-name: anchore/scan-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2024-10-16 17:52:33 +03:00
dependabot[bot]	069359ef15	build(deps): bump anchore/scan-action from 3 to 4 ... Bumps [anchore/scan-action](https://github.com/anchore/scan-action) from 3 to 4. - [Release notes](https://github.com/anchore/scan-action/releases) - [Changelog](https://github.com/anchore/scan-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/anchore/scan-action/compare/v3...v4) --- updated-dependencies: - dependency-name: anchore/scan-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2024-07-24 15:10:51 +03:00
Alex Pyrgiotis	2da0e993a2	Add a manual way to trigger GitHub Actions workflows	2024-07-10 18:23:17 +03:00
Naglis Jonaitis	7c4e62954f	Update GitHub actions ... The `checkout`, `setup-python`, `upload-artifact` and `download-artifact` actions produce warnings about deprecated Node.js 16. Update the actions to use Node.js 20.	2024-04-09 14:39:26 +03:00
deeplow	22ab6f65bf	Bump CodeQL upload action to V3 due to deprecation ... The following warning was showing up in our conversion logs [1]: | Warning: CodeQL Action v2 will be deprecated on December 5th, 2024. | Please update all occurrences of the CodeQL Action in your workflow | files to v3. For more information, see https://github.blog/changelog/2024-01-12-code-scanning-deprecation-of-codeql-action-v2/ [1]: https://github.com/freedomofpress/dangerzone/actions/runs/7916735564/job/21611227503?pr=718	2024-02-15 14:40:33 +00:00
Alex Pyrgiotis	7f50ad2e48	ci: Make our security scans stricter ... Our security scans previously alerted us on critical CVEs that have a fix. In this commit, we ask to be alerted on CVEs that don't have a fix yet, so that we can have them in our radar. Since the introduction of these security checks, we have only once encountered a case where our container was vulnerable to a CVE that Alpine Linux had not fixed yet. This means that the maintenance burden of this change will probably be minimal.	2023-12-06 17:57:19 +02:00
Alex Pyrgiotis	75be9b5c00	ci: Add security scanning ... Add two GitHub Actions workflows, that perform the following checks: * Security scan the Python dependencies of the Dangerzone application (`poetry.lock`), for the current/main branch. * Build and security scan the Dangerzone container image for the current/main branch. * Security scan the Python dependencies of the Dangerzone application (`poetry.lock`), for the latest release of Dangerzone (currently v0.4.1). * Download and security scan the Dangerzone container image for the latest release of Dangerzone (currently v0.4.1). The first two checks will run on branch pushes, PRs, and nightly. The last two checks will run only nightly, since the code in the current branch cannot affect already released artifacts. Also, besides the security scans, these workflows will also update the Security alerts in the GitHub page for the Dangerzone project, and print the SARIF report to the stdout, for debugging purposes. Closes #222	2023-05-17 20:29:13 +03:00