Skip to content

Commit 4ba4fac

Browse files
Sharra-writesSharra-writes
authored
Merge branch 'main' into gha-hardening-pull-request-target
2 parents d044373 + 6f1c3a9 commit 4ba4fac

File tree

64 files changed

+782
-227
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+782
-227
lines changed

‎Dockerfile

Lines changed: 41 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -54,19 +54,28 @@ RUN --mount=type=secret,id=DOCS_BOT_PAT_BASE,mode=0444 \
5454
. ./build-scripts/fetch-repos.sh
5555

5656
# -----------------------------------------
57-
# DEPENDENCIES STAGE: Install node packages
57+
# PROD_DEPS STAGE: Install production dependencies
5858
# -----------------------------------------
59-
FROM base AS dependencies
59+
FROM base AS prod_deps
6060
USER node:node
6161
WORKDIR $APP_HOME
6262

6363
# Copy what is needed to run npm ci
6464
COPY --chown=node:node package.json package-lock.json ./
6565

66-
RUN npm ci --omit=optional --registry https://registry.npmjs.org/
66+
# Install only production dependencies (skip scripts to avoid husky)
67+
RUN npm ci --omit=dev --ignore-scripts --registry https://registry.npmjs.org/
6768

6869
# -----------------------------------------
69-
# BUILD STAGE: Prepare for production stage
70+
# ALL_DEPS STAGE: Install all dependencies on top of prod deps
71+
# -----------------------------------------
72+
FROM prod_deps AS all_deps
73+
74+
# Install dev dependencies on top of production ones
75+
RUN npm ci --registry https://registry.npmjs.org/
76+
77+
# -----------------------------------------
78+
# BUILD STAGE: Build the application
7079
# -----------------------------------------
7180
FROM base AS build
7281
USER node:node
@@ -84,14 +93,27 @@ COPY --chown=node:node --from=clones $APP_HOME/assets assets/
8493
COPY --chown=node:node --from=clones $APP_HOME/content content/
8594
COPY --chown=node:node --from=clones $APP_HOME/translations translations/
8695

87-
# From the dependencies stage
88-
COPY --chown=node:node --from=dependencies $APP_HOME/node_modules node_modules/
96+
# From the all_deps stage (need dev deps for build)
97+
COPY --chown=node:node --from=all_deps $APP_HOME/node_modules node_modules/
98+
99+
# Build the application
100+
RUN npm run build
101+
102+
# -----------------------------------------
103+
# WARMUP_CACHE STAGE: Warm up remote JSON cache
104+
# -----------------------------------------
105+
FROM build AS warmup_cache
106+
107+
# Generate remote JSON cache
108+
RUN npm run warmup-remotejson
89109

90-
# Generate build files
91-
RUN npm run build \
92-
&& npm run warmup-remotejson \
93-
&& npm run precompute-pageinfo -- --max-versions 2 \
94-
&& npm prune --production
110+
# -----------------------------------------
111+
# PRECOMPUTE STAGE: Precompute page info
112+
# -----------------------------------------
113+
FROM build AS precompute_stage
114+
115+
# Generate precomputed page info
116+
RUN npm run precompute-pageinfo -- --max-versions 2
95117

96118
# -------------------------------------------------
97119
# PRODUCTION STAGE: What will run on the containers
@@ -112,13 +134,17 @@ COPY --chown=node:node --from=clones $APP_HOME/assets assets/
112134
COPY --chown=node:node --from=clones $APP_HOME/content content/
113135
COPY --chown=node:node --from=clones $APP_HOME/translations translations/
114136

115-
# From dependencies stage (*modified in build stage)
116-
COPY --chown=node:node --from=build $APP_HOME/node_modules node_modules/
137+
# From prod_deps stage (production-only node_modules)
138+
COPY --chown=node:node --from=prod_deps $APP_HOME/node_modules node_modules/
117139

118140
# From build stage
119141
COPY --chown=node:node --from=build $APP_HOME/.next .next/
120-
COPY --chown=node:node --from=build $APP_HOME/.remotejson-cache ./
121-
COPY --chown=node:node --from=build $APP_HOME/.pageinfo-cache.json.br* ./
142+
143+
# From warmup_cache stage
144+
COPY --chown=node:node --from=warmup_cache $APP_HOME/.remotejson-cache ./
145+
146+
# From precompute_stage
147+
COPY --chown=node:node --from=precompute_stage $APP_HOME/.pageinfo-cache.json.br* ./
122148

123149
# This makes it possible to set `--build-arg BUILD_SHA=abc123`
124150
# and it then becomes available as an environment variable in the docker run.

‎assets/images/help/copilot/coding-agent/agents-page-input.png

21.2 KB
Loading

‎assets/images/help/copilot/coding-agent/agents-page.png

101 KB
Loading

‎assets/images/social-cards/copilot.png

3.66 KB
Loading

‎content/actions/how-tos/administering-github-actions/index.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ versions:
88
ghec: '*'
99
children:
1010
- /viewing-github-actions-metrics
11-
- /sharing-workflows-secrets-and-runners-with-your-organization
1211
- /making-retired-namespaces-available-on-ghecom
1312
redirect_from:
1413
- /actions/administering-github-actions

‎content/actions/how-tos/administering-github-actions/sharing-workflows-secrets-and-runners-with-your-organization.md

Lines changed: 0 additions & 69 deletions
This file was deleted.

‎content/actions/how-tos/security-for-github-actions/security-guides/using-secrets-in-github-actions.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ redirect_from:
1212
- /actions/security-guides/encrypted-secrets
1313
- /actions/security-guides/using-secrets-in-github-actions
1414
- /actions/security-for-github-actions/security-guides/using-secrets-in-github-actions
15+
- /actions/how-tos/administering-github-actions/sharing-workflows-secrets-and-runners-with-your-organization
1516
versions:
1617
fpt: '*'
1718
ghes: '*'

‎content/actions/how-tos/security-for-github-actions/using-artifact-attestations/index.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ children:
1111
- /using-artifact-attestations-and-reusable-workflows-to-achieve-slsa-v1-build-level-3
1212
- /enforcing-artifact-attestations-with-a-kubernetes-admission-controller
1313
- /verifying-attestations-offline
14+
- /managing-the-lifecycle-of-artifact-attestations
1415
redirect_from:
1516
- /actions/security-for-github-actions/using-artifact-attestations
1617
---

‎content/actions/how-tos/security-for-github-actions/using-artifact-attestations/managing-the-lifecycle-of-artifact-attestations.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
title: Managing the lifecycle of artifact attestations
3+
shortTitle: Manage attestations
4+
intro: Search for and delete attestations that you no longer need.
5+
versions:
6+
fpt: '*'
7+
ghec: '*'
8+
---
9+
10+
{% data reusables.actions.lifecycle-of-attestations %}
11+
12+
## Finding attestations
13+
14+
1. Navigate to the repository where the attestation was produced.
15+
{% data reusables.repositories.actions-tab %}
16+
1. In the left sidebar, under "Management," click **{% octicon "verified" aria-hidden="true" aria-label="verified" %} Attestations**.
17+
1. The attestations are sorted by creation date, newest first. Use the "Search or filter" bar to search for an attestation or filter the results.
18+
19+
### Searching and filtering
20+
21+
Enter **free text** to search by subject name. This returns all attestations with subject names that partially match your search string. Multiple attestations can have the same subject name.
22+
23+
Use the `created` filter to filter by creation date. To enter a custom date range, click today's date then edit the default query.
24+
25+
* For example: `created:<2025-04-03`.
26+
* Supported operators: `> <`.
27+
28+
Use the `predicate` filter to filter by the kind of attestation. A predicate is the type of claim that an attestation makes about an artifact, such as "this artifact was built during a particular workflow run and originates from this repository."
29+
30+
* Provenance attestations were created with the `attest-build-provenance` action.
31+
* SBOM attestations were created with the `attest-sbom` action.
32+
* Custom predicate type patterns are **not** supported in the search field, but are supported by the API.
33+
34+
## Deleting attestations
35+
36+
Before deleting an attestation, we recommend downloading a copy of it. Once the attestation is deleted, consumers with a verification process in place will **no longer be able to use the associated artifact**, and you will no longer be able to find the attestation on {% data variables.product.github %}.
37+
38+
1. In the list of attestations, select the checkbox next to the attestations you want to delete. You can select multiple attestations at a time.
39+
1. Click **{% octicon "trash" aria-hidden="true" aria-label="trash" %} Delete**.
40+
1. Read the message, then confirm by clicking **Delete attestations**.
41+
42+
## Managing attestations with the API
43+
44+
To manage attestations in bulk with the REST API, see [AUTOTITLE](/rest/users/attestations).

‎content/actions/how-tos/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -221,3 +221,9 @@ gh attestation verify PATH/TO/YOUR/BUILD/ARTIFACT-BINARY \
221221
--format json \
222222
--jq '.[].verificationResult.statement.predicate'
223223
```
224+
225+
## Managing the lifecycle of attestations
226+
227+
{% data reusables.actions.lifecycle-of-attestations %}
228+
229+
To find and delete attestations, see [AUTOTITLE](/actions/how-tos/security-for-github-actions/using-artifact-attestations/managing-the-lifecycle-of-artifact-attestations).

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy