crypt/step-ca
1
0
Fork 0
mirror of synced 2026-10-24 12:59:18 +03:00
Code Activity
5,769 Commits 50 Branches 245 Tags
master
Commit Graph

116 Commits

Author SHA1 Message Date
dependabot[bot]
11522db9fe build(deps): bump actions/checkout from 7.0.0 to 7.0.1 
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](9c091bb21b...3d3c42e5aa)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-23 15:02:00 +00:00
dependabot[bot]
8bfcef1ebe build(deps): bump actions/checkout from 6.0.3 to 7.0.0 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](df4cb1c069...9c091bb21b)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-22 15:32:52 +00:00
Max
3e9e8bee0c Delegate GitHub Release creation to goreleaser, tighten permissions (#2708) 
The explicit softprops/action-gh-release step was redundant: goreleaser
already creates the GitHub Release via its built-in release support
(configured with prerelease: auto in .goreleaser.yml). Removing the
intermediate create_release job simplifies the pipeline and eliminates
overly broad contents: write grants on the docker build jobs.

Change-Type: ci
Release-Note: no
Audience: internal
Impact: low
Breaking: false

Co-authored-by: Claude <noreply@anthropic.com>
 2026-06-10 21:54:41 -07:00
Herman Slatman
8a369ffe6c Fix pull-requests: write permission in triage workflow 2026-06-10 08:38:35 +02:00
dependabot[bot]
2a0760bb24 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](de0fac2e45...df4cb1c069)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-02 21:50:33 +00:00
Panagiotis Siatras
21483fac7f gh: aligned workflow permissions with smallstep/workflows#324 (#2688) 
* gh: aligned workflow permissions with smallstep/workflows#324

* gh: forwarded codeql secrets through code-scan-cron.yml
 2026-05-20 19:52:29 +05:30
dependabot[bot]
17f77689dd Bump softprops/action-gh-release from 2.6.1 to 3.0.0 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.6.1 to 3.0.0.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](153bb8e044...b430933298)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-13 16:51:54 +00:00
Herman Slatman
927ecc7baf Add actions and security-events permissions to release CI job (#2593) 
The release workflow's CI job was missing `actions: read` and
`security-events: write` permissions, which are required for
certain CI steps (e.g. uploading SARIF results or reading
workflow artifacts).

Change-Type: ci
Release-Note: no
Audience: internal
Impact: low
Breaking: false

Co-authored-by: Claude <noreply@anthropic.com>
 2026-03-17 12:02:17 -07:00
dependabot[bot]
62f536890b Bump softprops/action-gh-release from 2.5.0 to 2.6.1 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.5.0 to 2.6.1.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](a06a81a03e...153bb8e044)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-16 16:05:07 +00:00
Carl Tashian
b0c1c4b40e ci: Enable zizmor GitHub Advanced Security upload 
Public repos need to explicitly enable GHAS upload now that the
actionci.yml default has been changed to false.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-03 08:58:44 -08:00
Carl Tashian
015f0f265e Move codeql permissions to job level to satisfy zizmor 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-03 06:11:43 -08:00
Carl Tashian
cf1b1edb2f Add missing permissions for codeql job in goCI workflow 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-03 06:08:25 -08:00
Carl Tashian
dcf2db9ba6 ci: Replace separate actionlint/zizmor/frizbee with actionci.yml 
Consolidate the three separate workflow files into a single actionci.yml
that calls the shared workflow from smallstep/workflows.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-02 19:52:22 -08:00
Carl Tashian
0d683fa642 Add security-events: write to zizmor caller workflow 
The caller workflow's permissions are the ceiling for reusable
workflows. The zizmor-action needs security-events: write to
upload SARIF results to GitHub Advanced Security.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-02 18:43:01 -08:00
Carl Tashian
a7c332a121 Add explicit permissions blocks, remove excessive-permissions ignores 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-02 17:54:27 -08:00
Carl Tashian
14e5181f75 Add zizmor and frizbee CI checks 
Add caller workflows for zizmor (security scanning) and frizbee
(action pinning verification). Fix zizmor findings where applicable
and add suppression config for intentional patterns.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-02 17:44:33 -08:00
Carl Tashian
2866f1db07 Add least-privilege permissions to triage workflow 
Add explicit permissions: block (pull-requests: write, issues: write) to
constrain GITHUB_TOKEN scope on pull_request_target trigger.

Ref: https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-02 16:04:19 -08:00
dependabot[bot]
e08661be8d Bump actions/checkout from 6.0.1 to 6.0.2 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](8e8c483db8...de0fac2e45)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-26 17:14:47 +00:00
Carl Tashian
096faa94c9 Sync with CLI version 2026-01-08 09:32:24 -06:00
Carl Tashian
07d544cbcc Lint fixes 2026-01-07 13:28:20 -06:00
Carl Tashian
b73f8b108b Standalone workflow to publish packages 2026-01-07 12:48:41 -06:00
Herman Slatman
3e90f37689 Revert "Disable govulncheck until go 1.25.5 is available in github actions (#2490)" 
This reverts commit 8e76e290c0.
 2025-12-03 14:55:50 +01:00
Max
8e76e290c0 Disable govulncheck until go 1.25.5 is available in github actions (#2490) 2025-12-02 19:39:12 -08:00
dependabot[bot]
895e8c61bf Bump softprops/action-gh-release from 2.4.2 to 2.5.0 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.4.2 to 2.5.0.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](5be0e66d93...a06a81a03e)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-12-01 17:04:12 +00:00
dependabot[bot]
35702e7390 Bump softprops/action-gh-release from 2.4.1 to 2.4.2 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.4.1 to 2.4.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](6da8fa9354...5be0e66d93)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-11-10 16:36:17 +00:00
dependabot[bot]
ff3c08778f Bump softprops/action-gh-release from 2.3.4 to 2.4.1 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.3.4 to 2.4.1.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](62c96d0c4e...6da8fa9354)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-10-13 15:24:03 +00:00
dependabot[bot]
3a421512f2 Bump softprops/action-gh-release from 2.3.3 to 2.3.4 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.3.3 to 2.3.4.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](6cbd405e2c...62c96d0c4e)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-10-06 15:20:37 +00:00
dependabot[bot]
0adecdb845 Bump softprops/action-gh-release from 2.3.2 to 2.3.3 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.3.2 to 2.3.3.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](72f2c25fcb...6cbd405e2c)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-09-08 15:17:22 +00:00
dependabot[bot]
60faccdf6c Bump softprops/action-gh-release from 2.2.2 to 2.3.2 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.2.2 to 2.3.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](da05d55257...72f2c25fcb)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-06-16 17:07:34 +00:00
dependabot[bot]
d61c3d9971 Bump softprops/action-gh-release from 2.2.1 to 2.2.2 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.2.1 to 2.2.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](c95fe14893...da05d55257)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-04-21 16:22:00 +00:00
dependabot[bot]
9f50dd9030 Bump softprops/action-gh-release from 2.2.0 to 2.2.1 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.2.0 to 2.2.1.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](7b4da11513...c95fe14893)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-01-13 15:23:46 +00:00
dependabot[bot]
1bc4eded3b Bump softprops/action-gh-release from 2.1.0 to 2.2.0 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.1.0 to 2.2.0.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](01570a1f39...7b4da11513)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-12-16 16:06:37 +00:00
Joe Doss
2b4894a871 Configure GitHub Actions to publish RPMs and Debs to packages.smallstep.com. 2024-11-18 11:35:50 -06:00
dependabot[bot]
fc007dfd03 Bump softprops/action-gh-release from 2.0.9 to 2.1.0 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.0.9 to 2.1.0.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](e7a8f85e1c...01570a1f39)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-11-18 16:20:05 +00:00
dependabot[bot]
0a0dfc008e Bump softprops/action-gh-release from 2.0.8 to 2.0.9 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.0.8 to 2.0.9.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](c062e08bd5...e7a8f85e1c)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-11-04 15:17:26 +00:00
Max
364629e2a2 [ci] Missing permission in goreleaser job (#1993) 2024-09-13 10:05:38 -07:00
dependabot[bot]
2dda026392 Bump softprops/action-gh-release from 2.0.6 to 2.0.8 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.0.6 to 2.0.8.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](a74c6b72af...c062e08bd5)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-07-22 16:01:34 +00:00
Max
0a9dd62d8f [actions] use ref_name as release name (#1924) 2024-07-12 10:44:58 -07:00
Max
3978d2b859 Update changelog for 0.27.0 | add actionlint | update go.step.sm/crypto (#1923) 2024-07-11 22:00:41 -07:00
dependabot[bot]
fffffc60a8 Bump softprops/action-gh-release from 2.0.5 to 2.0.6 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.0.5 to 2.0.6.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](69320dbe05...a74c6b72af)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-06-24 15:07:24 +00:00
Max
890e81cb66 [actions] dependabot to common workflow | move to new release action (#1887) 2024-06-13 12:25:05 -07:00
dependabot[bot]
bf03d56ae4 Bump dependabot/fetch-metadata from 2.0.0 to 2.1.0 
Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 2.0.0 to 2.1.0.
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](https://github.com/dependabot/fetch-metadata/compare/v2.0.0...v2.1.0)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-04-29 15:35:42 +00:00
dependabot[bot]
014b4ef2c0 Bump dependabot/fetch-metadata from 1.6.0 to 2.0.0 
Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 1.6.0 to 2.0.0.
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](https://github.com/dependabot/fetch-metadata/compare/v1.6.0...v2.0.0)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-03-25 15:54:53 +00:00
Max
c451546cfb [action] fix actionlint warnings (#1598) 2023-10-23 19:22:26 +02:00
dependabot[bot]
f548c13e3e Bump dependabot/fetch-metadata from 1.1.1 to 1.6.0 
Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 1.1.1 to 1.6.0.
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](https://github.com/dependabot/fetch-metadata/compare/v1.1.1...v1.6.0)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-10-17 13:39:37 +00:00
Max
5758657b53 [action] remove gitleaks key from code-scan-cron (#1564) 2023-09-29 19:34:28 +02:00
Max
67d32685c7 [action] updated goCI workflow API (#1429) 2023-06-13 11:13:42 -07:00
Max
53c7774d3c [action] use common goreleaser workflow (#1427) 2023-06-09 16:28:44 -07:00
Max
99f9b2fb3e Update .github/workflows/release.yml 
Co-authored-by: Mariano Cano <mariano@smallstep.com>
 2023-04-12 18:31:35 -07:00
max furman
574351a8f7 [action] Fix docker image name in release workflow 2023-04-12 18:26:19 -07:00