Skip to content

Commit b2bf9d6

Browse files
maennchenmaennchen
authored
Add GitHub Actions security scanning with CodeQL and zizmor (#76)
* Add explicit minimal permissions to CI workflow Fixes zizmor excessive-permissions audit warning by explicitly setting read-only contents permission instead of using defaults. https://docs.zizmor.sh/audits/#excessive-permissions * Setup Dependabot * Setup CI Scanning via codeql / zizmor * Pin GitHub Actions * Bash Escape Command Interpolations * Disable persist-credentials for actions/checkout
1 parent 770db26 commit b2bf9d6

3 files changed

Lines changed: 91 additions & 15 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
cooldown:
8+
default-days: 7
9+
10+
- package-ecosystem: "mix"
11+
directory: "/"
12+
schedule:
13+
interval: "weekly"
14+
cooldown:
15+
default-days: 7

‎.github/workflows/codeql.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: "CodeQL Advanced"
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
branches: ["main"]
8+
schedule:
9+
- cron: "29 8 * * 1"
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
analyze:
16+
name: Analyze (${{ matrix.language }})
17+
runs-on: "ubuntu-latest"
18+
permissions:
19+
security-events: write
20+
strategy:
21+
fail-fast: false
22+
matrix:
23+
include:
24+
- language: actions
25+
build-mode: none
26+
steps:
27+
- name: Checkout repository
28+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
29+
with:
30+
persist-credentials: false
31+
- name: Initialize CodeQL
32+
uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
33+
with:
34+
languages: ${{ matrix.language }}
35+
build-mode: ${{ matrix.build-mode }}
36+
- name: Perform CodeQL Analysis
37+
uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
38+
with:
39+
category: "/language:${{matrix.language}}"
40+
41+
zizmor:
42+
name: Zizmor
43+
runs-on: ubuntu-latest
44+
permissions:
45+
security-events: write
46+
steps:
47+
- name: Checkout repository
48+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
49+
with:
50+
persist-credentials: false
51+
- name: Run zizmor
52+
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0

‎.github/workflows/main.yml‎

Lines changed: 24 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,21 @@ name: CI
22

33
on: [push, pull_request]
44

5+
permissions:
6+
contents: read
7+
58
jobs:
69
test:
710
name: Test
811
runs-on: ubuntu-24.04
912

1013
steps:
11-
- uses: actions/checkout@v4
14+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
15+
with:
16+
persist-credentials: false
1217

1318
- name: Install OTP and Elixir
14-
uses: erlef/setup-beam@v1
19+
uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.20.4
1520
with:
1621
otp-version: 27.2
1722
elixir-version: 1.18.1
@@ -54,14 +59,16 @@ jobs:
5459
WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCLOUD_WORKFLOW_IDENTITY_POOL_PROVIDER }}
5560

5661
steps:
57-
- uses: actions/checkout@v4
62+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
63+
with:
64+
persist-credentials: false
5865

5966
- name: Set up Docker Buildx
60-
uses: docker/setup-buildx-action@v3
67+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
6168

6269
- name: Google auth
6370
id: auth
64-
uses: "google-github-actions/auth@v2"
71+
uses: "google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed" # v2.1.13
6572
if: ${{ github.event_name != 'pull_request' && env.SERVICE_ACCOUNT != '' }}
6673
with:
6774
token_format: "access_token"
@@ -71,7 +78,7 @@ jobs:
7178

7279
- name: Docker Auth
7380
id: docker-auth
74-
uses: "docker/login-action@v3"
81+
uses: "docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9" # v3.7.0
7582
if: ${{ github.event_name != 'pull_request' && env.SERVICE_ACCOUNT != '' }}
7683
with:
7784
registry: gcr.io
@@ -80,7 +87,7 @@ jobs:
8087

8188
- name: Build and push by digest
8289
id: build
83-
uses: docker/build-push-action@v6
90+
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
8491
with:
8592
platforms: ${{ matrix.platform }}
8693
outputs: type=image,name=gcr.io/${{ env.PROJECT_ID }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' && env.SERVICE_ACCOUNT != '' }}
@@ -91,12 +98,14 @@ jobs:
9198
if: ${{ github.event_name != 'pull_request' && env.SERVICE_ACCOUNT != '' }}
9299
run: |
93100
mkdir -p /tmp/digests
94-
digest="${{ steps.build.outputs.digest }}"
101+
digest="${DIGEST}"
95102
touch "/tmp/digests/${digest#sha256:}"
103+
env:
104+
DIGEST: ${{ steps.build.outputs.digest }}
96105

97106
- name: Upload digest
98107
if: ${{ github.event_name != 'pull_request' && env.SERVICE_ACCOUNT != '' }}
99-
uses: actions/upload-artifact@v4
108+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
100109
with:
101110
name: digests-${{ matrix.runner }}
102111
path: /tmp/digests/*
@@ -120,23 +129,23 @@ jobs:
120129
- name: Set short git commit SHA
121130
run: echo "COMMIT_SHORT_SHA=${GITHUB_SHA::7}" >> $GITHUB_ENV
122131
- name: Download digests
123-
uses: actions/download-artifact@v4
132+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
124133
with:
125134
path: /tmp/digests
126135
pattern: digests-*
127136
merge-multiple: true
128137
- name: Set up Docker Buildx
129-
uses: docker/setup-buildx-action@v3
138+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
130139
- name: Google auth
131140
id: auth
132-
uses: "google-github-actions/auth@v2"
141+
uses: "google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed" # v2.1.13
133142
with:
134143
token_format: "access_token"
135144
project_id: ${{ env.PROJECT_ID }}
136145
service_account: ${{ env.SERVICE_ACCOUNT }}
137146
workload_identity_provider: ${{ env.WORKLOAD_IDENTITY_PROVIDER }}
138147
- name: Docker Auth
139-
uses: "docker/login-action@v3"
148+
uses: "docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9" # v3.7.0
140149
with:
141150
registry: gcr.io
142151
username: "oauth2accesstoken"
@@ -145,5 +154,5 @@ jobs:
145154
working-directory: /tmp/digests
146155
run: |
147156
docker buildx imagetools create \
148-
-t gcr.io/${{ env.PROJECT_ID }}/${{ env.IMAGE_NAME }}:${{ env.COMMIT_SHORT_SHA }} \
149-
$(printf 'gcr.io/${{ env.PROJECT_ID }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
157+
-t gcr.io/${PROJECT_ID}/${IMAGE_NAME}:${COMMIT_SHORT_SHA} \
158+
$(printf 'gcr.io/${PROJECT_ID}/${IMAGE_NAME}@sha256:%s ' *)

0 commit comments

Comments
 (0)