Skip to content

Commit 784a044

Browse files
martincostellomartincostello
authored
Harden GitHub Actions workflows (#841)
* Harden GitHub Actions workflows - Add CodeQL analysis. - Add actionlint analysis. - Add zizmor analysis. - Fix zizmor findings by: - Adding version comments to GitHub Actions pins. - Using latest GitHub Actions versions. - Adding timeouts. - Adding concurrency. - Refactoring permissions to least privilege. - Removing third-party actions. - Adding dependabot with cooldown. - Disabling npm caching. Contributes to #814. * Fix typo Add missing space from copy-paste mistake.
1 parent bf9b81a commit 784a044

8 files changed

Lines changed: 213 additions & 25 deletions

File tree

‎.github/actionlint-matcher.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"problemMatcher": [
3+
{
4+
"owner": "actionlint",
5+
"pattern": [
6+
{
7+
"regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
8+
"file": 1,
9+
"line": 2,
10+
"column": 3,
11+
"message": 4,
12+
"code": 5
13+
}
14+
]
15+
}
16+
]
17+
}

‎.github/dependabot.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
cooldown:
5+
default-days: 7
6+
directory: "/"
7+
schedule:
8+
interval: monthly

‎.github/workflows/codeql.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: codeql
2+
3+
on:
4+
push:
5+
branches: [ master ]
6+
pull_request:
7+
schedule:
8+
- cron: '0 6 * * MON'
9+
workflow_dispatch:
10+
11+
permissions: {}
12+
13+
jobs:
14+
analysis:
15+
name: analysis
16+
runs-on: ubuntu-latest
17+
timeout-minutes: 10
18+
19+
concurrency:
20+
group: ${{ github.workflow }}-${{ github.sha }}
21+
cancel-in-progress: false
22+
23+
permissions:
24+
actions: read # Scan GitHub Actions workflows
25+
contents: read # Checkout the repository
26+
security-events: write # Store results in the Security tab
27+
28+
strategy:
29+
fail-fast: false
30+
matrix:
31+
language: [ 'actions', 'javascript' ]
32+
33+
steps:
34+
- name: Checkout repository
35+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
36+
with:
37+
persist-credentials: false
38+
show-progress: false
39+
40+
- name: Initialize CodeQL
41+
uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
42+
with:
43+
languages: ${{ matrix.language }}
44+
queries: security
45+
46+
- name: Perform CodeQL Analysis
47+
uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
48+
with:
49+
category: '/language:${{ matrix.language }}'
50+
51+
codeql:
52+
if: ${{ !cancelled() }}
53+
name: codeql
54+
needs: [ analysis ]
55+
runs-on: ubuntu-latest
56+
timeout-minutes: 5
57+
58+
concurrency:
59+
group: ${{ github.workflow }}-${{ github.sha }}
60+
cancel-in-progress: false
61+
62+
steps:
63+
- name: Report status
64+
shell: bash
65+
env:
66+
SCAN_SUCCESS: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
67+
run: |
68+
if [ "${SCAN_SUCCESS}" == "true" ]
69+
then
70+
echo 'CodeQL analysis successful ✅'
71+
else
72+
echo 'CodeQL analysis failed ❌'
73+
exit 1
74+
fi

‎.github/workflows/greetings.yml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,23 @@ name: Greetings
22

33
on: [issues]
44

5+
permissions: {}
6+
57
jobs:
68
greeting:
9+
name: greeting
710
runs-on: ubuntu-latest
11+
timeout-minutes: 10
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.event.issue.number || github.ref }}
15+
cancel-in-progress: false
16+
17+
permissions:
18+
issues: write # Needed to comment on issues
19+
820
steps:
9-
- uses: actions/first-interaction@v1
21+
- uses: actions/first-interaction@3c71ce730280171fd1cfb57c00c774f8998586f7 # v1
1022
with:
1123
repo-token: ${{ secrets.GITHUB_TOKEN }}
1224
issue-message: 'We''re glad you find this project helpful. We''ll try to address this issue ASAP. You can join Discord channel(https://discord.gg/X4Qp9u6Vz) for anonucements and pre release discussions. Don''t forget to star this repo.'

‎.github/workflows/lint.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: lint
2+
3+
on:
4+
push:
5+
branches: [ master ]
6+
pull_request:
7+
workflow_dispatch:
8+
9+
permissions: {}
10+
11+
jobs:
12+
lint:
13+
name: Lint workflows
14+
runs-on: ubuntu-latest
15+
timeout-minutes: 10
16+
17+
concurrency:
18+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
19+
cancel-in-progress: false
20+
21+
env:
22+
FORCE_COLOR: 1
23+
TERM: xterm
24+
25+
permissions:
26+
actions: read # Scan GitHub Actions workflows
27+
contents: read # Checkout the repository
28+
security-events: write # Store results in the Security tab
29+
30+
steps:
31+
32+
- name: Checkout code
33+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
34+
with:
35+
persist-credentials: false
36+
show-progress: false
37+
38+
- name: Add actionlint problem matcher
39+
run: echo "::add-matcher::.github/actionlint-matcher.json"
40+
41+
- name: Lint workflows with actionlint
42+
uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
43+
with:
44+
args: -color
45+
46+
- name: Lint workflows with zizmor
47+
uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6

‎.github/workflows/node.js.yml‎

Lines changed: 24 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
1-
# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
2-
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
3-
41
name: Node.js CI
52

63
on:
@@ -9,24 +6,42 @@ on:
96
pull_request:
107
branches: [ master ]
118

12-
permissions:
13-
contents: read
9+
permissions: {}
1410

1511
jobs:
1612
build:
13+
name: build
1714
runs-on: ubuntu-latest
15+
timeout-minutes: 10
16+
17+
concurrency:
18+
group: ${{ github.workflow }}-${{ github.sha }}
19+
cancel-in-progress: false
20+
21+
permissions:
22+
contents: read
1823

1924
strategy:
2025
matrix:
2126
node-version: [14.x, 16.x, 18.x, 20.x, 22.x]
2227

2328
steps:
24-
- uses: actions/checkout@v4
29+
- name: Checkout
30+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
31+
with:
32+
persist-credentials: false
33+
2534
- name: Use Node.js ${{ matrix.node-version }}
26-
uses: actions/setup-node@v4
35+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
2736
with:
2837
node-version: ${{ matrix.node-version }}
38+
package-manager-cache: false
39+
2940
- name: Set PUBLISH_PLEASE_DISABLE_PROMPT
3041
run: echo "PUBLISH_PLEASE_DISABLE_PROMPT=true" >> $GITHUB_ENV
31-
- run: npm install --ignore-scripts
32-
- run: npm run test
42+
43+
- name: Install dependencies
44+
run: npm install --ignore-scripts
45+
46+
- name: Run tests
47+
run: npm run test

‎.github/workflows/publish.yml‎

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -5,29 +5,38 @@ on:
55
tags:
66
- 'v*'
77

8-
permissions:
9-
contents: write # needed to create the GitHub release
10-
id-token: write # needed for npm trusted publishing (OIDC)
8+
permissions: {}
119

1210
jobs:
1311
publish:
12+
name: publish
1413
runs-on: ubuntu-latest
15-
# If you set an "Environment name" on the npm trusted publisher page,
16-
# uncomment the line below and use the same name. This lets you add a
17-
# required-reviewer gate in repo Settings > Environments if you want
18-
# one last manual "approve" click before publish actually runs.
19-
environment: npm-publish
14+
timeout-minutes: 10
15+
16+
concurrency:
17+
group: ${{ github.workflow }}-${{ github.ref }}
18+
cancel-in-progress: false
19+
20+
environment:
21+
name: npm-publish
22+
deployment: false
23+
24+
permissions:
25+
contents: write # Needed to create the GitHub release
26+
id-token: write # Needed for npm trusted publishing (OIDC)
2027

2128
steps:
2229
- name: Checkout
23-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
30+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
31+
with:
32+
persist-credentials: false
2433

2534
- name: Setup Node
26-
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
35+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
2736
with:
2837
node-version: 24
38+
package-manager-cache: false
2939
registry-url: 'https://registry.npmjs.org'
30-
cache: 'npm'
3140

3241
- name: Install dependencies
3342
run: npm ci
@@ -44,7 +53,9 @@ jobs:
4453
- name: Publish to npm
4554
run: npm publish
4655

47-
- name: Create GitHub Release
48-
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
49-
with:
50-
generate_release_notes: true
56+
- name: Create GitHub release
57+
shell: bash
58+
env:
59+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
60+
run: |
61+
gh release create "${GITHUB_REF_NAME}" --generate-notes --repo "${GITHUB_REPOSITORY}"

‎.github/zizmor.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
rules:
2+
dependabot-cooldown:
3+
config:
4+
days: 7

0 commit comments

Comments
 (0)