Skip to content

Commit c557847

Browse files
step-security-botstep-security-bot
authored
[StepSecurity] Apply security best practices (#203)
Signed-off-by: StepSecurity Bot <[email protected]>
1 parent 0f13c01 commit c557847

File tree

8 files changed

+168
-1
lines changed

8 files changed

+168
-1
lines changed

‎.github/dependabot.yml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,19 @@ updates:
1111
interval: daily
1212
open-pull-requests-limit: 10
1313
commit-message:
14-
prefix: "[gha] "
14+
prefix: "[gha] "
15+
16+
- package-ecosystem: github-actions
17+
directory: /
18+
schedule:
19+
interval: daily
20+
21+
- package-ecosystem: pip
22+
directory: /
23+
schedule:
24+
interval: daily
25+
26+
- package-ecosystem: pip
27+
directory: /standalone-node
28+
schedule:
29+
interval: daily

‎.github/workflows/auto-add-labels.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ jobs:
1919
pull-requests: write
2020
runs-on: ubuntu-latest
2121
steps:
22+
- name: Harden the runner (Audit all outbound calls)
23+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
24+
with:
25+
egress-policy: audit
26+
2227
- uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
2328
with:
2429
repo-token: ${{ secrets.SYS_ORCH_GITHUB }}

‎.github/workflows/auto-close.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ jobs:
1919
pull-requests: write
2020
runs-on: ubuntu-latest
2121
steps:
22+
- name: Harden the runner (Audit all outbound calls)
23+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
24+
with:
25+
egress-policy: audit
26+
2227
- uses: actions/stale@3a9db7e6a41a89f618792c92c0e97cc736e1b13f # v10.0.0
2328
with:
2429
repo-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/auto-update.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@ jobs:
2828
runs-on: ubuntu-latest
2929

3030
steps:
31+
- name: Harden the runner (Audit all outbound calls)
32+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
33+
with:
34+
egress-policy: audit
35+
3136
- name: Checkout repository
3237
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
3338
with:

‎.github/workflows/dependency-review.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Harden the runner (Audit all outbound calls)
20+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
21+
with:
22+
egress-policy: audit
23+
24+
- name: 'Checkout Repository'
25+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
26+
- name: 'Dependency Review'
27+
uses: actions/dependency-review-action@595b5aeba73380359d98a5e087f648dbb0edce1b # v4.7.3

‎.github/workflows/pre-merge.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,11 @@ jobs:
2727
env:
2828
GITHUB_ACTIONS: true
2929
steps:
30+
- name: Harden the runner (Audit all outbound calls)
31+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
32+
with:
33+
egress-policy: audit
34+
3035
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
3136
with:
3237
persist-credentials: false
@@ -54,6 +59,11 @@ jobs:
5459
permissions:
5560
contents: read
5661
steps:
62+
- name: Harden the runner (Audit all outbound calls)
63+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
64+
with:
65+
egress-policy: audit
66+
5767
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
5868
with:
5969
persist-credentials: false
@@ -112,6 +122,11 @@ jobs:
112122
if: ${{ always() }}
113123
needs: [pre-merge-root, pre-merge-pipeline]
114124
steps:
125+
- name: Harden the runner (Audit all outbound calls)
126+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
127+
with:
128+
egress-policy: audit
129+
115130
- name: Final Status Check
116131
env:
117132
pre_merge_root_pipeline: ${{ needs.pre-merge-root.result }}

‎.github/workflows/scorecards.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# This workflow uses actions that are not certified by GitHub. They are provided
2+
# by a third-party and are governed by separate terms of service, privacy
3+
# policy, and support documentation.
4+
5+
name: Scorecard supply-chain security
6+
on:
7+
# For Branch-Protection check. Only the default branch is supported. See
8+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
9+
branch_protection_rule:
10+
# To guarantee Maintained check is occasionally updated. See
11+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
12+
schedule:
13+
- cron: '20 7 * * 2'
14+
push:
15+
branches: ["main"]
16+
17+
# Declare default permissions as read only.
18+
permissions: read-all
19+
20+
jobs:
21+
analysis:
22+
name: Scorecard analysis
23+
runs-on: ubuntu-latest
24+
permissions:
25+
# Needed to upload the results to code-scanning dashboard.
26+
security-events: write
27+
# Needed to publish results and get a badge (see publish_results below).
28+
id-token: write
29+
contents: read
30+
actions: read
31+
# To allow GraphQL ListCommits to work
32+
issues: read
33+
pull-requests: read
34+
# To detect SAST tools
35+
checks: read
36+
37+
steps:
38+
- name: Harden the runner (Audit all outbound calls)
39+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
40+
with:
41+
egress-policy: audit
42+
43+
- name: "Checkout code"
44+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
45+
with:
46+
persist-credentials: false
47+
48+
- name: "Run analysis"
49+
uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
50+
with:
51+
results_file: results.sarif
52+
results_format: sarif
53+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
54+
# - you want to enable the Branch-Protection check on a *public* repository, or
55+
# - you are installing Scorecards on a *private* repository
56+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
57+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
58+
59+
# Public repositories:
60+
# - Publish results to OpenSSF REST API for easy access by consumers
61+
# - Allows the repository to include the Scorecard badge.
62+
# - See https://github.com/ossf/scorecard-action#publishing-results.
63+
# For private repositories:
64+
# - `publish_results` will always be set to `false`, regardless
65+
# of the value entered here.
66+
publish_results: true
67+
68+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
69+
# format to the repository Actions tab.
70+
- name: "Upload artifact"
71+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
72+
with:
73+
name: SARIF file
74+
path: results.sarif
75+
retention-days: 5
76+
77+
# Upload the results to GitHub's code scanning dashboard.
78+
- name: "Upload to code-scanning"
79+
uses: github/codeql-action/upload-sarif@d3678e237b9c32a6c9bffb3315c335f976f3549f # v3.30.2
80+
with:
81+
sarif_file: results.sarif

‎.pre-commit-config.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
repos:
2+
- repo: https://github.com/gitleaks/gitleaks
3+
rev: v8.16.3
4+
hooks:
5+
- id: gitleaks
6+
- repo: https://github.com/jumanjihouse/pre-commit-hooks
7+
rev: 3.0.0
8+
hooks:
9+
- id: shellcheck
10+
- repo: https://github.com/pre-commit/pre-commit-hooks
11+
rev: v4.4.0
12+
hooks:
13+
- id: end-of-file-fixer
14+
- id: trailing-whitespace

0 commit comments

Comments
 (0)