1759241 - Allow 'google-github-actions' for Github Actions in mozilla.org

Status: RESOLVED FIXED

(mozilla.org :: Github: Administration, task)

Description

[Bryan Sieber [ :bsieber ]]

Hi I was attempting to use google-github-actions for continuous deployment to GCP when I received this message:

google-github-actions/setup-gcloud@v0 is not allowed to be used in mozilla/jira-bugzilla-integration. Actions in this workflow must be: within a repository that belongs to your Enterprise account, created by GitHub or match the following: !/mozilla/**, !mozilla/**, ./**, 10up/wpcs-action@*, aws-actions/*, docker/*, pypa/gh-action-pypi-publish@v1.4.2, slackapi/slack-github-action@*, codecov/codecov-action@v2.

What is the procedure for allowing/enabling a new set of actions?
Thanks in advance for reading this.

Comment 1

[Chris Knowles [:cknowles]]

this bug is an excellent start - I'm NI'ing Hal from secops to look at things.

Hal - I checked the Approved GHE lists for actions, this wasn't on it, so passing it to you.

Comment 2

[hwine]

Since this is an officially backed-by-Google repo, and we have many contracts with them, we can both:

1. enabled for any action in that repo in mozilla-services, and
2. add to the "default template" for actions for any org

(my apologies for the delay - I thought I'd already posted this)

Comment 3

[Chris Knowles [:cknowles]]

Alright, per that note, and some confirmation in slack, have enabled google-github-actions/* for the mozilla org. Let me know if that's not working for you.

Comment 4

[Bryan Sieber [ :bsieber ]]

It's working for me; thank you!