1752897 - Assess use of external addon github actions in Mozilla's GitHub organization mozilla-services/cjms/

Status: RESOLVED FIXED

(mozilla.org :: Github: Administration, task)

Description

[Brandon Wells]

Hi, I want to use the following github actions:

docker/login-action@v1
docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc

in mozilla-services/cjms/ to build and publish a docker image to docker hub.

See: https://github.com/mozilla-services/cjms/blob/main/.github/workflows/publish.yml

Repo: cjms
Is this a private repo: Yes
Description: Need selected github actions. On builds, github throws the following error:

Error : .github#L1
docker/login-action@v1, docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38, and docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc are not allowed to be used in mozilla-services/cjms. Actions in this workflow must be: within a repository owned by mozilla-services or created by GitHub.

ref: https://github.com/mozilla-services/cjms/actions/runs/1773457158

Comment 1

[Chris Knowles [:cknowles]]

forwarding to secops for their approval - as actions have to be approved for the entire organization.

Comment 2

[hwine]

:cknowles -- docker is in the default new-org allow list, so it's okay to add to not-yet-migrated orgs. You can add all of the defaults if you'd like.

Comment 3

[Jon Buckley [:jbuck]]

:hwine - is that "default new-org allow list" published somewhere we can reference?

Comment 4

[Chris Knowles [:cknowles]]

Hal, apologies for not looking there.

https://github.com/MoCo-GHE-Admin/Approved-GHE-add-ons/blob/main/New_Org_Default_settings.md

That should be accessible to anyone in the mozilla org.

I have changed mozilla-services to include the docker/* entry.

Hal, I'll be poking you about other maintenance ongoing.

One note, jbuck - while docker/* is now allowed, that only applies to public repositories, private ones can only run actions if the organization is in github enterprise. which mozilla-services is not. One option would be to migrate the repository to the mozilla or mozilla-it orgs, which are currently in the github enterprise plan.

Comment 5

[Chris Knowles [:cknowles]]

I'm taking silence to mean that things are going well or as expected. If you need further assistance, let us know.

Comment 6

[Jon Buckley [:jbuck]]

Yup, it's working great now, thank you!