ci: Updaiting workflow permissions and adding hardend runner per step-security. #3124

san-est · 2024-10-18T12:28:22Z

Description:
Updating several workflows and their permissions per step-security requirements and adding hardend runner to one of the workflows.

Related issue(s):

Fixes #3121

Notes for reviewer:

Checklist

Documented (Code comments, README, etc.)
Tested (unit, integration, etc.)

github-actions · 2024-10-18T12:32:12Z

🚨 Memory Leak Detected 🚨

A potential memory leak has been detected in the test titled validates enforcement of request id. This may impact the application's performance and stability.

Details

📊 Memory Leak Detection Report 📊

GC Type: MarkSweepCompact
Cost: 27,265.5 ms

Heap Statistics (before vs after executing the test):

Total Heap Size: increased with 1.46 MB
Total Heap Size Executable: no changes
Total Physical Size: decreased with 348.16 KB
Total Available Size: decreased with 5.88 MB
Total Global Handles Size: no changes
Used Global Handles Size: decreased with 64.00 bytes
Used Heap Size: decreased with 3.44 MB
Heap Size Limit: no changes
Malloced Memory: no changes
External Memory: no changes
Peak Malloced Memory: no changes

Heap Space Statistics (before vs after executing the test):

Old Space:
- Space Size: increased with 1.84 MB
- Space Used Size: increased with 2.08 MB
- Space Available Size: decreased with 8.72 MB
- Physical Space Size: increased with 1.84 MB
Large Object Space:
- Space Size: increased with 835.58 KB
- Space Used Size: increased with 813.50 KB
- Space Available Size: no changes
- Physical Space Size: increased with 835.58 KB

Recommendations

Please investigate the memory allocations in this test, focusing on objects that are not being properly deallocated.

github-actions · 2024-10-18T12:32:37Z

Tests

      3 files   399 suites 18s ⏱️
1 433 tests 1 432 ✔️ 1 💤 0 ❌
1 442 runs 1 441 ✔️ 1 💤 0 ❌

Results for commit b89ff2d.

♻️ This comment has been updated with latest results.

github-actions · 2024-10-18T15:00:37Z

Acceptance Tests

  17 files 245 suites 28m 2s ⏱️
599 tests 593 ✔️ 4 💤 2 ❌
728 runs 722 ✔️ 4 💤 2 ❌

Results for commit b89ff2d.

♻️ This comment has been updated with latest results.

.github/workflows/pr-label-milestone-check.yml

.github/workflows/conformity-workflow.yml

.github/workflows/release-acceptance.yml

Nana-EC · 2024-10-25T04:36:26Z

@san-est need to fix DCO then you can check in

…-security. Signed-off-by: Vasil Boyadzhiev <vasil.boyadzhiev@limechain.tech>

Co-authored-by: Roger Barker <roger.barker@swirldslabs.com> Signed-off-by: Vasil Boyadzhiev <vasil.boiadzhiev@gmail.com> Signed-off-by: Vasil Boyadzhiev <vasil.boyadzhiev@limechain.tech>

Signed-off-by: Vasil Boyadzhiev <vasil.boyadzhiev@limechain.tech>

sonarqubecloud · 2024-10-28T12:56:49Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

github-actions · 2024-10-28T13:00:04Z

Test Results

20 files ± 0 287 suites +4 35m 8s ⏱️ +33s
607 tests + 2 588 ✅ - 3 4 💤 ±0 15 ❌ +5
768 runs - 26 747 ✅ - 33 6 💤 +2 15 ❌ +5

For more details on these failures, see this check.

Results for commit 58c9f9e. ± Comparison against base commit 9afe7c2.

This pull request removes 1 and adds 3 tests. Note that renamed tests count towards both.

"before all" hook in "@tokenmanagement HTS Precompile Token Management Acceptance Tests" ‑ RPC Server Acceptance Tests Acceptance tests @tokenmanagement HTS Precompile Token Management Acceptance Tests "before all" hook in "@tokenmanagement HTS Precompile Token Management Acceptance Tests"

"before all" hook in "Debug API Test Suite" ‑ RPC Server Acceptance Tests Acceptance tests @api-batch-3 RPC Server Acceptance Tests Debug API Test Suite "before all" hook in "Debug API Test Suite"
"before each" hook for "Should eventually exhaust the hbar limit for EXTENDED user" ‑ RPC Server Acceptance Tests Acceptance tests @hbarlimiter HBAR Limiter Acceptance Tests HBAR Rate Limit Tests HBAR Rate Limit For Different Spending Plan Tiers Preconfigured Tiers EXTENDED Tier "before each" hook for "Should eventually exhaust the hbar limit for EXTENDED user"
"before each" hook for "Should increase the amount spent of the spending plan by the transaction cost" ‑ RPC Server Acceptance Tests Acceptance tests @hbarlimiter HBAR Limiter Acceptance Tests HBAR Rate Limit Tests HBAR Rate Limit For Different Spending Plan Tiers Preconfigured Tiers PRIVILEGED Tier "before each" hook for "Should increase the amount spent of the spending plan by the transaction cost"

♻️ This comment has been updated with latest results.

codecov · 2024-10-29T10:51:19Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.26%. Comparing base (daf2aef) to head (58c9f9e).
Report is 20 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3124      +/-   ##
==========================================
+ Coverage   83.19%   83.26%   +0.07%     
==========================================
  Files          63       66       +3     
  Lines        4242     4254      +12     
  Branches      830      829       -1     
==========================================
+ Hits         3529     3542      +13     
- Misses        470      471       +1     
+ Partials      243      241       -2

Flag	Coverage Δ
config-service	`98.14% <ø> (?)`
relay	`85.45% <ø> (-0.14%)`	⬇️
server	`83.52% <ø> (+0.04%)`	⬆️
ws-server	`36.87% <ø> (+0.71%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

see 32 files with indirect coverage changes

**Description**: Added `packages: write` permission per https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-with-a-personal-access-token-classic May need to modify other files modified by #3124 **Related Issue(s)**: Relates to #3124 Relates to #3182 Signed-off-by: Roger Barker <roger.barker@swirldslabs.com>

#3186) * ci(bug): Update permissions in JSON rpc relay for GITHUB_TOKEN (#3183) **Description**: Added `packages: write` permission per https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-with-a-personal-access-token-classic May need to modify other files modified by #3124 **Related Issue(s)**: Relates to #3124 Relates to #3182 Signed-off-by: Roger Barker <roger.barker@swirldslabs.com> * chore: divided hbar limtier tests into different batches (#3181) * chore: divided hbar limtier tests into different batches Signed-off-by: Logan Nguyen <logan.nguyen@swirldslabs.com> * fix: fixed acceptance.yml Signed-off-by: Logan Nguyen <logan.nguyen@swirldslabs.com> --------- Signed-off-by: Logan Nguyen <logan.nguyen@swirldslabs.com> --------- Signed-off-by: Roger Barker <roger.barker@swirldslabs.com> Signed-off-by: Logan Nguyen <logan.nguyen@swirldslabs.com> Co-authored-by: Roger Barker <roger.barker@swirldslabs.com> Co-authored-by: Logan Nguyen <logan.nguyen@swirldslabs.com>

san-est added the github_action label Oct 18, 2024

san-est added this to the 0.59.0 milestone Oct 18, 2024

san-est self-assigned this Oct 18, 2024

san-est requested review from AlfredoG87, ebadiere, Nana-EC and a team as code owners October 18, 2024 12:28

san-est requested a review from tomzhenghedera October 18, 2024 12:28

san-est linked an issue Oct 18, 2024 that may be closed by this pull request

Update default GITHUB_TOKEN permissions per step-security recommendations #3121

Closed

san-est requested a review from leninmehedy October 18, 2024 12:28

Nana-EC previously approved these changes Oct 18, 2024

View reviewed changes

rbarkerSL requested changes Oct 19, 2024

View reviewed changes

.github/workflows/pr-label-milestone-check.yml Outdated Show resolved Hide resolved

.github/workflows/conformity-workflow.yml Outdated Show resolved Hide resolved

.github/workflows/release-acceptance.yml Outdated Show resolved Hide resolved

san-est dismissed Nana-EC’s stale review via 4b4d259 October 21, 2024 08:32

san-est requested a review from a team as a code owner October 21, 2024 08:44

rbarkerSL approved these changes Oct 21, 2024

View reviewed changes

quiet-node approved these changes Oct 22, 2024

View reviewed changes

san-est and others added 3 commits October 28, 2024 14:55

ci: Updaiting workflow permissions and adding hardend runner per step…

63e7681

…-security. Signed-off-by: Vasil Boyadzhiev <vasil.boyadzhiev@limechain.tech>

Update .github/workflows/pr-label-milestone-check.yml

e4e63b2

Co-authored-by: Roger Barker <roger.barker@swirldslabs.com> Signed-off-by: Vasil Boyadzhiev <vasil.boiadzhiev@gmail.com> Signed-off-by: Vasil Boyadzhiev <vasil.boyadzhiev@limechain.tech>

ci: Updating authenticate step in release-acceptance

58c9f9e

Signed-off-by: Vasil Boyadzhiev <vasil.boyadzhiev@limechain.tech>

san-est force-pushed the 3121-update-default-github_token-permissions-per-step-security-recommendations branch from b89ff2d to 58c9f9e Compare October 28, 2024 12:55

san-est merged commit 592b92f into main Oct 29, 2024
43 of 44 checks passed

san-est deleted the 3121-update-default-github_token-permissions-per-step-security-recommendations branch October 29, 2024 10:51

rbarkerSL mentioned this pull request Oct 30, 2024

ci(bug): Update permissions in JSON rpc relay for GITHUB_TOKEN #3183

Merged

ebadiere mentioned this pull request Oct 30, 2024

fix: 03182 updatetoken permissions cherry pick #3185

Closed

ebadiere mentioned this pull request Oct 30, 2024

ci(bug): Update permissions in JSON rpc relay for GITHUB_TOKEN (#3183) #3186

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: Updaiting workflow permissions and adding hardend runner per step-security. #3124

ci: Updaiting workflow permissions and adding hardend runner per step-security. #3124

san-est commented Oct 18, 2024

github-actions bot commented Oct 18, 2024 •

edited

Loading

github-actions bot commented Oct 18, 2024 •

edited

Loading

github-actions bot commented Oct 18, 2024 •

edited

Loading

Nana-EC commented Oct 25, 2024

sonarqubecloud bot commented Oct 28, 2024

github-actions bot commented Oct 28, 2024 •

edited

Loading

codecov bot commented Oct 29, 2024

ci: Updaiting workflow permissions and adding hardend runner per step-security. #3124

ci: Updaiting workflow permissions and adding hardend runner per step-security. #3124

Conversation

san-est commented Oct 18, 2024

github-actions bot commented Oct 18, 2024 • edited Loading

🚨 Memory Leak Detected 🚨

Details

Recommendations

github-actions bot commented Oct 18, 2024 • edited Loading

Tests

github-actions bot commented Oct 18, 2024 • edited Loading

Acceptance Tests

Nana-EC commented Oct 25, 2024

sonarqubecloud bot commented Oct 28, 2024

Quality Gate passed

github-actions bot commented Oct 28, 2024 • edited Loading

Test Results

codecov bot commented Oct 29, 2024

Codecov Report

github-actions bot commented Oct 18, 2024 •

edited

Loading

github-actions bot commented Oct 18, 2024 •

edited

Loading

github-actions bot commented Oct 18, 2024 •

edited

Loading

github-actions bot commented Oct 28, 2024 •

edited

Loading