Skip to content

RHIDP-11072: update workflows to be more secure #1647

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
themr0c merged 8 commits into from
Jan 8, 2026
Merged

RHIDP-11072: update workflows to be more secure #1647

themr0c merged 8 commits into from
Jan 8, 2026

Conversation

@Zaperex
Copy link
Member

@Zaperex Zaperex commented Dec 15, 2025 •
edited
Loading

Updates the pr.yaml workflow to not execute user controlled scripts.
This will necessitate that RHDH_BOT_TOKEN has read org member/team access for the redhat-developer org
IMPORTANT: Do Not Merge - To be merged by Docs Team Only

Version(s):

Issue: RHIDP-11072

Preview:

@Zaperex
chore: use secure script in gh actions
77fe616 
Signed-off-by: Frank Kong <[email protected]>

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED
@Zaperex
Merge branch 'main' of github.com:redhat-developer/red-hat-developers…
371e9e5 
…-documentation-rhdh into secure-workflow

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED
@rhdh-bot
Copy link
Collaborator

rhdh-bot commented Dec 15, 2025 •
edited
Loading

Updated preview: https://redhat-developer.github.io/red-hat-developers-documentation-rhdh/pr-1647/ @ 01/08/26 09:22:04

@Zaperex Zaperex marked this pull request as draft December 16, 2025 19:57
@Zaperex
chore: update authorize job to check for rhdh team
e29b59c 
Signed-off-by: Frank Kong <[email protected]>

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED
@Zaperex Zaperex marked this pull request as ready for review December 19, 2025 15:10
Zaperex added 3 commits January 7, 2026 10:37
@Zaperex
chore: update team membership check to use github app instead of PAT
a0e1d65 
Signed-off-by: Frank Kong <[email protected]>

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED
@Zaperex
Merge branch 'secure-workflow' of github.com:Zaperex/red-hat-develope…
f6473db 
…rs-documentation-rhdh into secure-workflow

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED
@Zaperex
Merge branch 'main' of github.com:redhat-developer/red-hat-developers…
b86f825 
…-documentation-rhdh into secure-workflow

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED
@sonarqubecloud
Copy link

sonarqubecloud bot commented Jan 7, 2026

Quality Gate Failed Quality Gate failed

Failed conditions
2 Security Hotspots

See analysis details on SonarQube Cloud

nickboldt
nickboldt reviewed Jan 7, 2026
View reviewed changes
@nickboldt nickboldt self-requested a review January 7, 2026 20:03
nickboldt
nickboldt approved these changes Jan 7, 2026
View reviewed changes
Copy link
Member

@nickboldt nickboldt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm label Jan 7, 2026
@themr0c themr0c merged commit f0a69af into redhat-developer:main Jan 8, 2026
4 of 5 checks passed
@themr0c
Copy link
Member

themr0c commented Jan 8, 2026

/cherry-pick release-1.8

@themr0c
Copy link
Member

themr0c commented Jan 8, 2026

/cherry-pick release-1.7

@openshift-cherrypick-robot
Copy link
Contributor

openshift-cherrypick-robot commented Jan 8, 2026

@themr0c: new pull request created: #1664

Details

In response to this:

/cherry-pick release-1.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

This was referenced Jan 8, 2026
Merged
Merged
@openshift-cherrypick-robot
Copy link
Contributor

openshift-cherrypick-robot commented Jan 8, 2026

@themr0c: new pull request created: #1665

Details

In response to this:

/cherry-pick release-1.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nickboldt nickboldt nickboldt approved these changes

@themr0c themr0c themr0c approved these changes

Assignees

@nickboldt nickboldt

Labels

lgtm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@Zaperex @rhdh-bot @themr0c @openshift-cherrypick-robot @nickboldt