Skip to content

Commit ec57988

Browse files
vikrantpuppalavikrantpuppala
authored
Harden CI/CD supply chain security (#329)
## Summary - Pin all GitHub Actions to verified commit SHAs (0/6 were pinned before) - Add explicit least-privilege `permissions:` blocks to all workflows - Replace third-party `tisonkun/actions-dco` action with inline DCO check script (ported from databricks-jdbc) - Switch runners from `ubuntu-latest` to `databricks-protected-runner-group` - Replace `curl | sh` golangci-lint install with `go install` in Makefile - Add Dependabot configuration for Go modules and GitHub Actions ## Security findings addressed Addresses findings from CI/CD supply chain security analysis: - **Critical**: All GitHub Actions pinned to mutable tags → now SHA-pinned - **Critical**: No permissions blocks → explicit least-privilege scoping - **High**: Third-party DCO action from individual publisher → inline script - **High**: curl|sh without checksum → go install - **Medium**: No Dependabot → automated dependency updates ## Test plan - [ ] Verify lint job runs successfully with golangci-lint-action - [ ] Verify DCO check correctly passes for signed commits - [ ] Verify DCO check correctly fails for unsigned commits - [ ] Verify build-and-test job completes on protected runner group - [ ] Verify Dependabot creates initial update PRs This pull request was AI-assisted by Isaac. Signed-off-by: Vikrant Puppala <vikrant.puppala@databricks.com>
1 parent d125096 commit ec57988

File tree

4 files changed

+121
-28
lines changed

4 files changed

+121
-28
lines changed

‎.github/dependabot.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: gomod
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
- package-ecosystem: github-actions
8+
directory: /
9+
schedule:
10+
interval: weekly

‎.github/workflows/dco-check.yml‎

Lines changed: 95 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,101 @@
11
name: DCO Check
22

3-
on: [pull_request]
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, reopened]
6+
branches: [main]
7+
8+
permissions:
9+
contents: read
410

511
jobs:
6-
check:
7-
runs-on: ubuntu-latest
12+
dco-check:
13+
runs-on:
14+
group: databricks-protected-runner-group
15+
labels: [linux-ubuntu-latest]
16+
name: Check DCO Sign-off
817
steps:
9-
- name: Check for DCO
10-
id: dco-check
11-
uses: tisonkun/actions-dco@v1.1
12-
- name: Comment about DCO status
13-
uses: actions/github-script@v6
14-
if: ${{ failure() }}
18+
- name: Checkout
19+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
1520
with:
16-
script: |
17-
github.rest.issues.createComment({
18-
issue_number: context.issue.number,
19-
owner: context.repo.owner,
20-
repo: context.repo.repo,
21-
body: `Thanks for your contribution! To satisfy the DCO policy in our \
22-
[contributing guide](https://github.com/databricks/databricks-sql-go/blob/main/CONTRIBUTING.md) \
23-
every commit message must include a sign-off message. One or more of your commits is missing this message. \
24-
You can reword previous commit messages with an interactive rebase (\`git rebase -i main\`).`
25-
})
21+
fetch-depth: 0
22+
ref: ${{ github.event.pull_request.head.ref }}
23+
repository: ${{ github.event.pull_request.head.repo.full_name }}
24+
25+
- name: Add upstream remote (for forks)
26+
run: |
27+
if [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then
28+
echo "This is a fork, adding upstream remote"
29+
git remote add upstream https://github.com/${{ github.repository }}.git
30+
git fetch upstream ${{ github.event.pull_request.base.ref }}
31+
else
32+
echo "This is not a fork, using origin"
33+
fi
34+
35+
- name: Check DCO Sign-off
36+
run: |
37+
#!/bin/bash
38+
set -e
39+
40+
BASE_SHA="${{ github.event.pull_request.base.sha }}"
41+
HEAD_SHA="${{ github.event.pull_request.head.sha }}"
42+
43+
echo "Checking commits from $BASE_SHA to $HEAD_SHA"
44+
45+
if ! git cat-file -e "$BASE_SHA" 2>/dev/null; then
46+
echo "Error: Base commit $BASE_SHA not found"
47+
echo "Trying to fetch from upstream..."
48+
if [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then
49+
git fetch upstream ${{ github.event.pull_request.base.ref }}
50+
else
51+
git fetch origin ${{ github.event.pull_request.base.ref }}
52+
fi
53+
fi
54+
55+
if ! git cat-file -e "$HEAD_SHA" 2>/dev/null; then
56+
echo "Error: Head commit $HEAD_SHA not found"
57+
exit 1
58+
fi
59+
60+
COMMITS=$(git rev-list --no-merges "$BASE_SHA..$HEAD_SHA")
61+
62+
if [ -z "$COMMITS" ]; then
63+
echo "No commits found in this PR"
64+
exit 0
65+
fi
66+
67+
FAILED_COMMITS=()
68+
69+
for commit in $COMMITS; do
70+
echo "Checking commit: $commit"
71+
COMMIT_MSG=$(git log --format=%B -n 1 "$commit")
72+
if echo "$COMMIT_MSG" | grep -q "^Signed-off-by: "; then
73+
echo " Commit $commit has DCO sign-off"
74+
else
75+
echo " Commit $commit is missing DCO sign-off"
76+
FAILED_COMMITS+=("$commit")
77+
fi
78+
done
79+
80+
if [ ${#FAILED_COMMITS[@]} -ne 0 ]; then
81+
echo ""
82+
echo "DCO Check Failed!"
83+
echo "The following commits are missing the required 'Signed-off-by' line:"
84+
for commit in "${FAILED_COMMITS[@]}"; do
85+
echo " - $commit: $(git log --format=%s -n 1 "$commit")"
86+
done
87+
echo ""
88+
echo "To fix this, you need to sign off your commits. You can:"
89+
echo "1. Add sign-off to new commits: git commit -s -m 'Your commit message'"
90+
echo "2. Amend existing commits: git commit --amend --signoff"
91+
echo "3. For multiple commits, use: git rebase --signoff HEAD~N (where N is the number of commits)"
92+
echo ""
93+
echo "The sign-off should be in the format:"
94+
echo "Signed-off-by: Your Name <your.email@example.com>"
95+
echo ""
96+
echo "For more details, see CONTRIBUTING.md"
97+
exit 1
98+
else
99+
echo ""
100+
echo "All commits have proper DCO sign-off!"
101+
fi

‎.github/workflows/go.yml‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,23 +6,28 @@ on:
66
pull_request:
77
branches: [main]
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
lint:
1114
name: Lint
12-
runs-on: ubuntu-latest
15+
runs-on:
16+
group: databricks-protected-runner-group
17+
labels: [linux-ubuntu-latest]
1318

1419
steps:
1520
- name: Check out code into the Go module directory
16-
uses: actions/checkout@v4
21+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
1722

1823
- name: Set up Go Toolchain
19-
uses: actions/setup-go@v5
24+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
2025
with:
2126
go-version: '1.20.x'
2227
cache: false
2328

2429
- name: Lint
25-
uses: golangci/golangci-lint-action@v4
30+
uses: golangci/golangci-lint-action@d6238b002a20823d52840fda27e2d4891c5952dc # v4
2631
with:
2732
version: 'v1.51'
2833
build-and-test:
@@ -31,20 +36,22 @@ jobs:
3136
matrix:
3237
go-version: [1.20.x]
3338
os: [ubuntu-latest]
34-
runs-on: ${{ matrix.os }}
39+
runs-on:
40+
group: databricks-protected-runner-group
41+
labels: [linux-ubuntu-latest]
3542

3643
steps:
3744
- name: Check out code into the Go module directory
38-
uses: actions/checkout@v4
45+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3946

4047
- name: Set up Go Toolchain
41-
uses: actions/setup-go@v5
48+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
4249
with:
4350
go-version: ${{ matrix.go-version }}
4451
cache: false
4552

4653
- name: Cache Go artifacts
47-
uses: actions/cache@v4
54+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
4855
with:
4956
path: |
5057
~/go/pkg/mod

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ help: ## Show this help.
3535
all: gen fmt lint test coverage ## format and test everything
3636

3737
bin/golangci-lint: go.mod go.sum
38-
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b ./bin v1.48.0
38+
GOBIN=$(pwd)/bin go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.51.0
3939

4040
bin/gotestsum: go.mod go.sum
4141
@mkdir -p bin/

0 commit comments

Comments
 (0)