Ghat is a tool for updating your GitHub actions and Terraform with the latest version of it dependencies and using immutable hashes instead of mutable tags.
APACHE-2.0 License
Ghat is a tool (GHAT) for updating dependencies in a GHA - GitHub Action, managing Terraform Dependencies and pre-commit configs. It replaces insecure mutable tags with immutable commit hashes as well as using the latest released version:
## sets up go based on the version
- name: Install Go
uses: actions/[email protected]
with:
go-version: ${{ matrix.go-version }}
## checks out our code locally, so we can work with the files
- name: Checkout code
uses: actions/[email protected]
Becomes
## sets up go based on the version
- name: Install Go
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
with:
go-version: ${{ matrix.go-version }}
## checks out our code locally, so we can work with the files
- name: Checkout code
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
Ghat will use your GitHub credentials, if available, from your environment using the environmental variables GITHUB_TOKEN or GITHUB_API, but it can also drop back to anonymous access, the drawback is that this is severely rate limited by gitHub.
Ghat also manages Terraform modules, to give you the most secure reference, so:
module "ip" {
source = "JamesWoolfenden/ip/http"
version = "0.3.12"
permissions = "pike"
}
Becomes:
module "ip" {
source = "git::https://github.com/JamesWoolfenden/terraform-http-ip.git?ref=a6cf071d14365133f48ed161812c14b00ad3c692"
permissions = "pike"
}
Download the latest binary here:
https://github.com/JamesWoolfenden/ghat/releases
Install from code:
go install
Install remotely:
go install github.com/jameswoolfenden/ghat@latest
brew tap jameswoolfenden/homebrew-tap
brew install jameswoolfenden/tap/ghat
I'm now using Scoop to distribute releases, it's much quicker to update and easier to manage than previous methods, you can install scoop from https://scoop.sh/.
Add my scoop bucket:
scoop bucket add iac https://github.com/JamesWoolfenden/scoop.git
Then you can install a tool:
scoop install ghat
docker pull jameswoolfenden/ghat
docker run --tty --volume /local/path/to/repo:/repo jameswoolfenden/ghat swot -d /repo
https://hub.docker.com/repository/docker/jameswoolfenden/ghat
To authenticate the GitHub Api you should set up your GitHub Personal Access Token as the environment variable GITHUB_API or GITHUB_TOKEN, it will fall back to using anonymous if you don't but RATE LIMITS.
This will look for the .github/workflow folder and update all the files it finds there, and display a diff of the changes made to each file:
$ghat swot -d .
$ghat swot -f .\.github\workflows\ci.yml
If you're concerned that the very latest release might be too fresh, and would rather have the latest from 2 weeks ago? I got you covered:
$ghat swot -d . --stable 14
Updates Terraform modules to use secure module references, and displays a file diff:
ghat swipe -f .\registry\module.git.tf -update
_ _
__ _ | |_ __ _ | |_
/ _` || ' \ / _` || _|
\__, ||_||_|\__,_| \__|
|___/
version: 9.9.9
1:42PM INF module source is git::https://github.com/terraform-aws-modules/terraform-aws-memory-db.git?depth=1 of type shallow and cannot be updated
module "ip" {
source = "git::https://github.com/JamesWoolfenden/ip/terraform-http"
v-ip.git?rersion f= "aca5d0.4513.1698f2f564913cfcc3534780794c800"
permissions = "pike"
}
The update flag can be used to update the reference, the default behaviour is just to change the reference to a git bashed hash.
Sift updates pre-commit configs with the latest hooks using hashes. Commands are similar, but only the directory is needed:
ghat sift -d .
The flag dryrun is also supported. Example outcome display:
- hooks:
- id: forbid-tabs
exclude: binary|\.bin$|rego|\.rego$|go|\.go$
exclude_types:
- python
- javascript
- dtd
- markdown
- makefile
- xml
repo: https://github.com/Lucas-C/pre-commit-hooks
rev: 762c66ea96843b54b936fc680162ea67f85ec2d7
ghat --help
_ _
__ _ | |_ __ _ | |_
/ _` || ' \ / _` || _|
\__, ||_||_|\__,_| \__|
|___/
version: v0.1.1
NAME:
ghat - Update GHA dependencies
USAGE:
ghat [global options] command [command options] [arguments...]
VERSION:
v0.1.1
AUTHOR:
James Woolfenden <[email protected]>
COMMANDS:
sift, p updates pre-commit version with hashes
swipe, w updates Terraform module versions with versioned hashes
swot, a updates GHA versions for hashes
version, v Outputs the application version
help, h Shows a list of commands or help for one command
GLOBAL OPTIONS:
--help, -h show help
--version, -v print the version
COPYRIGHT:
James Woolfenden
I've added a number of pre-commit hooks to this repo that will update your build configs, update .pre-commit-config.yaml
- repo: https://github.com/JamesWoolfenden/ghat/actions
rev: v0.0.10
hooks:
- id: ghat-go
name: ghat
description: upgrade action dependencies
language: golang
entry: ghat swot -d .
pass_filenames: false
always_run: true
types: [ yaml ]
go build
or
Make build
Log an issue, a pr or an email to jim.wolf @ duck.com.