Skip to content

Commit 599b446

Browse files
step-security-botstep-security-bot
authored
ci: Harden GitHub Actions [StepSecurity] (#389)
[StepSecurity] ci: Harden GitHub Actions Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
1 parent 8c14df1 commit 599b446

11 files changed

Lines changed: 95 additions & 4 deletions

‎.github/workflows/ci.yaml‎

Lines changed: 39 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,11 @@ jobs:
3737
changed-tests-files: ${{ steps.changed-files-yaml.outputs.tests_any_changed }}
3838
steps:
3939
# Checkout the repository
40+
- name: Harden the runner (Audit all outbound calls)
41+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
42+
with:
43+
egress-policy: audit
44+
4045
- name: Checkout Code
4146
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4247
- name: Get changed files
@@ -71,6 +76,11 @@ jobs:
7176
- clippy
7277
runs-on: ubuntu-latest
7378
steps:
79+
- name: Harden the runner (Audit all outbound calls)
80+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
81+
with:
82+
egress-policy: audit
83+
7484
- name: Failed
7585
run: exit 1
7686
if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
@@ -80,6 +90,11 @@ jobs:
8090
needs: changed_files
8191
steps:
8292
# Checkout the repository
93+
- name: Harden the runner (Audit all outbound calls)
94+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
95+
with:
96+
egress-policy: audit
97+
8398
- name: Checkout Code
8499
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
85100
- name: Prepare
@@ -90,7 +105,7 @@ jobs:
90105
- name: Get cache-hit output
91106
run: 'echo "Cache hit >>>>>: ${{ steps.init.outputs.cache-hit }}"'
92107
- name: Install cargo hack
93-
uses: taiki-e/install-action@cargo-hack
108+
uses: taiki-e/install-action@7689010b667477e55299b24c373cdf719c945fdf # cargo-hack
94109

95110
# Check the minimum supported Rust version
96111
- name: Default features
@@ -101,6 +116,11 @@ jobs:
101116
runs-on: ubuntu-latest
102117
steps:
103118
# Checkout the repository
119+
- name: Harden the runner (Audit all outbound calls)
120+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
121+
with:
122+
egress-policy: audit
123+
104124
- name: Checkout Code
105125
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
106126
- name: Prepare
@@ -120,6 +140,11 @@ jobs:
120140
runs-on: ubuntu-latest
121141
steps:
122142
# Checkout the repository
143+
- name: Harden the runner (Audit all outbound calls)
144+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
145+
with:
146+
egress-policy: audit
147+
123148
- name: Checkout Code
124149
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
125150
- name: Prepare
@@ -162,10 +187,15 @@ jobs:
162187
runs-on: ubuntu-latest
163188
steps:
164189
# Checkout the repository
190+
- name: Harden the runner (Audit all outbound calls)
191+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
192+
with:
193+
egress-policy: audit
194+
165195
- name: Checkout Code
166196
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
167197
- name: Setup Node.js
168-
uses: actions/setup-node@v4
198+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
169199
with:
170200
node-version: '20'
171201
- name: Install TypeScript and ts-node
@@ -195,9 +225,9 @@ jobs:
195225
- name: Get cache-hit output
196226
run: 'echo "Cache hit >>>>>: ${{ steps.init.outputs.cache-hit }}"'
197227
- name: Install cargo hack
198-
uses: taiki-e/install-action@cargo-hack
228+
uses: taiki-e/install-action@7689010b667477e55299b24c373cdf719c945fdf # cargo-hack
199229
- name: Install cargo-llvm-cov
200-
uses: taiki-e/install-action@cargo-llvm-cov
230+
uses: taiki-e/install-action@16edcff251c6bb06f6878981359f84b77b28e7e2 # cargo-llvm-cov
201231
- name: Build
202232
run: cargo test --no-run --locked
203233

@@ -263,6 +293,11 @@ jobs:
263293
${{ github.event.pull_request.draft == false && needs.changed_files.outputs.changed-docker-files == 'true' }}
264294
steps:
265295
# Checkout the repository
296+
- name: Harden the runner (Audit all outbound calls)
297+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
298+
with:
299+
egress-policy: audit
300+
266301
- name: Checkout Code
267302
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
268303
- name: Set up Docker Buildx

‎.github/workflows/codeql.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ on:
99
- main
1010
schedule:
1111
- cron: 25 21 * * 1
12+
permissions:
13+
contents: read
14+
1215
jobs:
1316
analyze:
1417
name: Analyze (${{ matrix.language }})
@@ -32,6 +35,11 @@ jobs:
3235
- language: rust
3336
build-mode: none
3437
steps:
38+
- name: Harden the runner (Audit all outbound calls)
39+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
40+
with:
41+
egress-policy: audit
42+
3543
- name: Checkout repository
3644
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.5.4
3745

‎.github/workflows/pr-title.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,11 @@ jobs:
1313
validate:
1414
runs-on: ubuntu-latest
1515
steps:
16+
- name: Harden the runner (Audit all outbound calls)
17+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
18+
with:
19+
egress-policy: audit
20+
1621
- uses: thehanimo/pr-title-checker@7fbfe05602bdd86f926d3fb3bccb6f3aed43bc70 # v1.4.3
1722
with:
1823
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/rc.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,11 @@ jobs:
2222
create-release-branch:
2323
runs-on: ubuntu-latest
2424
steps:
25+
- name: Harden the runner (Audit all outbound calls)
26+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
27+
with:
28+
egress-policy: audit
29+
2530
- uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
2631
id: gh-app-token
2732
with:

‎.github/workflows/release-docker.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@ jobs:
1717
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
1818
SLACK_CHANNEL: '#oss-releases'
1919
steps:
20+
- name: Harden the runner (Audit all outbound calls)
21+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
22+
with:
23+
egress-policy: audit
24+
2025
- name: Slack notification
2126
uses: act10ns/slack@44541246747a30eb3102d87f7a4cc5471b0ffb7d # v2.1.0
2227
with:

‎.github/workflows/release-docs.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@ jobs:
2828
SLACK_CHANNEL: '#oss-releases'
2929
TAG: ${{ inputs.tag || github.event.inputs.tag }}
3030
steps:
31+
- name: Harden the runner (Audit all outbound calls)
32+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
33+
with:
34+
egress-policy: audit
35+
3136
- name: Get github app token
3237
uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
3338
id: gh-app-token

‎.github/workflows/release-please.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ jobs:
2525
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
2626
SLACK_CHANNEL: '#oss-releases'
2727
steps:
28+
- name: Harden the runner (Audit all outbound calls)
29+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
30+
with:
31+
egress-policy: audit
32+
2833
- name: Get github app token
2934
uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
3035
id: gh-app-token
@@ -114,6 +119,11 @@ jobs:
114119
needs: release-please
115120
if: ${{ needs.release-please.outputs.release_created == 'false' && needs.release-please.outputs.pr_created == 'true' }}
116121
steps:
122+
- name: Harden the runner (Audit all outbound calls)
123+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
124+
with:
125+
egress-policy: audit
126+
117127
- name: Get github app token
118128
uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
119129
id: gh-app-token

‎.github/workflows/release-sbom.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,11 @@ jobs:
1616
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
1717
SLACK_CHANNEL: '#oss-releases'
1818
steps:
19+
- name: Harden the runner (Audit all outbound calls)
20+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
21+
with:
22+
egress-policy: audit
23+
1924
- name: Get github app token
2025
uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
2126
id: gh-app-token

‎.github/workflows/rust-docs-url.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,11 @@ jobs:
2222
runs-on: ubuntu-latest
2323
environment: release
2424
steps:
25+
- name: Harden the runner (Audit all outbound calls)
26+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
27+
with:
28+
egress-policy: audit
29+
2530
- uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
2631
id: gh-app-token
2732
with:

‎.github/workflows/semgrep.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ on:
1212
# Schedule the CI job (this method uses cron syntax):
1313
schedule:
1414
- cron: 15 11 * * * # Sets Semgrep to scan every day at 11:15 UTC.
15+
permissions:
16+
contents: read
17+
1518
jobs:
1619
semgrep:
1720
name: semgrep/ci

0 commit comments

Comments
 (0)