PIPELINE.adoc

GitHub Actions Pipeline

Table of Contents

• Overview
• TODO
• Tools
• Resource usage and cost
• Security

Overview

This might be a good introduction to GitHub Actions.

The entire functionality here is just one GitHub Actions Workflow file.

There is a simpler workflow you can start with: ../.github/workflows/build_simple.yaml-disabled

TODO

• Add SBOM as described in: github.com/microsoft/sbom-tool/blob/main/docs/setting-up-github-actions.md

  • github.com/${OWNER}/${REPO}/network/dependencies (relative link) offers an SBOM file, is this the same? Does this make sense?

Tools

For maintenance, if something breaks, use these tools:

• Playground from github.com/rhysd/actionlint

• Tutorial for GitHub Actions

Resource usage and cost

TODO

Security

Go to github.com/${OWNER}/${REPO}/settings/actions (relative link) and select: Actions permissions → Allow OWNER, and select non-OWNER, actions and reusable workflows. Enable Allow actions created by GitHub. Add ncipollo/release-action@v* to Allow specified actions and reusable workflows.

TODO: Find a way to do this with gh.