From cb150c9abee03c741852c3d3d5c0dfbdb8d5f017 Mon Sep 17 00:00:00 2001 From: stephen schuresko Date: Fri, 7 Mar 2025 14:22:32 -0500 Subject: [PATCH] feat: secure kubeconfig permissions in deployment step of build-and-push workflow --- .gitea/workflows/build-and-push.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitea/workflows/build-and-push.yaml b/.gitea/workflows/build-and-push.yaml index 64352a3..96e5cdd 100644 --- a/.gitea/workflows/build-and-push.yaml +++ b/.gitea/workflows/build-and-push.yaml @@ -38,7 +38,7 @@ jobs: - env: KUBEB64: '${{ secrets.KUBEB64 }}' name: deploy - run: mkdir -p $HOME/.kube &&echo "$KUBEB64" | base64 -d > $HOME/.kube/config && + run: mkdir -p $HOME/.kube &&echo "$KUBEB64" | base64 -d > $HOME/.kube/config && chmod 700 $HOME/.kube/config && /usr/local/bin/helm upgrade --install papi-${{ steps.extract_branch.outputs.branch }} papi-helm/ -f ./papi-helm/v.prod.yaml --set image.tag=${{ steps.extract_branch.outputs.branch }} --set name=papi-prod # Deploy the Helm chart