swade1987 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026
@@ -0,0 +1,4 @@
+# Names the repo owner for GitHub's own UI (review requests, blame).
+# The branch ruleset does not require owner review before merge - this
+# file's effect is currently informational only.
+* @swade1987
@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "ci"
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore"
@@ -1,7 +1,7 @@
 name: commit-lint
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - edited
@@ -14,7 +14,15 @@ permissions:
 jobs:
   commit-lint:
     name: commit-lint
+    # Dependabot's own commit messages don't pass commitlint's stricter
+    # subject-case rules (its PR titles do - pr-lint still runs for these).
+    # Keyed on the PR's actual author, not github.actor - a manual "update
+    # branch" would otherwise flip actor away from dependabot[bot] and make
+    # this job run for real on a Dependabot commit it was meant to exempt.
+    if: github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-      - uses: wagoid/commitlint-github-action@3d28780bbf0365e29b144e272b2121204d5be5f3 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
@@ -0,0 +1,36 @@
+name: lint
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: lint-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  hadolint:
+    name: hadolint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
+        with:
+          dockerfile: Dockerfile
+          failure-threshold: error
+
+  shellcheck:
+    name: shellcheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
+        with:
+          severity: error
@@ -0,0 +1,50 @@
+name: Monitor Flux Versions
+
+on:
+  schedule:
+    - cron: '0 1 * * 1'  # Weekly, Mondays at 01:00 - flux releases far less often than daily
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  check-flux-versions:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.RELEASE_TOKEN }}
+
+      - name: Setup GitHub CLI
+        run: |
+          gh auth login --with-token <<< "${{ secrets.RELEASE_TOKEN }}"
+
+      - name: Check for an existing upgrade PR
+        id: check-prs
+        run: |
+          EXISTING_PRS=$(gh pr list --json title --jq '.[] | select(.title | contains("sync kustomize/helm to flux")) | .title')
+          if [ -n "$EXISTING_PRS" ]; then
+            echo "Found an existing sync PR, skipping until it's merged:"
+            echo "$EXISTING_PRS"
+            echo "has_pr=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_pr=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Configure Git
+        if: steps.check-prs.outputs.has_pr == 'false'
+        run: |
+          git config user.name "Steve Wade"
+          git config user.email "steven@stevenwade.co.uk"
+
+      - name: Run upgrade script
+        if: steps.check-prs.outputs.has_pr == 'false'
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+        run: |
+          chmod +x ./scripts/upgrade-flux-versions.sh
+          ./scripts/upgrade-flux-versions.sh --execute
@@ -1,7 +1,7 @@
 name: pr-lint
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - edited
@@ -16,6 +16,6 @@ jobs:
     name: pr-lint
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -17,16 +17,16 @@ jobs:
       id-token: write # to enable use of OIDC for npm provenance
     steps:
       - name: checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
           token: ${{ secrets.RELEASE_TOKEN }}
       - name: setup node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "lts/*"
       - name: release
-        uses: cycjimmy/semantic-release-action@v4
+        uses: cycjimmy/semantic-release-action@16ca923e6ccbb50770c415a0ccd43709a8c5f7a4 # v4.2.2
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -0,0 +1,42 @@
+name: Scorecard analysis workflow
+on:
+  push:
+    branches:
+    - main
+  schedule:
+    - cron:  '30 1 * * 6'
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        with:
+          sarif_file: results.sarif
@@ -0,0 +1,87 @@
+name: test
+
+on:
+  pull_request:
+
+concurrency:
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout kustomize-diff-test
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: swade1987/kustomize-diff-test
+          path: fixture
+          fetch-depth: 0
+
+      - name: Checkout this action
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          path: action
+
+      - name: Build the action image
+        working-directory: action
+        run: docker build -t kustomize-diff:ci .
+
+      # Deterministic change on a throwaway local branch, never pushed - a
+      # known-good target this test can assert against, independent of
+      # whatever state the fixture repo's own branches happen to be in.
+      - name: Create a known change on a throwaway branch
+        working-directory: fixture
+        run: |
+          git config user.email "ci@github-actions.local"
+          git config user.name "github-actions[ci]"
+          git checkout -b e2e-test-branch
+          sed -i 's/ENV=base/ENV=base-e2e-test/' kustomize/base/kustomization.yaml
+          git add -A
+          git commit -sm "test: e2e change"
+
+      - name: Run the action against the fixture
+        working-directory: fixture
+        run: |
+          # The bind-mount source must exist as a file before "docker run"
+          # creates the mount, or Docker creates it as a directory instead -
+          # which silently breaks the container's write to it. Verified
+          # live: this exact failure happened on a real CI run once, before
+          # this touch existed.
+          touch "$RUNNER_TEMP/output.txt"
+          docker run --rm \
+            -v "$(pwd):/github/workspace" \
+            -v "$RUNNER_TEMP/output.txt:/github_output.txt" \
+            -w /github/workspace \
+            -e GITHUB_WORKSPACE=/github/workspace \
+            -e GITHUB_OUTPUT=/github_output.txt \
+            -e INPUT_BASE_REF=main \
+            -e INPUT_HEAD_REF=e2e-test-branch \
+            -e INPUT_ROOT_DIR=./kustomize \
+            -e INPUT_MAX_DEPTH=2 \
+            -e DEBUG=false \
+            kustomize-diff:ci
+        env:
+          RUNNER_TEMP: ${{ runner.temp }}
+
+      - name: Assert the diff output is correct
+        run: |
+          touch "$RUNNER_TEMP/output.txt"
+          if ! grep -q "^diff<<" "$RUNNER_TEMP/output.txt"; then
+            echo "::error::GITHUB_OUTPUT was never written - the action produced no diff output at all"
+            cat "$RUNNER_TEMP/output.txt"
+            exit 1
+          fi
+          if ! grep -q -- "-  ENV: base$" "$RUNNER_TEMP/output.txt" || ! grep -q -- "+  ENV: base-e2e-test$" "$RUNNER_TEMP/output.txt"; then
+            echo "::error::Expected diff content not found in the action's output"
+            cat "$RUNNER_TEMP/output.txt"
+            exit 1
+          fi
+          echo "Diff output looks correct:"
+          cat "$RUNNER_TEMP/output.txt"
+        env:
+          RUNNER_TEMP: ${{ runner.temp }}
@@ -1,16 +1,20 @@
-FROM alpine:3.23.3
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 RUN apk update && apk --no-cache add bash curl git
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
+# kustomize/helm versions are kept in step with what flux itself is built
+# against - see scripts/upgrade-flux-versions.sh and
+# .github/workflows/monitor-flux-versions.yml, which derive these from
+# flux2's own release rather than chasing each tool's latest independently.
 ARG KUSTOMIZE=5.8.1
 RUN curl -sL https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${KUSTOMIZE}/kustomize_v${KUSTOMIZE}_linux_amd64.tar.gz | \
 tar xz && mv kustomize /usr/local/bin/kustomize
 
-ARG HELM_V3=3.19.2
-RUN curl -sSL https://get.helm.sh/helm-v${HELM_V3}-linux-amd64.tar.gz | \
-tar xz && mv linux-amd64/helm /usr/local/bin/helmv3 && rm -rf linux-amd64 && ln -s /usr/local/bin/helmv3 /usr/local/bin/helm && helm version
+ARG HELM_VERSION=3.19.2
+RUN curl -sSL https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz | \
+tar xz && mv linux-amd64/helm /usr/local/bin/helm && rm -rf linux-amd64 && helm version
 
 RUN rm -rf /var/cache/apk/*
 

@@ -1,5 +1,11 @@
 # Kustomize Diff GitHub Action
 
+[![test](https://github.com/swade1987/github-action-kustomize-diff/actions/workflows/test.yml/badge.svg)](https://github.com/swade1987/github-action-kustomize-diff/actions/workflows/test.yml)
+[![lint](https://github.com/swade1987/github-action-kustomize-diff/actions/workflows/lint.yml/badge.svg)](https://github.com/swade1987/github-action-kustomize-diff/actions/workflows/lint.yml)
+[![commit-lint](https://github.com/swade1987/github-action-kustomize-diff/actions/workflows/commit-lint.yaml/badge.svg)](https://github.com/swade1987/github-action-kustomize-diff/actions/workflows/commit-lint.yaml)
+[![pr-lint](https://github.com/swade1987/github-action-kustomize-diff/actions/workflows/pr-lint.yml/badge.svg)](https://github.com/swade1987/github-action-kustomize-diff/actions/workflows/pr-lint.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/swade1987/github-action-kustomize-diff/badge)](https://scorecard.dev/viewer/?uri=github.com/swade1987/github-action-kustomize-diff)
+
 This GitHub Action builds and compares Kustomize configurations between the base and head of a Pull Request, posting the differences as a PR comment. This helps reviewers easily identify configuration changes in Kubernetes manifests.
 
 ## Why Use This Action?
@@ -52,7 +58,7 @@ This approach correctly handles cases where changes have been made to the base b
 
 ## Usage
 
-The below example will run `kustomize-diff` against your branch and commit the changes due to be applied back to your Pull Request.
+The below example will run `kustomize-diff` against your branch and post the resulting diff as a comment on your Pull Request.
 
 ```
 name: kustomize-diff
@@ -65,7 +71,7 @@ jobs:
   kustomize-diff:
     permissions:
       pull-requests: write
-      contents: write
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Supported versions
+
+This action ships one rolling `latest` semantic-release version; there's no long-term-support branch to track. Security fixes land on `main` and are published as the next tagged release.
+
+## Reporting a vulnerability
+
+Please report security issues privately rather than opening a public GitHub issue: use [GitHub's private vulnerability reporting](https://github.com/swade1987/github-action-kustomize-diff/security/advisories/new) for this repository (Security tab → Report a vulnerability).
+
+Include what you'd include in any good bug report: the affected version or commit, what you found, and how to reproduce it. We'll acknowledge new reports within 5 business days and aim to have a fix or mitigation plan within 30 days, depending on severity.
+
+## Scope
+
+This is a Docker-based GitHub Action: consumers build it fresh from a tagged ref each time it's used (there's no pre-built image published to a registry). It checks out and merges the caller's own base/head refs locally to build a diff - reports about that logic, the Dockerfile, or the CI/release pipeline are in scope. Using this action with `pull_request_target` on an untrusted (fork) PR is a misuse of the trigger, not a vulnerability in the action itself - the documented usage in the README uses plain `pull_request`.