Skip to content

Commit 9748529

Browse files
SebTardifSebTardif
authored
ci: harden all workflows against CI best practices checklist (#57)
- Add step-security/harden-runner to all 17 jobs (egress-policy: audit) - Add merge_group trigger to ci.yml and security.yml for merge queue - Add workflow_dispatch to auto-approve, dependabot-auto-merge, post-merge, and pr-title workflows - Add concurrency groups to auto-approve and post-merge workflows - Create composite action for Node.js setup (deduplicates 5 jobs) - Fix github.actor to github.event.pull_request.user.login in auto-approve, dependabot-auto-merge, and pr-title workflows - Move stale.yml write permissions from workflow to job level - Add links.yml to its own path filters - Add CodeQL analysis to ruleset required status checks Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
1 parent b7d484f commit 9748529

12 files changed

Lines changed: 131 additions & 44 deletions

File tree

‎.github/actions/setup-node/action.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: Setup Node.js
2+
description: Set up Node.js from .nvmrc and install dependencies
3+
4+
runs:
5+
using: composite
6+
steps:
7+
- name: Setup Node.js
8+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
9+
with:
10+
node-version-file: .nvmrc
11+
cache: npm
12+
13+
- name: Install dependencies
14+
run: npm ci
15+
shell: bash

‎.github/workflows/auto-approve.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,15 @@ name: Auto-approve
33
on:
44
pull_request:
55
types: [opened, synchronize, reopened]
6+
workflow_dispatch:
67

78
permissions:
89
contents: read
910

11+
concurrency:
12+
group: auto-approve-${{ github.event.pull_request.number || github.run_id }}
13+
cancel-in-progress: true
14+
1015
jobs:
1116
auto-approve:
1217
runs-on: ubuntu-latest
@@ -15,9 +20,14 @@ jobs:
1520
contents: write
1621
pull-requests: write
1722
if: >
18-
github.actor == 'SebTardif' ||
19-
github.actor == 'dependabot[bot]'
23+
github.event.pull_request.user.login == 'SebTardif' ||
24+
github.event.pull_request.user.login == 'dependabot[bot]'
2025
steps:
26+
- name: Harden runner
27+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
28+
with:
29+
egress-policy: audit
30+
2131
- uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0
2232

2333
- name: Enable auto-merge

‎.github/workflows/ci.yml‎

Lines changed: 19 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ name: ci
33
on:
44
push:
55
pull_request:
6+
merge_group:
67
workflow_dispatch:
78

89
permissions:
@@ -21,19 +22,18 @@ jobs:
2122
runs-on: ${{ matrix.os }}
2223
timeout-minutes: 10
2324
steps:
25+
- name: Harden runner
26+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
27+
with:
28+
egress-policy: audit
29+
2430
- name: Checkout
2531
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
2632
with:
2733
persist-credentials: false
2834

2935
- name: Setup Node.js
30-
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
31-
with:
32-
node-version-file: .nvmrc
33-
cache: npm
34-
35-
- name: Install dependencies
36-
run: npm ci
36+
uses: ./.github/actions/setup-node
3737

3838
- name: Run tests
3939
run: npm test
@@ -42,19 +42,18 @@ jobs:
4242
runs-on: ubuntu-latest
4343
timeout-minutes: 10
4444
steps:
45+
- name: Harden runner
46+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
47+
with:
48+
egress-policy: audit
49+
4550
- name: Checkout
4651
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
4752
with:
4853
persist-credentials: false
4954

5055
- name: Setup Node.js
51-
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
52-
with:
53-
node-version-file: .nvmrc
54-
cache: npm
55-
56-
- name: Install dependencies
57-
run: npm ci
56+
uses: ./.github/actions/setup-node
5857

5958
- name: Compile
6059
run: npm run compile
@@ -67,19 +66,18 @@ jobs:
6766
runs-on: macos-latest
6867
timeout-minutes: 15
6968
steps:
69+
- name: Harden runner
70+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
71+
with:
72+
egress-policy: audit
73+
7074
- name: Checkout
7175
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
7276
with:
7377
persist-credentials: false
7478

7579
- name: Setup Node.js
76-
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
77-
with:
78-
node-version-file: .nvmrc
79-
cache: npm
80-
81-
- name: Install dependencies
82-
run: npm ci
80+
uses: ./.github/actions/setup-node
8381

8482
- name: Compile extension and tests
8583
run: npm run compile && npm run compile-tests

‎.github/workflows/dco.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ jobs:
1919
runs-on: ubuntu-latest
2020
timeout-minutes: 5
2121
steps:
22+
- name: Harden runner
23+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
24+
with:
25+
egress-policy: audit
26+
2227
- name: Checkout
2328
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
2429
with:

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,29 @@ name: Dependabot Auto-Merge
22

33
on:
44
pull_request_target:
5+
workflow_dispatch:
56

67
permissions: {}
78

89
concurrency:
9-
group: dependabot-auto-merge-${{ github.event.pull_request.number }}
10+
group: dependabot-auto-merge-${{ github.event.pull_request.number || github.run_id }}
1011
cancel-in-progress: true
1112

1213
jobs:
1314
auto-merge:
1415
name: Auto-merge Dependabot PRs
1516
runs-on: ubuntu-latest
1617
timeout-minutes: 5
17-
if: github.actor == 'dependabot[bot]'
18+
if: github.event.pull_request.user.login == 'dependabot[bot]'
1819
permissions:
1920
contents: write
2021
pull-requests: write
2122
steps:
23+
- name: Harden runner
24+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
25+
with:
26+
egress-policy: audit
27+
2228
- name: Fetch Dependabot metadata
2329
id: metadata
2430
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0

‎.github/workflows/fossa.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@ jobs:
2121
runs-on: ubuntu-latest
2222
timeout-minutes: 10
2323
steps:
24+
- name: Harden runner
25+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
26+
with:
27+
egress-policy: audit
28+
2429
- name: Check API key
2530
id: check
2631
run: |

‎.github/workflows/links.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,12 @@ on:
66
paths:
77
- "**.md"
88
- "lychee.toml"
9+
- ".github/workflows/links.yml"
910
pull_request:
1011
paths:
1112
- "**.md"
1213
- "lychee.toml"
14+
- ".github/workflows/links.yml"
1315
schedule:
1416
- cron: "0 6 * * 1"
1517
workflow_dispatch:
@@ -27,6 +29,11 @@ jobs:
2729
runs-on: ubuntu-latest
2830
timeout-minutes: 10
2931
steps:
32+
- name: Harden runner
33+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
34+
with:
35+
egress-policy: audit
36+
3037
- name: Checkout
3138
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
3239
with:

‎.github/workflows/post-merge.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,14 @@ name: Post-merge CI trigger
33
on:
44
pull_request:
55
types: [closed]
6+
workflow_dispatch:
67

78
permissions: {}
89

10+
concurrency:
11+
group: post-merge-${{ github.event.pull_request.number || github.run_id }}
12+
cancel-in-progress: true
13+
914
jobs:
1015
trigger:
1116
name: Trigger CI on main
@@ -15,6 +20,11 @@ jobs:
1520
permissions:
1621
actions: write
1722
steps:
23+
- name: Harden runner
24+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
25+
with:
26+
egress-policy: audit
27+
1828
- name: Trigger workflows on main
1929
env:
2030
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/pr-title.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,27 @@ name: Semantic PR title
33
on:
44
pull_request_target:
55
types: [opened, edited, synchronize]
6+
workflow_dispatch:
67

78
permissions:
89
pull-requests: read
910

1011
concurrency:
11-
group: pr-title-${{ github.event.pull_request.number }}
12+
group: pr-title-${{ github.event.pull_request.number || github.run_id }}
1213
cancel-in-progress: true
1314

1415
jobs:
1516
lint:
1617
name: Validate PR title
17-
if: github.actor != 'dependabot[bot]'
18+
if: github.event.pull_request.user.login != 'dependabot[bot]'
1819
runs-on: ubuntu-latest
1920
timeout-minutes: 5
2021
steps:
22+
- name: Harden runner
23+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
24+
with:
25+
egress-policy: audit
26+
2127
- name: Check PR title
2228
uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
2329
env:

‎.github/workflows/scorecard.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,11 @@ jobs:
2323
security-events: write
2424
id-token: write
2525
steps:
26+
- name: Harden runner
27+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
28+
with:
29+
egress-policy: audit
30+
2631
- name: Checkout
2732
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
2833
with:

0 commit comments

Comments
 (0)