GHES の GitHub Actions で Google Cloud との OIDC 連携がしやすくなりました
みなさん GitHub Actions の OpenID Connect (以下OIDC) 連携使っていますか？ GitHub Actions はワークフローの中で OIDC の ID トークンを発行でき，これを Google Cloud などのクラウドプロバイダの認証に用いることでサービスアカウントのクレデンシャルを発行することなくクラウドプロバイダのリソースをワークフロー内で操作できるようになります．これによりクレデンシャルのローテーションなどの管理コストが減り，よりセキュアな連携が可能になります． 詳しくは GitHub の公式ドキュメントや解説記事を見ていただけると良いと思います． 基本的に良いことづくめな OIDC 連携ですが，GitHub Enterprise Server (オンプレ版 GitHub．以下GHES) では OIDC 連携が難しいケースがあります．OIDC 連携
GitHub Actions Larger runners - Are now in public beta
September 1, 2022 Today, we are announcing the public beta of larger GitHub hosted runners for GitHub Actions for Team and Enterprise plans 🎉 🎉 The new larger runners provide new capabilities for Team and Enterprise GitHub Action users: Linux and Windows machines up to 64 cores Fixed IP ranges to provide access to runners via allow list services Admin control over access to larger runners and co
GitHub Actions入門 ── ワークフローの基本的な構造からOIDCによる外部サービス認証まで - エンジニアHub｜Webエンジニアのキャリアを考える！
GitHub Actions入門 ── ワークフローの基本的な構造からOIDCによる外部サービス認証まで GitHubが公式に提供するGitHub Actionsは、後発ながらよく使われるワークフローエンジンとなっています。本記事では、藤吾郎（gfx）さんが、典型的なCI/CDのユースケースに即したワークフローの設定と管理について解説するとともに、注目されているGitHub OIDC（OpenID Connect）の利用についても紹介します。 GitHub Actionsは、GitHubが提供するCI/CDのためのワークフローエンジンです。ワークフローエンジンは、ビルド、テスト、デプロイといったCI/CD関連のワークフローを実行し、定期実行するワークフローを管理するなど、開発におけるソフトウェア実行の自動化を担います。 ▶ GitHub Actions - アイデアからリリースまでのワーク
Terraform の CI を AWS CodeBuild から GitHub Actions + tfaction に移行しました - スタディサプリ Product Team Blog
こんにちは。 SRE の @suzuki-shunsuke です。 Terraform の CI を AWS CodeBuild (以下 CodeBuild) から GitHub Actions + tfaction に移行した話を紹介します。 これまでの Terraform Workflow (CodeBuild) 弊プロダクトの Terraform の CI に関しては過去の記事でも何度か紹介していますが、 元々 CodeBuild 上で CI を実行していました。 かつては CircleCI 上で実行していましたが、 CodeBuild に移行しました。 blog.studysapuri.jp CodeBuild に移行した理由は大きく 2 つありました。 Security 永続的な Access Key を発行することなく AWS のリソースを管理できる GCP に関しても Wor
GitHub Actions: Reusable workflows can be referenced locally
January 25, 2022 You can now reference local reusable workflows more easily. With this release, reusable workflows that are in the same repository as the calling repository can be referenced with just the path and filename: {path}/{filename}. For example: jobs: call-workflow-in-local-repo: uses: ./.github/workflows/workflow-2.yml When referenced this way, the called workflow will be from the same
GitHub Actions - Update on OIDC based deployments to AWS
January 13, 2022 While renewing GitHub Actions SSL certificates, an unexpected change in the intermediate certificate authority broke workflows using Open ID Connect (OIDC) based deployment to AWS. To fix the issue please follow the following steps: In the AWS Console, go to IAM -> Identity Providers Open the provider(s) for token.actions.githubusercontent.com Click Manage under Thumbprints Add th
Safeguard your containers with new container signing capability in GitHub Actions
ProductSecuritySafeguard your containers with new container signing capability in GitHub ActionsGitHub has partnered with the OpenSSF and Project Sigstore to add container image signing to our default “Publish Docker Container” workflow. As developers have leaned into cloud native projects for scale and maintainability, the popularity of containers has exploded. With 92% of organizations leveragin
GitHub Actions: Secure cloud deployments with OpenID Connect
October 27, 2021 GitHub Actions now supports OpenID Connect (OIDC) for secure deployments to cloud, which uses short-lived tokens that are automatically rotated for each deployment. This enables: Seamless authentication between Cloud Providers and GitHub without the need for storing any long-lived cloud secrets in GitHub Cloud Admins can rely on the security mechanisms of their cloud provider to e
GitHub Actions: Experience refresh for the management of self-hosted runners
GitHub Actions: Experience refresh for the management of self-hosted runners actions September 20, 2021 GitHub Actions now has an updated management experience for your self-hosted runners that makes it easier to manage runner groups and see the status of your runners. New Runners and Runner groups pages give you flexibility to get a summary view of your runners, or deep dive into a specific runne
GitHub Actions: Ephemeral self-hosted runners & new webhooks for auto-scaling
GitHub Actions: Ephemeral self-hosted runners & new webhooks for auto-scaling actions September 20, 2021 GitHub Actions now supports ephemeral (i.e. single job) self-hosted runners and a new workflow_job webhook to make autoscaling your runners easier. After a job is run, ephemeral runners are automatically unregistered from the service, allowing you to do any required post-job management. Ephemer
AWS federation comes to GitHub Actions
At the time of writing, this functionality exists but has yet to be announced or documented. It works, though! EDIT: Here is the functionality on the GitHub roadmap. GitHub Actions has new functionality that can vend OpenID Connect credentials to jobs running on the platform. This is very exciting for AWS account administrators as it means that CI/CD jobs no longer need any long-term secrets to be
Keeping your GitHub Actions and workflows secure Part 3: How to trust your building blocks
Keeping your GitHub Actions and workflows secure Part 3: How to trust your building blocks Jaroslav Lobacevski This post is the third and final in a series of posts about GitHub Actions security. Part 1, Part 2 In previous blog posts, we discussed possible mistakes and abuse patterns that could lead to the compromise of your GitHub repository. This time, I’ll discuss sometimes less obvious — whose
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
GitHub - github/gh-valet: Valet helps facilitate the migration of Azure DevOps, CircleCI, GitLab CI, Jenkins, and Travis CI pipelines to GitHub Actions.
GitHub - test-summary/action: Show a helpful summary of test results in GitHub Actions CI/CD workflow runs
Release Add caching support on GHES 3.5 · actions/setup-node
GitHub Actions workflow not triggering at scheduled time | Upptime
GitHub Actions: Workflows triggered by Dependabot receive dependabot secrets
Release v2.284.0 · actions/runner
GitHub - google-github-actions/auth: A GitHub Action for authenticating to Google Cloud.
Release v2.282.0 · actions/runner