Test artifactory-oidc #791
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| name: Test Artifactory OIDC (Ruby) | ||
| on: workflow_dispatch | ||
|
|
||
| jobs: | ||
| test-oidc: | ||
| runs-on: ubuntu-x64 | ||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: twilio/sdk-actions/artifactory-oidc@dv/add-ruby-ecosystem | ||
|
There was a problem hiding this comment.
✨ Fixed in commit 1a98cef ✨ |
||
| with: | ||
| ecosystem: ruby | ||
| - uses: ruby/setup-ruby@v1 | ||
|
There was a problem hiding this comment.
🍰 Fixed in commit 1a98cef 🍰 |
||
| with: | ||
| ruby-version: "3.2" | ||
| - name: Verify Bundler mirror is configured | ||
| run: | | ||
| echo "Bundler config:" | ||
| bundle config mirror.https://rubygems.org/ | ||
| bundle config mirror.https://rubygems.org/ | grep -q "twilio.jfrog.io" \ | ||
| && echo "OK — mirror points to Artifactory" \ | ||
| || { echo "FAIL — mirror not set"; exit 1; } | ||
| - name: Test bundle install through Artifactory | ||
| run: | | ||
| bundle install --verbose 2>&1 | head -50 | ||
| echo "bundle install succeeded" | ||
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.🧁 Fixed in commit 1a98cef 🧁