Merge pull request #13847 from Azure/v-rusraut/securityalertfixworkflow

v-atulyadav · web-flow · commit 3447dde8e5c2 · 2026-03-17T17:28:29.000+05:30
Fixed Security Alert Issue for workflow files
diff --git a/.github/workflows/addCommentToRemindUpdatingTemplateVersion.yml b/.github/workflows/addCommentToRemindUpdatingTemplateVersion.yml
@@ -15,7 +15,7 @@ jobs:
       hasAutoDetectionComment: ${{ steps.job1.outputs.hasAutoDetectionComment }}
     steps:
       - name: Find Comment
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@5bed3ff3b347db473a92357bb8a37455be2dd767
         id: fc
         with:
           issue-number: ${{ github.event.pull_request.number }}
diff --git a/.github/workflows/convertKqlFunctionYamlToArmTemplate.yaml b/.github/workflows/convertKqlFunctionYamlToArmTemplate.yaml
@@ -54,7 +54,7 @@ jobs:
           python-version: "3.x"
           architecture: "x64"
       - name: Install yamale package
-        uses: BSFishy/pip-action@v1
+        uses: BSFishy/pip-action@53e8bcfedbdc8bd6798360d0dba6b485bc9df8fd
         with:
           packages: |
             yamale
@@ -88,14 +88,14 @@ jobs:
             echo "Arm templates were changed. Changes were committed"
           fi
       - name: Push changes
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@57116acb309081ee57864270b0e3c4cedbe45452
         if: ${{ env.armTemplatesChanged == 'true' }}
         with:
           github_token: ${{ steps.generate_token.outputs.token }}
           repository: ${{github.event.pull_request.head.repo.full_name}}
           branch: ${{ github.head_ref }}
       - name: Add comment
-        uses: mshick/add-pr-comment@v1
+        uses: mshick/add-pr-comment@3b5edaaa32fd0272ba44e0eb2d9070b55110e0b9
         if: ${{ env.armTemplatesChanged == 'true' }}
         with:
           message: |
diff --git a/.github/workflows/runAsimSchemaAndDataTesters.yaml b/.github/workflows/runAsimSchemaAndDataTesters.yaml
@@ -7,19 +7,19 @@ on:
     branches:
       - master
     paths:
-    - 'Parsers/ASimDns/Parsers/**'
-    - 'Parsers/ASimNetworkSession/Parsers/**'
-    - 'Parsers/ASimWebSession/Parsers/**'
-    - 'Parsers/ASimProcessEvent/Parsers/**'
-    - 'Parsers/ASimAuditEvent/Parsers/**'
-    - 'Parsers/ASimAuthentication/Parsers/**'
-    - 'Parsers/ASimFileEvent/Parsers/**'
-    - 'Parsers/ASimRegistryEvent/Parsers/**'
-    - 'Parsers/ASimUserManagement/Parsers/**'
-    - 'Parsers/ASimDhcpEvent/Parsers/**'
-    - 'Parsers/ASimAlertEvent/Parsers/**'
-    - 'Parsers/ASimAssetEntity/Parsers/**'
-    
+      - "Parsers/ASimDns/Parsers/**"
+      - "Parsers/ASimNetworkSession/Parsers/**"
+      - "Parsers/ASimWebSession/Parsers/**"
+      - "Parsers/ASimProcessEvent/Parsers/**"
+      - "Parsers/ASimAuditEvent/Parsers/**"
+      - "Parsers/ASimAuthentication/Parsers/**"
+      - "Parsers/ASimFileEvent/Parsers/**"
+      - "Parsers/ASimRegistryEvent/Parsers/**"
+      - "Parsers/ASimUserManagement/Parsers/**"
+      - "Parsers/ASimDhcpEvent/Parsers/**"
+      - "Parsers/ASimAlertEvent/Parsers/**"
+      - "Parsers/ASimAssetEntity/Parsers/**"
+
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
@@ -35,7 +35,7 @@ concurrency:
       || format('run-{0}', github.run_id) }}
   cancel-in-progress: ${{ github.event.pull_request.head.repo.fork }}
 
-jobs: 
+jobs:
   # Security gate: Fork PRs require manual approval via "SafeToRun" label
   # Internal PRs (same repo) can proceed without labels
   security-gate:
@@ -63,13 +63,13 @@ jobs:
           # Function to log with consistent formatting
           log_info() { echo "ℹ️  $1"; }
           log_success() { echo "✅ $1"; }
-          
+
           log_info "Starting PR approval check..."
-          
+
           # Check if this is a fork PR
           is_fork="${{ github.event.pull_request.head.repo.fork }}"
           log_info "Fork PR: $is_fork"
-          
+
           if [ "$is_fork" = "true" ]; then
             log_info "FORK PR DETECTED - Proceeding with security checks"
             
@@ -140,7 +140,7 @@ jobs:
             echo "$modified_files" | grep "\.script/tests/asimParsersTest/" | sed 's/^/  - /'
             exit 1
           fi
-          
+
           log_success "No modifications to asimParsersTest folder detected"
 
       - name: Comment on fork PR for approval guidance
@@ -156,9 +156,9 @@ jobs:
               const icons = { info: 'ℹ️', success: '✅', warning: '⚠️', error: '❌' };
               console.log(`${icons[level] || 'ℹ️'} ${message}`);
             };
-            
+
             log('info', 'Comment step triggered for fork PR approval guidance');
-            
+
             try {
               // Fetch existing comments
               const { data: comments } = await github.rest.issues.listComments({
@@ -244,46 +244,46 @@ jobs:
       - name: Checkout pull request branch
         uses: actions/checkout@v3
         with:
-            ref: ${{github.event.pull_request.head.sha}}
-            repository: ${{github.event.pull_request.head.repo.full_name}}
-            persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal access token.
-            fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository.
+          ref: ${{github.event.pull_request.head.sha}}
+          repository: ${{github.event.pull_request.head.repo.full_name}}
+          persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal access token.
+          fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository.
       - name: Setup git config
         run: |
-              git config --local user.name "github-actions[bot]"
-              git config --local user.email "<>"
+          git config --local user.name "github-actions[bot]"
+          git config --local user.email "<>"
       - name: Merge master into pull request branch
         run: |
-              git merge origin/master
-              Conflicts=$(git ls-files -u | wc -l)
-              if [ "$Conflicts" -gt 0 ] ; then
-                echo "There is a merge conflict. Aborting"
-                git merge --abort
-                exit 1
-              fi
+          git merge origin/master
+          Conflicts=$(git ls-files -u | wc -l)
+          if [ "$Conflicts" -gt 0 ] ; then
+            echo "There is a merge conflict. Aborting"
+            git merge --abort
+            exit 1
+          fi
       - name: Set up Python
         uses: actions/setup-python@v2
         with:
-          python-version: '3.x'
+          python-version: "3.x"
       - name: Install dependencies
         run: |
-              python -m pip install --upgrade pip
-              pip install requests
-              pip install PyYAML
-              pip install tabulate
+          python -m pip install --upgrade pip
+          pip install requests
+          pip install PyYAML
+          pip install tabulate
       - name: Run ASim parsers template validations python script
         run: |
-              filePath=".script/tests/asimParsersTest/VerifyASimParserTemplate.py"
-              url="https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/.script/tests/asimParsersTest/VerifyASimParserTemplate.py" 
-              # Check if file exists and delete if it does
-              if [ -f "$filePath" ]; then
-                rm -f "$filePath"
-              fi
-              # Download the file
-              echo "Downloading script from the master: $url"
-              curl -o "$filePath" "$url"
-              # Execute the script
-              python "$filePath" 
+          filePath=".script/tests/asimParsersTest/VerifyASimParserTemplate.py"
+          url="https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/.script/tests/asimParsersTest/VerifyASimParserTemplate.py" 
+          # Check if file exists and delete if it does
+          if [ -f "$filePath" ]; then
+            rm -f "$filePath"
+          fi
+          # Download the file
+          echo "Downloading script from the master: $url"
+          curl -o "$filePath" "$url"
+          # Execute the script
+          python "$filePath"
   Run-ASim-Sample-Data-Ingest:
     needs: Run-ASim-TemplateValidation
     name: Run ASim Sample Data Ingestion
@@ -295,56 +295,56 @@ jobs:
       - name: Checkout pull request branch
         uses: actions/checkout@v4
         with:
-            ref: ${{github.event.pull_request.head.sha}}
-            repository: ${{github.event.pull_request.head.repo.full_name}}
-            persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal access token.
-            fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository.
+          ref: ${{github.event.pull_request.head.sha}}
+          repository: ${{github.event.pull_request.head.repo.full_name}}
+          persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal access token.
+          fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository.
       - name: Setup git config
         run: |
-              git config --local user.name "github-actions[bot]"
-              git config --local user.email "<>"
+          git config --local user.name "github-actions[bot]"
+          git config --local user.email "<>"
       - name: Merge master into pull request branch
         run: |
-              git merge origin/master
-              Conflicts=$(git ls-files -u | wc -l)
-              if [ "$Conflicts" -gt 0 ] ; then
-                echo "There is a merge conflict. Aborting"
-                git merge --abort
-                exit 1
-              fi
+          git merge origin/master
+          Conflicts=$(git ls-files -u | wc -l)
+          if [ "$Conflicts" -gt 0 ] ; then
+            echo "There is a merge conflict. Aborting"
+            git merge --abort
+            exit 1
+          fi
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.x'
+          python-version: "3.x"
       - name: Install dependencies
         run: |
-              python -m pip install --upgrade pip
-              pip install azure-identity
-              pip install requests
-              pip install PyYAML
-              pip install azure-monitor-ingestion
-              pip install azure-core
+          python -m pip install --upgrade pip
+          pip install azure-identity
+          pip install requests
+          pip install PyYAML
+          pip install azure-monitor-ingestion
+          pip install azure-core
       - name: Login to Azure Public Cloud
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5
         with:
           client-id: ${{ secrets.AZURE_ASIM_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           allow-no-subscriptions: true
       - name: Asim Sample Log Ingestion
         id: Ingestlogs
         run: |
-              filePath=".script/tests/asimParsersTest/ingestASimSampleData.py"
-              url="https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/.script/tests/asimParsersTest/ingestASimSampleData.py" 
-              # Check if file exists and delete if it does
-              if [ -f "$filePath" ]; then
-                rm -f "$filePath"
-              fi
-              # Download the file
-              echo "Downloading script from the master: $url"
-              curl -o "$filePath" "$url"
-              chmod +x "$filePath"
-              # Execute the script
-              python "$filePath" "${{ github.event.pull_request.number }}"
+          filePath=".script/tests/asimParsersTest/ingestASimSampleData.py"
+          url="https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/.script/tests/asimParsersTest/ingestASimSampleData.py" 
+          # Check if file exists and delete if it does
+          if [ -f "$filePath" ]; then
+            rm -f "$filePath"
+          fi
+          # Download the file
+          echo "Downloading script from the master: $url"
+          curl -o "$filePath" "$url"
+          chmod +x "$filePath"
+          # Execute the script
+          python "$filePath" "${{ github.event.pull_request.number }}"
   Run-ASim-Schema-Data-tests:
     needs: Run-ASim-Sample-Data-Ingest
     name: Run ASim Schema and Data tests
@@ -360,9 +360,9 @@ jobs:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           persist-credentials: false
           fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository.
-      
+
       - name: Login to Azure Public Cloud with AzPowershell
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5
         with:
           client-id: ${{ secrets.AZURE_ASIM_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -384,7 +384,7 @@ jobs:
             exit 1
           fi
       - name: Run ASIM Schema and Data tests PowerShell script
-        uses: azure/powershell@v2
+        uses: azure/powershell@53dd145408794f7e80f97cfcca04155c85234709
         with:
           inlineScript: |
             $filePath = ".script/tests/asimParsersTest/runAsimTesters.ps1"
@@ -426,8 +426,8 @@ jobs:
           fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository.
       - name: Setup git config
         run: |
-              git config --local user.name "github-actions[bot]"
-              git config --local user.email "<>"
+          git config --local user.name "github-actions[bot]"
+          git config --local user.email "<>"
       - name: Merge master into pull request branch
         run: |
           git merge origin/master
@@ -440,15 +440,15 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v2
         with:
-          python-version: '3.x'
+          python-version: "3.x"
       - name: Install dependencies
         run: |
-              python -m pip install --upgrade pip
-              pip install PyYAML
-              pip install azure-identity
-              pip install azure-monitor-query
+          python -m pip install --upgrade pip
+          pip install PyYAML
+          pip install azure-identity
+          pip install azure-monitor-query
       - name: Login to Azure Public Cloud
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5
         with:
           client-id: ${{ secrets.AZURE_ASIM_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
