Skip to content

Commit 5163bd9

Browse files
step-security-botstep-security-bot
committed
[StepSecurity] ci: Harden GitHub Actions
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
1 parent ea4476e commit 5163bd9

3 files changed

Lines changed: 72 additions & 16 deletions

File tree

‎.github/workflows/claude-org-wide.yml‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ on:
44
issue_comment:
55
types: [created]
66

7+
permissions:
8+
contents: read
9+
710
jobs:
811
check-trigger:
912
name: "Check trigger phrase and eligibility"
@@ -13,6 +16,11 @@ jobs:
1316
outputs:
1417
triggered: ${{ steps.check.outputs.triggered }}
1518
steps:
19+
- name: Harden the runner (Audit all outbound calls)
20+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
21+
with:
22+
egress-policy: audit
23+
1624
- name: "Check for trigger phrase"
1725
id: check
1826
env:
@@ -33,6 +41,11 @@ jobs:
3341
outputs:
3442
repos: ${{ steps.list.outputs.repos }}
3543
steps:
44+
- name: Harden the runner (Audit all outbound calls)
45+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
46+
with:
47+
egress-policy: audit
48+
3649
- name: "List all public repositories in the organization"
3750
id: list
3851
env:
@@ -66,6 +79,11 @@ jobs:
6679
- repo: phpstan/vim-phpstan
6780
- repo: phpstan/.github
6881
steps:
82+
- name: Harden the runner (Audit all outbound calls)
83+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
84+
with:
85+
egress-policy: audit
86+
6987
- name: "Get default branch of target repository"
7088
id: default-branch
7189
env:
@@ -75,7 +93,7 @@ jobs:
7593
echo "branch=$default_branch" >> "$GITHUB_OUTPUT"
7694
7795
- name: "Checkout target repository"
78-
uses: actions/checkout@v4
96+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
7997
with:
8098
repository: ${{ matrix.repo }}
8199
token: ${{ secrets.PHPSTAN_BOT_TOKEN }}
@@ -93,7 +111,7 @@ jobs:
93111
echo "${delimiter}" >> "$GITHUB_OUTPUT"
94112
95113
- name: "Run Claude Code on repository"
96-
uses: anthropics/claude-code-action@v1
114+
uses: anthropics/claude-code-action@35a9e0292d36f1186f5d842b14eb575074e8b450 # v1.0.57
97115
with:
98116
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
99117
claude_args: "--model claude-opus-4-6"
@@ -141,7 +159,7 @@ jobs:
141159

142160
- name: "Upload PR URL artifact"
143161
if: always()
144-
uses: actions/upload-artifact@v4
162+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
145163
with:
146164
name: pr-url-${{ steps.repo-name.outputs.sanitized }}
147165
path: /tmp/pr-url.txt
@@ -154,8 +172,13 @@ jobs:
154172
runs-on: ubuntu-latest
155173
timeout-minutes: 5
156174
steps:
175+
- name: Harden the runner (Audit all outbound calls)
176+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
177+
with:
178+
egress-policy: audit
179+
157180
- name: "Download all PR URL artifacts"
158-
uses: actions/download-artifact@v4
181+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
159182
with:
160183
pattern: pr-url-*
161184
path: pr-urls

‎.github/workflows/claude-react-on-comment.yml‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ concurrency:
1414
group: claude-pr-reactions-${{ github.event.pull_request.number || github.event.issue.number }}
1515
cancel-in-progress: false
1616

17+
permissions:
18+
contents: read
19+
1720
jobs:
1821
check-trigger:
1922
name: "Check trigger phrase"
@@ -22,6 +25,11 @@ jobs:
2225
outputs:
2326
triggered: ${{ steps.check.outputs.triggered }}
2427
steps:
28+
- name: Harden the runner (Audit all outbound calls)
29+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
30+
with:
31+
egress-policy: audit
32+
2533
- name: "Check for trigger phrase"
2634
id: check
2735
env:
@@ -45,11 +53,16 @@ jobs:
4553
pull-requests: write
4654

4755
steps:
56+
- name: Harden the runner (Audit all outbound calls)
57+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
58+
with:
59+
egress-policy: audit
60+
4861
- name: "Checkout"
49-
uses: actions/checkout@v4
62+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
5063

5164
- name: "React to feedback"
52-
uses: anthropics/claude-code-action@v1
65+
uses: anthropics/claude-code-action@35a9e0292d36f1186f5d842b14eb575074e8b450 # v1.0.57
5366
with:
5467
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
5568
trigger_phrase: "@phpstan-bot"

‎.github/workflows/lint-workflows.yml‎

Lines changed: 30 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,12 @@ jobs:
1414
actionlint:
1515
runs-on: ubuntu-latest
1616
steps:
17-
- uses: actions/checkout@v6
17+
- name: Harden the runner (Audit all outbound calls)
18+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
19+
with:
20+
egress-policy: audit
21+
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1823
- name: Check workflow files
1924
run: |
2025
echo "::add-matcher::.github/actionlint-matcher.json"
@@ -29,15 +34,20 @@ jobs:
2934
security-events: write # Required for codeql-action/upload-sarif to upload SARIF files.
3035
timeout-minutes: 10
3136
steps:
32-
- uses: actions/checkout@v6
37+
- name: Harden the runner (Audit all outbound calls)
38+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
39+
with:
40+
egress-policy: audit
41+
42+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3343
- name: Run octoscan
3444
id: octoscan
35-
uses: synacktiv/action-octoscan@v1
45+
uses: synacktiv/action-octoscan@6b1cf2343893dfb9e5f75652388bd2dc83f456b0 # v1.0.0
3646
with:
3747
filter_triggers: ''
3848

3949
- name: Upload SARIF file to GitHub
40-
uses: github/codeql-action/upload-sarif@v4
50+
uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
4151
with:
4252
sarif_file: "${{steps.octoscan.outputs.sarif_output}}"
4353
category: octoscan
@@ -49,16 +59,21 @@ jobs:
4959
permissions:
5060
security-events: write # Required for codeql-action/upload-sarif to upload SARIF files.
5161
steps:
62+
- name: Harden the runner (Audit all outbound calls)
63+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
64+
with:
65+
egress-policy: audit
66+
5267
- name: Checkout repository
53-
uses: actions/checkout@v6
68+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5469
with:
5570
persist-credentials: false
5671

5772
- name: Run Poutine
58-
uses: boostsecurityio/poutine-action@v0.15.2
73+
uses: boostsecurityio/poutine-action@84c0a0d32e8d57ae12651222be1eb15351429228 # v0.15.2
5974

6075
- name: Upload poutine SARIF file
61-
uses: github/codeql-action/upload-sarif@v4
76+
uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
6277
with:
6378
sarif_file: results.sarif
6479
category: poutine
@@ -70,13 +85,18 @@ jobs:
7085
permissions:
7186
security-events: write # Required for codeql-action/upload-sarif to upload SARIF files.
7287
steps:
88+
- name: Harden the runner (Audit all outbound calls)
89+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
90+
with:
91+
egress-policy: audit
92+
7393
- name: Checkout repository
74-
uses: actions/checkout@v6
94+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7595
with:
7696
persist-credentials: false
7797

7898
- name: Install the latest version of uv
79-
uses: astral-sh/setup-uv@v7.3.0
99+
uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
80100
with:
81101
enable-cache: false
82102

@@ -86,7 +106,7 @@ jobs:
86106
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
87107

88108
- name: Upload SARIF file
89-
uses: github/codeql-action/upload-sarif@v4.31.9
109+
uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
90110
with:
91111
sarif_file: results.sarif
92112
category: zizmor

0 commit comments

Comments
 (0)