From eea35794bc7af10527c02acd287225ec9b40cff5 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 11 Sep 2025 13:30:39 +0000 Subject: [PATCH 1/5] feat: update dependency-scan workflow to use common-actions Replace launchdarkly/gh-actions with launchdarkly/common-actions for SEC-7263. Update to use runs-on runner pattern and add proper artifacts configuration. Co-Authored-By: Patrick Kaeding --- .github/workflows/dependency-scan.yml | 30 ++++++++++++++++++--------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml index b02211d80..028ccff0d 100644 --- a/.github/workflows/dependency-scan.yml +++ b/.github/workflows/dependency-scan.yml @@ -1,20 +1,30 @@ name: Dependency Scan -on: pull_request +on: + pull_request: + push: + branches: + - main jobs: - dependency-scan: - runs-on: ubuntu-latest + generate-nodejs-sbom: + runs-on: runs-on=${{ github.run_id }}/runner=ubuntu22-2cpu-8gb-x64 steps: - - name: Setup Go - uses: actions/setup-go@v5 - with: - go-version: 'stable' + - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3 + - uses: launchdarkly/common-actions/init@main - name: Generate SBOM - uses: launchdarkly/gh-actions/actions/dependency-scan/generate-sbom@main + uses: launchdarkly/common-actions/dependency-scan/generate-sbom@main with: - types: 'go,nodejs' + types: 'nodejs' + evaluate-policy: + runs-on: runs-on=${{ github.run_id }}/runner=ubuntu22-2cpu-8gb-x64 + needs: + - generate-nodejs-sbom + steps: + - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3 - name: Evaluate SBOM Policy - uses: launchdarkly/gh-actions/actions/dependency-scan/evaluate-policy@main + uses: launchdarkly/common-actions/dependency-scan/evaluate-policy@main + with: + artifacts-pattern: bom-* From 1ad5d981e1235b3cb97b9c1ac4301077dbe895e2 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 11 Sep 2025 13:34:40 +0000 Subject: [PATCH 2/5] fix: add permissions to dependency-scan workflow jobs Add id-token: write and contents: read permissions to both generate-nodejs-sbom and evaluate-policy jobs to enable access to private launchdarkly/common-actions repository. Co-Authored-By: Patrick Kaeding --- .github/workflows/dependency-scan.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml index 028ccff0d..e74670442 100644 --- a/.github/workflows/dependency-scan.yml +++ b/.github/workflows/dependency-scan.yml @@ -9,6 +9,9 @@ on: jobs: generate-nodejs-sbom: runs-on: runs-on=${{ github.run_id }}/runner=ubuntu22-2cpu-8gb-x64 + permissions: + id-token: write + contents: read steps: - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3 - uses: launchdarkly/common-actions/init@main @@ -20,6 +23,9 @@ jobs: evaluate-policy: runs-on: runs-on=${{ github.run_id }}/runner=ubuntu22-2cpu-8gb-x64 + permissions: + id-token: write + contents: read needs: - generate-nodejs-sbom steps: From 6143d70e23bd4469a020062d6c8222fab35ef116 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 11 Sep 2025 13:37:39 +0000 Subject: [PATCH 3/5] fix: add custom GitHub token authentication to dependency-scan workflow Add CUSTOM_GITHUB_TOKEN retrieval via release-secrets action to both jobs to enable access to private launchdarkly/common-actions repository. Co-Authored-By: Patrick Kaeding --- .github/workflows/dependency-scan.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml index e74670442..4ed86abe9 100644 --- a/.github/workflows/dependency-scan.yml +++ b/.github/workflows/dependency-scan.yml @@ -13,8 +13,16 @@ jobs: id-token: write contents: read steps: + - name: Get Tokens + uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0 + with: + aws_assume_role: ${{ vars.AWS_ROLE_ARN }} + ssm_parameter_pairs: '/production/common/launchpad-ui/gh-pat-token = CUSTOM_GITHUB_TOKEN' + - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3 - uses: launchdarkly/common-actions/init@main + with: + token: ${{ env.CUSTOM_GITHUB_TOKEN }} - name: Generate SBOM uses: launchdarkly/common-actions/dependency-scan/generate-sbom@main @@ -29,8 +37,16 @@ jobs: needs: - generate-nodejs-sbom steps: + - name: Get Tokens + uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0 + with: + aws_assume_role: ${{ vars.AWS_ROLE_ARN }} + ssm_parameter_pairs: '/production/common/launchpad-ui/gh-pat-token = CUSTOM_GITHUB_TOKEN' + - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3 - name: Evaluate SBOM Policy uses: launchdarkly/common-actions/dependency-scan/evaluate-policy@main with: artifacts-pattern: bom-* + env: + GITHUB_TOKEN: ${{ env.CUSTOM_GITHUB_TOKEN }} From e3988d9be1c95425be25d2c6a6c09e7f2a280ad1 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 11 Sep 2025 13:54:16 +0000 Subject: [PATCH 4/5] fix: revert to use launchdarkly/gh-actions for public repo access Switch from private common-actions to public gh-actions for SEC-7263. Simplify workflow structure to match working implementation. Co-Authored-By: Patrick Kaeding --- .github/workflows/dependency-scan.yml | 23 +++-------------------- 1 file changed, 3 insertions(+), 20 deletions(-) diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml index 4ed86abe9..b160def1a 100644 --- a/.github/workflows/dependency-scan.yml +++ b/.github/workflows/dependency-scan.yml @@ -13,19 +13,11 @@ jobs: id-token: write contents: read steps: - - name: Get Tokens - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0 - with: - aws_assume_role: ${{ vars.AWS_ROLE_ARN }} - ssm_parameter_pairs: '/production/common/launchpad-ui/gh-pat-token = CUSTOM_GITHUB_TOKEN' - - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3 - - uses: launchdarkly/common-actions/init@main - with: - token: ${{ env.CUSTOM_GITHUB_TOKEN }} + - uses: actions/checkout@v4 - name: Generate SBOM - uses: launchdarkly/common-actions/dependency-scan/generate-sbom@main + uses: launchdarkly/gh-actions/actions/dependency-scan/generate-sbom@main with: types: 'nodejs' @@ -37,16 +29,7 @@ jobs: needs: - generate-nodejs-sbom steps: - - name: Get Tokens - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0 - with: - aws_assume_role: ${{ vars.AWS_ROLE_ARN }} - ssm_parameter_pairs: '/production/common/launchpad-ui/gh-pat-token = CUSTOM_GITHUB_TOKEN' - - - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3 - name: Evaluate SBOM Policy - uses: launchdarkly/common-actions/dependency-scan/evaluate-policy@main + uses: launchdarkly/gh-actions/actions/dependency-scan/evaluate-policy@main with: artifacts-pattern: bom-* - env: - GITHUB_TOKEN: ${{ env.CUSTOM_GITHUB_TOKEN }} From 82aa2cbfdde56957a336437e5c1a544c3e04f550 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 11 Sep 2025 13:56:09 +0000 Subject: [PATCH 5/5] fix: use ubuntu-latest runner instead of custom runner spec Remove custom runs-on configuration that was causing runner resolution failures. Simplify to standard ubuntu-latest for SEC-7263. Co-Authored-By: Patrick Kaeding --- .github/workflows/dependency-scan.yml | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml index b160def1a..20528e67b 100644 --- a/.github/workflows/dependency-scan.yml +++ b/.github/workflows/dependency-scan.yml @@ -8,12 +8,8 @@ on: jobs: generate-nodejs-sbom: - runs-on: runs-on=${{ github.run_id }}/runner=ubuntu22-2cpu-8gb-x64 - permissions: - id-token: write - contents: read + runs-on: ubuntu-latest steps: - - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3 - uses: actions/checkout@v4 - name: Generate SBOM @@ -22,10 +18,7 @@ jobs: types: 'nodejs' evaluate-policy: - runs-on: runs-on=${{ github.run_id }}/runner=ubuntu22-2cpu-8gb-x64 - permissions: - id-token: write - contents: read + runs-on: ubuntu-latest needs: - generate-nodejs-sbom steps: