Skip to content

Commit bfcca33

Browse files
kaifcoderkaifcoder
authored
Merge pull request #66 from step-security-bot/chore/GHA-112015-stepsecurity-remediation
[StepSecurity] Apply security best practices
2 parents 66f19bd + 92746ba commit bfcca33

File tree

7 files changed

+181
-29
lines changed

7 files changed

+181
-29
lines changed

‎.github/workflows/codeql.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: ["main"]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: ["main"]
20+
schedule:
21+
- cron: "0 0 * * 1"
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
analyze:
28+
name: Analyze
29+
runs-on: ubuntu-latest
30+
permissions:
31+
actions: read
32+
contents: read
33+
security-events: write
34+
35+
strategy:
36+
fail-fast: false
37+
matrix:
38+
language: ["go", "java", "javascript", "python"]
39+
# CodeQL supports [ $supported-codeql-languages ]
40+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
41+
42+
steps:
43+
- name: Harden the runner (Audit all outbound calls)
44+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
45+
with:
46+
egress-policy: audit
47+
48+
- name: Checkout repository
49+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
50+
51+
# Initializes the CodeQL tools for scanning.
52+
- name: Initialize CodeQL
53+
uses: github/codeql-action/init@bffd034ab1518ad839a542b8a7356e13a240e076 # v3.31.7
54+
with:
55+
languages: ${{ matrix.language }}
56+
# If you wish to specify custom queries, you can do so here or in a config file.
57+
# By default, queries listed here will override any specified in a config file.
58+
# Prefix the list here with "+" to use these queries and those in the config file.
59+
60+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
61+
# If this step fails, then you should remove it and run the build manually (see below)
62+
- name: Autobuild
63+
uses: github/codeql-action/autobuild@bffd034ab1518ad839a542b8a7356e13a240e076 # v3.31.7
64+
65+
# ℹ️ Command-line programs to run using the OS shell.
66+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
67+
68+
# If the Autobuild fails above, remove it and uncomment the following three lines.
69+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
70+
71+
# - run: |
72+
# echo "Run, Build Application using script"
73+
# ./location_of_script_within_repo/buildscript.sh
74+
75+
- name: Perform CodeQL Analysis
76+
uses: github/codeql-action/analyze@bffd034ab1518ad839a542b8a7356e13a240e076 # v3.31.7
77+
with:
78+
category: "/language:${{matrix.language}}"

‎.github/workflows/docs.yml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,16 @@ jobs:
2222
build-deploy:
2323
runs-on: ubuntu-latest
2424
steps:
25+
- name: Harden the runner (Audit all outbound calls)
26+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
27+
with:
28+
egress-policy: audit
29+
2530
- name: Checkout
26-
uses: actions/checkout@v4
31+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2732

2833
- name: Setup Node
29-
uses: actions/setup-node@v4
34+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
3035
with:
3136
node-version: 22
3237
- name: Remove node_modules and package-lock.json
@@ -39,9 +44,9 @@ jobs:
3944
run: npm run docs:build
4045

4146
- name: Upload artifact
42-
uses: actions/upload-pages-artifact@v3
47+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
4348
with:
4449
path: docs/.vitepress/dist
4550

4651
- name: Deploy to GitHub Pages
47-
uses: actions/deploy-pages@v4
52+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

‎.github/workflows/npm-publish.yml‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,20 @@ on:
77
release:
88
types: [created]
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
build:
1215
runs-on: ubuntu-latest
1316
steps:
14-
- uses: actions/checkout@v4
15-
- uses: actions/setup-node@v4
17+
- name: Harden the runner (Audit all outbound calls)
18+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
19+
with:
20+
egress-policy: audit
21+
22+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
23+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
1624
with:
1725
node-version: 22
1826
- name: Remove node_modules and package-lock.json
@@ -25,8 +33,13 @@ jobs:
2533
needs: [build]
2634
runs-on: ubuntu-latest
2735
steps:
28-
- uses: actions/checkout@v4
29-
- uses: actions/setup-node@v4
36+
- name: Harden the runner (Audit all outbound calls)
37+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
38+
with:
39+
egress-policy: audit
40+
41+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
42+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
3043
with:
3144
node-version: 20
3245
registry-url: https://registry.npmjs.org/

‎.github/workflows/pr-ci.yml‎

Lines changed: 46 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,15 @@ jobs:
2525
frontend: ${{ steps.filter.outputs.frontend }}
2626
any: ${{ steps.filter.outputs.any }}
2727
steps:
28-
- uses: actions/checkout@v4
28+
- name: Harden the runner (Audit all outbound calls)
29+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
30+
with:
31+
egress-policy: audit
32+
33+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2934
- name: Filter
3035
id: filter
31-
uses: dorny/paths-filter@v3
36+
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
3237
with:
3338
filters: |
3439
node:
@@ -50,8 +55,13 @@ jobs:
5055
if: needs.changes.outputs.node == 'true' || needs.changes.outputs.any == 'true'
5156
runs-on: ubuntu-latest
5257
steps:
53-
- uses: actions/checkout@v4
54-
- uses: actions/setup-node@v4
58+
- name: Harden the runner (Audit all outbound calls)
59+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
60+
with:
61+
egress-policy: audit
62+
63+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
64+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
5565
with:
5666
node-version: '22'
5767
cache: npm
@@ -71,8 +81,13 @@ jobs:
7181
if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.any == 'true'
7282
runs-on: ubuntu-latest
7383
steps:
74-
- uses: actions/checkout@v4
75-
- uses: actions/setup-node@v4
84+
- name: Harden the runner (Audit all outbound calls)
85+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
86+
with:
87+
egress-policy: audit
88+
89+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
90+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
7691
with:
7792
node-version: '20'
7893
cache: npm
@@ -90,8 +105,13 @@ jobs:
90105
if: needs.changes.outputs.python == 'true' || needs.changes.outputs.any == 'true'
91106
runs-on: ubuntu-latest
92107
steps:
93-
- uses: actions/checkout@v4
94-
- uses: actions/setup-python@v5
108+
- name: Harden the runner (Audit all outbound calls)
109+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
110+
with:
111+
egress-policy: audit
112+
113+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
114+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
95115
with:
96116
python-version: '3.12'
97117
cache: 'pip'
@@ -117,7 +137,12 @@ jobs:
117137
if: needs.changes.outputs.go == 'true' || needs.changes.outputs.any == 'true'
118138
runs-on: ubuntu-latest
119139
steps:
120-
- uses: actions/checkout@v4
140+
- name: Harden the runner (Audit all outbound calls)
141+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
142+
with:
143+
egress-policy: audit
144+
145+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
121146
- name: Build
122147
working-directory: templates/go
123148
run: go build -o service main.go
@@ -136,9 +161,14 @@ jobs:
136161
if: needs.changes.outputs.java == 'true' || needs.changes.outputs.any == 'true'
137162
runs-on: ubuntu-latest
138163
steps:
139-
- uses: actions/checkout@v4
164+
- name: Harden the runner (Audit all outbound calls)
165+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
166+
with:
167+
egress-policy: audit
168+
169+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
140170
- name: Set up Temurin JDK
141-
uses: actions/setup-java@v4
171+
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
142172
with:
143173
distribution: 'temurin'
144174
java-version: '21'
@@ -153,6 +183,11 @@ jobs:
153183
if: always()
154184
runs-on: ubuntu-latest
155185
steps:
186+
- name: Harden the runner (Audit all outbound calls)
187+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
188+
with:
189+
egress-policy: audit
190+
156191
- name: Report matrix
157192
run: |
158193
echo "Node: ${{ needs.node.result }}"

‎.github/workflows/release-notes.yml‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ on:
1515
default: 'main'
1616
type: string
1717

18+
permissions:
19+
contents: read
20+
1821
jobs:
1922
generate-release-notes:
2023
runs-on: ubuntu-latest
@@ -23,14 +26,19 @@ jobs:
2326
pull-requests: read
2427

2528
steps:
29+
- name: Harden the runner (Audit all outbound calls)
30+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
31+
with:
32+
egress-policy: audit
33+
2634
- name: Checkout code
27-
uses: actions/checkout@v4
35+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2836
with:
2937
fetch-depth: 0
3038
token: ${{ secrets.GITHUB_TOKEN }}
3139

3240
- name: Setup Node.js
33-
uses: actions/setup-node@v4
41+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
3442
with:
3543
node-version: '20'
3644

@@ -161,7 +169,7 @@ jobs:
161169
162170
- name: Update release with generated notes
163171
if: github.event_name == 'release'
164-
uses: actions/github-script@v7
172+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
165173
with:
166174
github-token: ${{ secrets.GITHUB_TOKEN }}
167175
script: |
@@ -187,7 +195,7 @@ jobs:
187195
188196
- name: Create draft release (for manual dispatch)
189197
if: github.event_name == 'workflow_dispatch'
190-
uses: actions/github-script@v7
198+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
191199
with:
192200
github-token: ${{ secrets.GITHUB_TOKEN }}
193201
script: |
@@ -232,7 +240,7 @@ jobs:
232240
}
233241
234242
- name: Upload release notes as artifact
235-
uses: actions/upload-artifact@v4
243+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
236244
with:
237245
name: release-notes-${{ steps.release_info.outputs.version }}
238246
path: release-notes.md

‎.github/workflows/scorecard.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,11 @@ jobs:
3333
# actions: read
3434

3535
steps:
36+
- name: Harden the runner (Audit all outbound calls)
37+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
38+
with:
39+
egress-policy: audit
40+
3641
- name: "Checkout code"
3742
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3843
with:
@@ -73,9 +78,9 @@ jobs:
7378
# Upload the results to GitHub's code scanning dashboard (optional).
7479
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
7580
- name: "Upload to code-scanning"
76-
uses: github/codeql-action/upload-sarif@v3
81+
uses: github/codeql-action/upload-sarif@bffd034ab1518ad839a542b8a7356e13a240e076 # v3.31.7
7782
with:
7883
sarif_file: results.sarif
7984

8085
- name: OSSF Scorecard action
81-
uses: ossf/[email protected]
86+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3

‎.github/workflows/test-release-notes.yml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ on:
1717
required: false
1818
type: string
1919

20+
permissions:
21+
contents: read
22+
2023
jobs:
2124
test-release-notes:
2225
runs-on: ubuntu-latest
@@ -25,14 +28,19 @@ jobs:
2528
pull-requests: read
2629

2730
steps:
31+
- name: Harden the runner (Audit all outbound calls)
32+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
33+
with:
34+
egress-policy: audit
35+
2836
- name: Checkout code
29-
uses: actions/checkout@v4
37+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3038
with:
3139
fetch-depth: 0
3240
ref: ${{ github.event.inputs.target_branch || github.ref }}
3341

3442
- name: Setup Node.js
35-
uses: actions/setup-node@v4
43+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
3644
with:
3745
node-version: '20'
3846

@@ -342,7 +350,7 @@ jobs:
342350
echo "✅ Cleanup completed"
343351
344352
- name: Upload test results
345-
uses: actions/upload-artifact@v4
353+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
346354
if: always()
347355
with:
348356
name: release-notes-test-results-${{ github.event.inputs.test_scenario }}

0 commit comments

Comments
 (0)