Skip to content

Commit 0150bac

Browse files
nusantara-selfnusantara-self
authored
Merge pull request #1489 from TheHive-Project/ci-dependencies-update-1
CI Dependencies update
2 parents ea678c0 + 5a83e3b commit 0150bac

5 files changed

Lines changed: 36 additions & 33 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 31 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
responders_matrix: ${{ steps.set-matrix.outputs.responders_matrix }}
2828
steps:
2929
- name: Checkout repository
30-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
30+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3131
with:
3232
fetch-depth: 0
3333

@@ -101,12 +101,12 @@ jobs:
101101
matrix: ${{ fromJson(needs.generate-matrix.outputs.analyzers_matrix_a) }}
102102
steps:
103103
- name: Checkout repository
104-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
104+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
105105
with:
106106
fetch-depth: 0
107107

108108
- name: GHCR Login
109-
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
109+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
110110
with:
111111
registry: ghcr.io
112112
username: ${{ github.actor }}
@@ -282,23 +282,24 @@ jobs:
282282
# Only install QEMU when we actually build AND arm64 is targeted
283283
- name: Set up QEMU
284284
if: steps.check-rebuild.outputs.rebuild == 'true' && contains(env.PLATFORMS, 'linux/arm64')
285-
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
285+
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
286286

287287
# Buildx is only needed when we build (and for imagetools)
288288
- name: Set up Docker Buildx
289289
if: steps.check-rebuild.outputs.rebuild == 'true'
290-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
290+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
291291

292292
- name: Build and push multi-arch image to GHCR
293293
if: steps.check-rebuild.outputs.rebuild == 'true'
294-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
294+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
295295
with:
296296
context: analyzers/${{ matrix.directory }}
297297
file: ./analyzers/${{ matrix.directory }}/Dockerfile
298298
platforms: ${{ env.PLATFORMS }}
299299
push: true
300300
tags: ${{ env.IMAGE_TAGS }}
301301
build-args: REQUIREMENTS=${{ env.REQUIREMENTS }}
302+
no-cache: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
302303
cache-from: type=gha
303304
cache-to: type=gha,mode=max,scope=shared
304305
labels: |
@@ -347,7 +348,7 @@ jobs:
347348
348349
- name: Scan image for vulnerabilities (Trivy)
349350
if: steps.check-rebuild.outputs.rebuild == 'true'
350-
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
351+
uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # 0.36.0
351352
with:
352353
image-ref: ${{ steps.get-digest.outputs.IMAGE_DIGEST }}
353354
format: sarif
@@ -361,7 +362,7 @@ jobs:
361362

362363
- name: Upload Trivy scan results to GitHub Security tab
363364
if: steps.check-rebuild.outputs.rebuild == 'true'
364-
uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
365+
uses: github/codeql-action/upload-sarif@faaa5d804fc648d0fdb28822a8e36cf7d0a6132c # v4.37.7
365366
with:
366367
sarif_file: trivy.sarif
367368
category: trivy-${{ matrix.directory }}
@@ -585,12 +586,12 @@ jobs:
585586
matrix: ${{ fromJson(needs.generate-matrix.outputs.analyzers_matrix_b) }}
586587
steps:
587588
- name: Checkout repository
588-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
589+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
589590
with:
590591
fetch-depth: 0
591592

592593
- name: GHCR Login
593-
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
594+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
594595
with:
595596
registry: ghcr.io
596597
username: ${{ github.actor }}
@@ -766,23 +767,24 @@ jobs:
766767
# Only install QEMU when we actually build AND arm64 is targeted
767768
- name: Set up QEMU
768769
if: steps.check-rebuild.outputs.rebuild == 'true' && contains(env.PLATFORMS, 'linux/arm64')
769-
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
770+
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
770771

771772
# Buildx is only needed when we build (and for imagetools)
772773
- name: Set up Docker Buildx
773774
if: steps.check-rebuild.outputs.rebuild == 'true'
774-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
775+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
775776

776777
- name: Build and push multi-arch image to GHCR
777778
if: steps.check-rebuild.outputs.rebuild == 'true'
778-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
779+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
779780
with:
780781
context: analyzers/${{ matrix.directory }}
781782
file: ./analyzers/${{ matrix.directory }}/Dockerfile
782783
platforms: ${{ env.PLATFORMS }}
783784
push: true
784785
tags: ${{ env.IMAGE_TAGS }}
785786
build-args: REQUIREMENTS=${{ env.REQUIREMENTS }}
787+
no-cache: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
786788
cache-from: type=gha
787789
cache-to: type=gha,mode=max,scope=shared
788790
labels: |
@@ -831,7 +833,7 @@ jobs:
831833
832834
- name: Scan image for vulnerabilities (Trivy)
833835
if: steps.check-rebuild.outputs.rebuild == 'true'
834-
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
836+
uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # 0.36.0
835837
with:
836838
image-ref: ${{ steps.get-digest.outputs.IMAGE_DIGEST }}
837839
format: sarif
@@ -845,7 +847,7 @@ jobs:
845847

846848
- name: Upload Trivy scan results to GitHub Security tab
847849
if: steps.check-rebuild.outputs.rebuild == 'true'
848-
uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
850+
uses: github/codeql-action/upload-sarif@faaa5d804fc648d0fdb28822a8e36cf7d0a6132c # v4.37.7
849851
with:
850852
sarif_file: trivy.sarif
851853
category: trivy-${{ matrix.directory }}
@@ -1069,12 +1071,12 @@ jobs:
10691071
matrix: ${{ fromJson(needs.generate-matrix.outputs.responders_matrix) }}
10701072
steps:
10711073
- name: Checkout repository
1072-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1074+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
10731075
with:
10741076
fetch-depth: 0
10751077

10761078
- name: GHCR Login
1077-
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
1079+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
10781080
with:
10791081
registry: ghcr.io
10801082
username: ${{ github.actor }}
@@ -1250,23 +1252,24 @@ jobs:
12501252
# Only install QEMU when we actually build AND arm64 is targeted
12511253
- name: Set up QEMU
12521254
if: steps.check-rebuild.outputs.rebuild == 'true' && contains(env.PLATFORMS, 'linux/arm64')
1253-
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
1255+
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
12541256

12551257
# Buildx is only needed when we build (and for imagetools)
12561258
- name: Set up Docker Buildx
12571259
if: steps.check-rebuild.outputs.rebuild == 'true'
1258-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
1260+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
12591261

12601262
- name: Build and push multi-arch image to GHCR
12611263
if: steps.check-rebuild.outputs.rebuild == 'true'
1262-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
1264+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
12631265
with:
12641266
context: responders/${{ matrix.directory }}
12651267
file: ./responders/${{ matrix.directory }}/Dockerfile
12661268
platforms: ${{ env.PLATFORMS }}
12671269
push: true
12681270
tags: ${{ env.IMAGE_TAGS }}
12691271
build-args: REQUIREMENTS=${{ env.REQUIREMENTS }}
1272+
no-cache: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
12701273
cache-from: type=gha
12711274
cache-to: type=gha,mode=max,scope=shared
12721275
labels: |
@@ -1315,7 +1318,7 @@ jobs:
13151318
13161319
- name: Scan image for vulnerabilities (Trivy)
13171320
if: steps.check-rebuild.outputs.rebuild == 'true'
1318-
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
1321+
uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # 0.36.0
13191322
with:
13201323
image-ref: ${{ steps.get-digest-responder.outputs.IMAGE_DIGEST }}
13211324
format: sarif
@@ -1329,7 +1332,7 @@ jobs:
13291332

13301333
- name: Upload Trivy scan results to GitHub Security tab
13311334
if: steps.check-rebuild.outputs.rebuild == 'true'
1332-
uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
1335+
uses: github/codeql-action/upload-sarif@faaa5d804fc648d0fdb28822a8e36cf7d0a6132c # v4.37.7
13331336
with:
13341337
sarif_file: trivy.sarif
13351338
category: trivy-${{ matrix.directory }}
@@ -1552,7 +1555,7 @@ jobs:
15521555
if: always()
15531556
steps:
15541557
- name: Checkout repository
1555-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1558+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
15561559
- name: Set lowercase repository owner
15571560
run: |
15581561
owner="${{ github.repository_owner }}"
@@ -1579,7 +1582,7 @@ jobs:
15791582
run: zip -r ../analyzers/report-templates.zip *
15801583
working-directory: thehive-templates
15811584
- name: Save Artifacts
1582-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
1585+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
15831586
with:
15841587
name: catalog
15851588
path: |
@@ -1591,7 +1594,7 @@ jobs:
15911594
responders/responders-devel.json
15921595
responders/responders-stable.json
15931596
- name: Make Release
1594-
uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
1597+
uses: softprops/action-gh-release@fe965f7af51af5f2602596916f38a38df2e33de0 # v3.0.2
15951598
if: startsWith(github.ref, 'refs/tags/')
15961599
with:
15971600
generate_release_notes: true
@@ -1610,13 +1613,13 @@ jobs:
16101613
needs: [ build_analyzers_A, build_analyzers_B, build_responders ]
16111614
if: startsWith(github.ref, 'refs/tags/') && always()
16121615
steps:
1613-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1616+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
16141617
- name: Prepare documentation files
16151618
uses: docker://thehiveproject/doc-builder
16161619
with:
16171620
args: --type Cortex-Neurons
16181621
- name: Set up Python
1619-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
1622+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
16201623
with:
16211624
python-version: "3.x"
16221625
architecture: x64
@@ -1665,7 +1668,7 @@ jobs:
16651668
echo "message=$msg" >> $GITHUB_OUTPUT
16661669
16671670
- name: Slack notification
1668-
uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
1671+
uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
16691672
with:
16701673
webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
16711674
webhook-type: incoming-webhook

‎.github/workflows/publish-catalogs.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
runs-on: ubuntu-latest
1919
steps:
2020
- name: Checkout repository
21-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
21+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2222

2323
- name: Set lowercase repository owner
2424
run: |
@@ -159,7 +159,7 @@ jobs:
159159
run: mv thehive-templates/report-templates.zip analyzers/
160160

161161
- name: Upload build artifacts
162-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
162+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
163163
with:
164164
name: catalogs
165165
path: |
@@ -225,13 +225,13 @@ jobs:
225225
226226
- name: Download build artifacts
227227
if: steps.check.outputs.skip == 'false'
228-
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
228+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
229229
with:
230230
name: catalogs
231231

232232
- name: Configure AWS credentials (OIDC)
233233
if: steps.check.outputs.skip == 'false'
234-
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
234+
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
235235
with:
236236
role-to-assume: ${{ steps.check.outputs.role_arn }}
237237
aws-region: ${{ env.AWS_REGION }}

analyzers/ThreatResponse/ThreatResponse.json renamed to analyzers/CiscoThreatResponse/ThreatResponse.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"version": "1.0",
77
"description": "Threat Response",
88
"dataTypeList": ["domain", "filename", "fqdn", "hash", "ip", "url"],
9-
"command": "ThreatResponse/ThreatResponse.py",
9+
"command": "CiscoThreatResponse/ThreatResponse.py",
1010
"baseConfig": "ThreatResponse",
1111
"configurationItems": [
1212
{

analyzers/ThreatResponse/ThreatResponse.py renamed to analyzers/CiscoThreatResponse/ThreatResponse.py

File renamed without changes.

analyzers/ThreatResponse/requirements.txt renamed to analyzers/CiscoThreatResponse/requirements.txt

File renamed without changes.

0 commit comments

Comments
 (0)