fix security on github action

Author: dedece35

.github/dependabot.yml

@@ -12,3 +12,12 @@ updates:
     ignore:
       # Ignore all versions : cf pom.xml comments
       - dependency-name: "com.mycila:license-maven-plugin"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    # Keep action update PRs focused and easy to review.
+    commit-message:
+      prefix: "ci"
+

.github/workflows/build.yml

@@ -20,12 +20,12 @@ jobs:
       pull-requests: read # allows SonarCloud to decorate PRs with analysis results
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
 
       - name: Set up JDK
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           distribution: 'temurin'
           java-version: 17
@@ -39,7 +39,7 @@ jobs:
           echo "<settings><pluginGroups><pluginGroup>org.sonarsource.scanner.maven</pluginGroup></pluginGroups></settings>" > ~/.m2/settings.xml
 
       - name: Cache SonarQube packages
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar

.github/workflows/build_container.yml

@@ -30,26 +30,26 @@ jobs:
 
     steps:
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2
 
       - name: Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           images: ${{ env.IMAGES }}
@@ -66,7 +66,7 @@ jobs:
 
       - name: Publish image
         id: push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4
         with:
           push: true
           tags: ${{ steps.meta.outputs.tags }}

.github/workflows/stale_tag.yml

@@ -11,7 +11,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/stale@v8.0.0
+      - uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 # v8.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-issue-stale: -1 # We don't want to address issues
@@ -21,4 +21,4 @@ jobs:
           stale-pr-label: stale
           stale-pr-message: |
             This PR has been automatically marked as stale because it has no activity for 30 days.
-            Please add a comment if you want to keep the issue open. Thank you for your contributions!
+            Please add a comment if you want to keep the issue open. Thank you for your contributions!

.github/workflows/tag_release.yml

@@ -19,7 +19,7 @@ jobs:
       contents: read
     steps:
       - name: Check user permissions
-        uses: 74th/workflow-permission-action@1.0.0
+        uses: 74th/workflow-permission-action@61b695d54d72c612459668d29fca41281a0f49d4 # 1.0.0
         with:
           users: dedece35,glalloue,jhertout,olegoaer,zippy1978,utarwyn
   build:
@@ -30,7 +30,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 0
 
@@ -56,13 +56,13 @@ jobs:
           echo "release_tag=$RELEASE_TAG" >> $GITHUB_ENV
 
       - name: Checkout tag "${{ env.release_tag }}"
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           ref: ${{ env.release_tag }}
 
       - name: Extract release notes
         id: extract-release-notes
-        uses: ffurrer2/extract-release-notes@v1
+        uses: ffurrer2/extract-release-notes@f2dd00dec4102dbc6d7bdf804dfd85546dfa1f0b # v1
 
       - name: Build project
         env:
@@ -83,7 +83,7 @@ jobs:
           echo "jar_path=$JAR_FILE" >> $GITHUB_ENV
 
       - name: Create release and upload asset
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           tag_name: ${{ env.release_tag }}
           name: Release ${{ env.release_tag }}

CHANGELOG.md

@@ -16,6 +16,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - [#111](https://github.com/green-code-initiative/creedengo-php/issues/111) refacto to have all the test files in the same place (for UT and IT), to avoid maintaining 2 test directories
 - [#111](https://github.com/green-code-initiative/creedengo-php/issues/111) refacto all test files to add sub-directories for each rule, to be more clear and to be able to add more tests for each rule in the future
 - [#126](https://github.com/green-code-initiative/creedengo-php/pull/126) Fix NPE on GCI2 and GCI35 + global NPE robustness for these 2 rules
+- harden GitHub Actions security by sanitizing dispatch input usage, pinning external actions to commit SHAs, and enabling Dependabot updates for pinned action references
 
 ### Deleted