Auto tagging

[santoshkal]

This PR enhances the release workflow for all the OCI artifacts of the policies and cue modules produced by genval.

• Generates OCI artifacts and pushes them to intelops ghcr registry, whenever there's an update to a specific directory. i.e will release dockerfile policies only if there's an update to dockerfile_policies directory.
• Once the artifact is successfully pushed to the OCI registry, the OCI URL is written back to the policyhub repo in the outputs directory and a separate PR is raised from a temporary branch for review and merging.

[dryrunsecurity[bot]]

DryRun Security Summary

The provided code changes focus on updating version files and environment variables related to various components and policies used in the application, such as ArgoCD, Tekton Pipelines, Terraform, Kubernetes, and input policies, as part of a larger effort to manage the versioning and release of these security-related artifacts.

Expand for full summary

**Summary:** The provided code changes focus on updating various version files and environment variables related to different components and policies used in the application, such as ArgoCD, Tekton Pipelines, Terraform, Kubernetes, and input policies. These changes appear to be part of a larger effort to manage the versioning and release of these security-related artifacts. From an application security engineer's perspective, the changes do not introduce any immediate security concerns. The updates are primarily focused on version number changes and do not appear to involve any direct modifications to the application's core functionality or security controls. However, it's important to consider the broader context and ensure that the versioning and release processes for these components are properly managed and secured. This includes: 1. **Secure Storage and Access**: Ensure that any sensitive information, such as API keys or credentials, are not stored in the version files or environment variables, and that access to these files is properly restricted. 2. **Vulnerability Monitoring**: Monitor the versions of the various components (e.g., ArgoCD, Tekton, Terraform) and ensure that they are kept up-to-date with the latest security patches and bug fixes. 3. **Automated Validation**: Implement automated checks, such as dependency scanning and version validation, to ensure that the versions being used are the latest stable releases and do not contain known vulnerabilities. 4. **Secure Release Process**: Review the release workflow, including the GitHub Actions configuration, to ensure that the process for updating and releasing these artifacts is secure and follows best practices for software development and deployment. 5. **Logging and Monitoring**: Establish robust logging and monitoring mechanisms to track changes to the version files and environment variables, and to detect any suspicious activity or potential misuse. Overall, the code changes appear to be routine updates to version management, and they do not raise any immediate security concerns. However, it's crucial to maintain vigilance and continuously review the application's security posture, especially when dealing with security-related components and infrastructure-as-code (IaC) artifacts. **Files Changed:** - `.github/versions/argocd_mod_version.env`: Sets the version of the ArgoCD module to `v0.0.1`. - `.github/versions/infrafile_version.env`: Sets the `INFRAFILE_VERSION` environment variable to `V0.0.1`. - `.github/versions/dockerfile_version.env`: Sets the `DOCKERFILE_POLICIES_VERSION` environment variable to `V0.0.1`. - `.github/get_versions.sh`: A Bash script that reads version information from a specified version file. - `.github/versions/tektoncd_mod_version.env`: Sets the `TEKTON_MOD_VERSION` environment variable to `v0.0.1`. - `.github/versions/terraform_version.env`: Sets the `TERRAFORM_POLICIES_VERSION` environment variable to `v0.0.1`. - `.github/versions/input_version.env`: Sets the `INPUT_POLICIES_VERSION` environment variable to `v0.0.1`. - `.github/versions/k8s_mod_version.env`: Sets the `K8S_MOD_VERSION` environment variable to `v0.0.1`. - `.github/workflows/release-artifacts.yaml`: A GitHub Actions workflow that manages the release of various policy and module artifacts.

Code Analysis

We ran 9 analyzers against 23 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

:green_circle: Risk threshold not exceeded.

View PR in the DryRun Dashboard.