From 012257e81c6fb5edbf632b04f29118ce19759dd2 Mon Sep 17 00:00:00 2001 From: attiasas Date: Tue, 21 Jul 2026 13:47:47 +0300 Subject: [PATCH 1/4] Add Build-Gate environment and checkout fix --- .github/workflows/analysis.yml | 1 + .github/workflows/build-gate.yml | 52 ++++++++++++++++++++++++ .github/workflows/test.yml | 70 ++++++++++++++++++-------------- 3 files changed, 92 insertions(+), 31 deletions(-) create mode 100644 .github/workflows/build-gate.yml diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml index d648b38b2..21decf28f 100644 --- a/.github/workflows/analysis.yml +++ b/.github/workflows/analysis.yml @@ -6,6 +6,7 @@ on: tags-ignore: - '**' pull_request: + types: [opened, synchronize, reopened] concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}-${{ github.ref }} cancel-in-progress: true diff --git a/.github/workflows/build-gate.yml b/.github/workflows/build-gate.yml new file mode 100644 index 000000000..1c64df99b --- /dev/null +++ b/.github/workflows/build-gate.yml @@ -0,0 +1,52 @@ +name: Build Gate +# Single approval gate for fork/PR runs: a maintainer approves the `build-gate` +# environment deployment once, releasing frogbot and the test suite. +# Replaces the per-workflow 'safe to test' label mechanism. +on: + pull_request_target: + types: [opened, synchronize, reopened] + branches: [dev] + push: + branches: [dev, main] + workflow_dispatch: + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: true + +permissions: + actions: read + pull-requests: write + contents: read + +jobs: + # The single approval point. `build-gate` carries the Required-reviewers rule. + # Trusted push & manual dispatch skip approval (empty environment name = no gate). + gate: + runs-on: ubuntu-latest + environment: ${{ github.event_name == 'pull_request_target' && 'build-gate' || '' }} + steps: + - run: echo "Approved — releasing frogbot and test suite." + + tests: + needs: gate + uses: ./.github/workflows/test.yml + secrets: inherit + + # Single, stable required status check. Point branch protection at + # "Build Gate / build-gate-success" instead of the matrix-expanded suite checks. + build-gate-success: + name: build-gate-success + if: always() + needs: + - gate + - tests + runs-on: ubuntu-latest + steps: + - name: Verify no suite failed or was cancelled + run: | + if ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}; then + echo "::error::One or more suites failed or were cancelled." + exit 1 + fi + echo "All suites succeeded (skipped suites are allowed)." diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 8822748c9..7000cf37f 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -6,19 +6,8 @@ permissions: pull-requests: write on: - push: - branches: - - '**' - tags-ignore: - - '**' - # Triggers the workflow on labeled PRs only. - pull_request_target: - types: [ labeled ] - -# Ensures that only the latest commit is running for each PR at a time. -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}-${{ github.ref }} - cancel-in-progress: true + workflow_call: + workflow_dispatch: # Environment variables shared across all jobs. env: @@ -33,19 +22,14 @@ env: jobs: Pretest: - if: contains(github.event.pull_request.labels.*.name, 'safe to test') || github.event_name == 'push' runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v5 with: - ref: ${{ github.event.pull_request.head.sha }} - - - name: Remove 'safe to test' label - uses: actions-ecosystem/action-remove-labels@v1 - if: ${{ github.event_name != 'push' }} - with: - labels: "safe to test" + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + allow-unsafe-pr-checkout: true - name: Start FastCI Optimization if: env.ENABLE_FASTCI_BOOST == 'true' @@ -74,7 +58,9 @@ jobs: - name: Checkout code uses: actions/checkout@v5 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + allow-unsafe-pr-checkout: true - name: Start FastCI Optimization if: env.ENABLE_FASTCI_BOOST == 'true' @@ -126,7 +112,9 @@ jobs: - name: Checkout code uses: actions/checkout@v5 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + allow-unsafe-pr-checkout: true - name: Start FastCI Optimization if: env.ENABLE_FASTCI_BOOST == 'true' @@ -156,7 +144,9 @@ jobs: - name: Checkout code uses: actions/checkout@v5 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + allow-unsafe-pr-checkout: true - name: Start FastCI Optimization if: env.ENABLE_FASTCI_BOOST == 'true' @@ -184,12 +174,16 @@ jobs: - name: Checkout code uses: actions/checkout@v5 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + allow-unsafe-pr-checkout: true + - name: Start FastCI Optimization if: env.ENABLE_FASTCI_BOOST == 'true' uses: jfrog/boost@v0 with: github_token: ${{secrets.GITHUB_TOKEN}} + - name: Install and Setup Dependencies uses: ./.github/actions/install-and-setup @@ -210,12 +204,16 @@ jobs: - name: Checkout code uses: actions/checkout@v5 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + allow-unsafe-pr-checkout: true + - name: Start FastCI Optimization if: env.ENABLE_FASTCI_BOOST == 'true' uses: jfrog/boost@v0 with: github_token: ${{secrets.GITHUB_TOKEN}} + - name: Install and Setup Dependencies uses: ./.github/actions/install-and-setup @@ -236,7 +234,9 @@ jobs: - name: Checkout code uses: actions/checkout@v5 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + allow-unsafe-pr-checkout: true - name: Start FastCI Optimization if: env.ENABLE_FASTCI_BOOST == 'true' @@ -264,7 +264,9 @@ jobs: - name: Checkout code uses: actions/checkout@v5 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + allow-unsafe-pr-checkout: true - name: Start FastCI Optimization if: env.ENABLE_FASTCI_BOOST == 'true' @@ -292,7 +294,9 @@ jobs: - name: Checkout code uses: actions/checkout@v5 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + allow-unsafe-pr-checkout: true - name: Start FastCI Optimization if: env.ENABLE_FASTCI_BOOST == 'true' @@ -320,7 +324,9 @@ jobs: - name: Checkout code uses: actions/checkout@v5 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + allow-unsafe-pr-checkout: true - name: Start FastCI Optimization if: env.ENABLE_FASTCI_BOOST == 'true' @@ -348,7 +354,9 @@ jobs: - name: Checkout code uses: actions/checkout@v5 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + allow-unsafe-pr-checkout: true - name: Start FastCI Optimization if: env.ENABLE_FASTCI_BOOST == 'true' From 2c5df67f18cabd2944b335844adb6f3f0b648bf2 Mon Sep 17 00:00:00 2001 From: attiasas Date: Tue, 21 Jul 2026 13:54:48 +0300 Subject: [PATCH 2/4] Update actions/checkout to v7 --- .github/workflows/analysis.yml | 8 ++++---- .github/workflows/embedded-jar-test.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/test.yml | 22 +++++++++++----------- 4 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml index 21decf28f..5b5818539 100644 --- a/.github/workflows/analysis.yml +++ b/.github/workflows/analysis.yml @@ -20,7 +20,7 @@ jobs: runs-on: ${{ matrix.os }}-latest steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha }} @@ -36,7 +36,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Source - uses: actions/checkout@v5 + uses: actions/checkout@v7 - name: Setup Go with cache uses: jfrog/.github/actions/install-go-with-cache@main @@ -56,7 +56,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Source - uses: actions/checkout@v5 + uses: actions/checkout@v7 - name: Setup Go with cache uses: jfrog/.github/actions/install-go-with-cache@main @@ -70,7 +70,7 @@ jobs: name: Spell Check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Check spelling uses: crate-ci/typos@master diff --git a/.github/workflows/embedded-jar-test.yml b/.github/workflows/embedded-jar-test.yml index 2a9ee7fac..b84607099 100644 --- a/.github/workflows/embedded-jar-test.yml +++ b/.github/workflows/embedded-jar-test.yml @@ -13,7 +13,7 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Download JARs run: buildscripts/download-jars.sh diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ab83df579..a33bb24a8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,7 +31,7 @@ jobs: echo "CI=true" >> $GITHUB_ENV - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: fetch-depth: 0 # fetch all branches so we can checkout main and merge dev token: ${{ secrets.RELEASE_GIT_TOKEN }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7000cf37f..0db55dd25 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -25,7 +25,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} persist-credentials: false @@ -56,7 +56,7 @@ jobs: steps: # Prepare the environment - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} persist-credentials: false @@ -110,7 +110,7 @@ jobs: steps: # Prepare the environment - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} persist-credentials: false @@ -142,7 +142,7 @@ jobs: steps: # Prepare the environment - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} persist-credentials: false @@ -172,7 +172,7 @@ jobs: steps: # Prepare the environment - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} persist-credentials: false @@ -202,7 +202,7 @@ jobs: steps: # Prepare the environment - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} persist-credentials: false @@ -232,7 +232,7 @@ jobs: steps: # Prepare the environment - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} persist-credentials: false @@ -262,7 +262,7 @@ jobs: steps: # Prepare the environment - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} persist-credentials: false @@ -292,7 +292,7 @@ jobs: steps: # Prepare the environment - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} persist-credentials: false @@ -322,7 +322,7 @@ jobs: steps: # Prepare the environment - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} persist-credentials: false @@ -352,7 +352,7 @@ jobs: steps: # Prepare the environment - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} persist-credentials: false From f9814da32ec0ae1d3468434fa0bc632526c6b341 Mon Sep 17 00:00:00 2001 From: attiasas Date: Tue, 21 Jul 2026 14:35:31 +0300 Subject: [PATCH 3/4] Use Frogbot V3 --- .../workflows/frogbot-scan-pull-request.yml | 47 ------------------- ...t-scan-repository.yml => frogbot-scan.yml} | 24 +++++++--- 2 files changed, 18 insertions(+), 53 deletions(-) delete mode 100644 .github/workflows/frogbot-scan-pull-request.yml rename .github/workflows/{frogbot-scan-repository.yml => frogbot-scan.yml} (57%) diff --git a/.github/workflows/frogbot-scan-pull-request.yml b/.github/workflows/frogbot-scan-pull-request.yml deleted file mode 100644 index 4afd0486d..000000000 --- a/.github/workflows/frogbot-scan-pull-request.yml +++ /dev/null @@ -1,47 +0,0 @@ -name: "Frogbot Scan Pull Request" -on: - pull_request_target: - types: [ opened, synchronize ] -permissions: - pull-requests: write - contents: read -jobs: - scan-pull-request: - runs-on: ubuntu-latest - # A pull request needs to be approved before Frogbot scans it. Any GitHub user who is associated with the - # "frogbot" GitHub environment can approve the pull request to be scanned. - environment: frogbot - steps: - - uses: jfrog/frogbot@v2 - env: - JFROG_CLI_LOG_LEVEL: "DEBUG" - # [Mandatory] - # JFrog platform URL (This functionality requires version 3.29.0 or above of Xray) - JF_URL: ${{ secrets.FROGBOT_URL }} - - # [Mandatory if JF_USER and JF_PASSWORD are not provided] - # JFrog access token with 'read' permissions on Xray service - JF_ACCESS_TOKEN: ${{ secrets.FROGBOT_ACCESS_TOKEN }} - - # [Mandatory] - # The GitHub token is automatically generated for the job - JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - # [Optional] - # Configure the SMTP server to enable Frogbot to send emails with detected secrets in pull request scans. - # SMTP server URL including should the relevant port: (Example: smtp.server.com:8080) - JF_SMTP_SERVER: ${{ secrets.JF_SMTP_SERVER }} - - # [Mandatory if JF_SMTP_SERVER is set] - # The username required for authenticating with the SMTP server. - JF_SMTP_USER: ${{ secrets.JF_SMTP_USER }} - - # [Mandatory if JF_SMTP_SERVER is set] - # The password associated with the username required for authentication with the SMTP server. - JF_SMTP_PASSWORD: ${{ secrets.JF_SMTP_PASSWORD }} - - # [Optional] - # List of comma separated email addresses to receive email notifications about secrets - # detected during pull request scanning. The notification is also sent to the email set - # in the committer git profile regardless of whether this variable is set or not. - JF_EMAIL_RECEIVERS: "eco-system@jfrog.com" \ No newline at end of file diff --git a/.github/workflows/frogbot-scan-repository.yml b/.github/workflows/frogbot-scan.yml similarity index 57% rename from .github/workflows/frogbot-scan-repository.yml rename to .github/workflows/frogbot-scan.yml index cb41bb516..5ce5aa046 100644 --- a/.github/workflows/frogbot-scan-repository.yml +++ b/.github/workflows/frogbot-scan.yml @@ -1,22 +1,34 @@ -name: "Frogbot Scan Repository" +name: "Frogbot Scan" on: + pull_request_target: + types: [ opened, synchronize ] workflow_dispatch: schedule: # The repository will be scanned once a day at 00:00 GMT. - cron: "0 0 * * *" + permissions: contents: write pull-requests: write security-events: write + jobs: - scan-repository: + frogbot-scan: runs-on: ubuntu-latest + # A pull request needs to be approved before Frogbot scans it. Any GitHub user who is associated with the + # "frogbot" GitHub environment can approve the pull request to be scanned. + environment: ${{ github.event_name == 'pull_request_target' && 'frogbot' || '' }} strategy: matrix: # The repository scanning will be triggered periodically on the following branches. - branch: [ "dev" ] + branch: [ "dev", "main" ] steps: - - uses: jfrog/frogbot@v2 + - name: Checkout code + uses: actions/checkout@v7 + with: + ref: ${{ github.event.pull_request.head.sha || github.sha }} + + - uses: jfrog/frogbot@v3 env: JFROG_CLI_LOG_LEVEL: "DEBUG" # [Mandatory] @@ -31,6 +43,6 @@ jobs: # The GitHub token is automatically generated for the job JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # [Mandatory] + # [Mandatory for repository scan] # The name of the branch on which Frogbot will perform the scan - JF_GIT_BASE_BRANCH: ${{ matrix.branch }} \ No newline at end of file + JF_GIT_BASE_BRANCH: ${{ github.event_name != 'pull_request_target' && matrix.branch || '' }} \ No newline at end of file From d765318d4ca6e627f6b3ceea61ea8a36f3e54717 Mon Sep 17 00:00:00 2001 From: attiasas Date: Tue, 21 Jul 2026 14:45:23 +0300 Subject: [PATCH 4/4] Improve triggers to Frogbot --- .github/workflows/frogbot-scan.yml | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/.github/workflows/frogbot-scan.yml b/.github/workflows/frogbot-scan.yml index 5ce5aa046..a8ac7ad9e 100644 --- a/.github/workflows/frogbot-scan.yml +++ b/.github/workflows/frogbot-scan.yml @@ -2,6 +2,9 @@ name: "Frogbot Scan" on: pull_request_target: types: [ opened, synchronize ] + branches: [ dev, main ] + push: + branches: [ dev, main ] workflow_dispatch: schedule: # The repository will be scanned once a day at 00:00 GMT. @@ -11,7 +14,7 @@ permissions: contents: write pull-requests: write security-events: write - + jobs: frogbot-scan: runs-on: ubuntu-latest @@ -20,14 +23,17 @@ jobs: environment: ${{ github.event_name == 'pull_request_target' && 'frogbot' || '' }} strategy: matrix: - # The repository scanning will be triggered periodically on the following branches. - branch: [ "dev", "main" ] + # Repository scans cover these branches; job `if` collapses push/PR to a single arm. + branch: [ dev, main ] + # schedule / dispatch → both arms; push → matching branch only; PR → base branch only (one PR scan). + if: | + github.event_name == 'schedule' || + github.event_name == 'workflow_dispatch' || + (github.event_name == 'push' && matrix.branch == github.ref_name) || + (github.event_name == 'pull_request_target' && matrix.branch == github.event.pull_request.base.ref) steps: - - name: Checkout code - uses: actions/checkout@v7 - with: - ref: ${{ github.event.pull_request.head.sha || github.sha }} - + # No checkout: Frogbot checks out the right refs itself. Avoids checking out untrusted PR + # heads under pull_request_target (secrets available). - uses: jfrog/frogbot@v3 env: JFROG_CLI_LOG_LEVEL: "DEBUG" @@ -45,4 +51,4 @@ jobs: # [Mandatory for repository scan] # The name of the branch on which Frogbot will perform the scan - JF_GIT_BASE_BRANCH: ${{ github.event_name != 'pull_request_target' && matrix.branch || '' }} \ No newline at end of file + JF_GIT_BASE_BRANCH: ${{ github.event_name != 'pull_request_target' && matrix.branch || '' }}