Skip to content

Commit 5719ba9

Browse files
step-security-botondrejmirtes
step-security-bot
authored and
ondrejmirtes
committed
[StepSecurity] ci: Harden GitHub Actions
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
1 parent 31ab876 commit 5719ba9

26 files changed

+452
-176
lines changed

‎.github/actions/downgrade-code/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ runs:
1010

1111
- name: "Change to simple-downgrade PHP version"
1212
if: inputs.php-version == '7.4' || inputs.php-version == '8.0' || inputs.php-version == '8.1'
13-
uses: "shivammathur/setup-php@v2"
13+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
1414
with:
1515
coverage: "none"
1616
php-version: "8.4"
@@ -25,7 +25,7 @@ runs:
2525
2626
- name: "Re-store PHP version"
2727
if: inputs.php-version == '7.4' || inputs.php-version == '8.0' || inputs.php-version == '8.1'
28-
uses: "shivammathur/setup-php@v2"
28+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
2929
with:
3030
coverage: "none"
3131
php-version: "${{ inputs.php-version }}"

‎.github/workflows/apiref.yml‎

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -28,27 +28,32 @@ jobs:
2828
timeout-minutes: 60
2929

3030
steps:
31+
- name: Harden the runner (Audit all outbound calls)
32+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
33+
with:
34+
egress-policy: audit
35+
3136
- name: "Checkout"
32-
uses: actions/checkout@v4
37+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3338

3439
- name: "Install PHP"
35-
uses: "shivammathur/setup-php@v2"
40+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
3641
with:
3742
coverage: "none"
3843
php-version: "8.2"
3944

40-
- uses: "ramsey/composer-install@v3"
45+
- uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
4146

4247
- name: "Install ApiGen dependencies"
43-
uses: "ramsey/composer-install@v3"
48+
uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
4449
with:
4550
working-directory: "apigen"
4651

4752
- name: "Run ApiGen"
4853
run: "apigen/vendor/bin/apigen -c apigen/apigen.neon --output docs -- src vendor/nikic/php-parser vendor/ondrejmirtes/better-reflection vendor/phpstan/phpdoc-parser"
4954

5055
- name: "Upload docs"
51-
uses: actions/upload-artifact@v4
56+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
5257
with:
5358
name: docs
5459
path: docs
@@ -60,19 +65,24 @@ jobs:
6065
if: github.repository_owner == 'phpstan'
6166
runs-on: "ubuntu-latest"
6267
steps:
68+
- name: Harden the runner (Audit all outbound calls)
69+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
70+
with:
71+
egress-policy: audit
72+
6373
- name: "Install Node"
64-
uses: actions/setup-node@v4
74+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
6575
with:
6676
node-version: "16"
6777

6878
- name: "Download docs"
69-
uses: actions/download-artifact@v4
79+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
7080
with:
7181
name: docs
7282
path: docs
7383

7484
- name: "Sync with S3"
75-
uses: jakejarvis/s3-sync-action@v0.5.1
85+
uses: jakejarvis/s3-sync-action@be0c4ab89158cac4278689ebedd8407dd5f35a83 # v0.5.1
7686
with:
7787
args: --exclude '.git*/*' --follow-symlinks
7888
env:
@@ -84,22 +94,22 @@ jobs:
8494
AWS_SECRET_ACCESS_KEY: ${{ secrets.APIREF_AWS_SECRET_ACCESS_KEY }}
8595

8696
- name: "Invalidate CloudFront"
87-
uses: chetan/invalidate-cloudfront-action@v2
97+
uses: chetan/invalidate-cloudfront-action@12d242edc7752fca9140c2034be28792ad22c5a8 # v2.4.1
8898
env:
8999
DISTRIBUTION: "E37G1C2KWNAPBD"
90100
PATHS: '/${{ github.ref_name }}/*'
91101
AWS_REGION: 'eu-west-1'
92102
AWS_ACCESS_KEY_ID: ${{ secrets.APIREF_AWS_ACCESS_KEY_ID }}
93103
AWS_SECRET_ACCESS_KEY: ${{ secrets.APIREF_AWS_SECRET_ACCESS_KEY }}
94104

95-
- uses: peter-evans/repository-dispatch@v3
105+
- uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
96106
with:
97107
token: ${{ secrets.PHPSTAN_BOT_TOKEN }}
98108
repository: "phpstan/phpstan"
99109
event-type: check_website_links
100110

101111
- name: "Check for broken links"
102-
uses: ScholliYT/Broken-Links-Crawler-Action@v3
112+
uses: ScholliYT/Broken-Links-Crawler-Action@21eab52f98097989d343116dbbd46dc4541b849b # v3.3.2
103113
with:
104114
website_url: 'https://apiref.phpstan.org/${{ github.ref_name }}/index.html'
105115
resolve_before_filtering: 'true'

‎.github/workflows/backward-compatibility.yml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ concurrency:
1515
group: bc-${{ github.head_ref || github.run_id }} # will be canceled on subsequent pushes in pull requests but not branches
1616
cancel-in-progress: true
1717

18+
permissions:
19+
contents: read
20+
1821
jobs:
1922
backward-compatibility:
2023
name: "Backward Compatibility"
@@ -23,18 +26,23 @@ jobs:
2326
timeout-minutes: 60
2427

2528
steps:
29+
- name: Harden the runner (Audit all outbound calls)
30+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
31+
with:
32+
egress-policy: audit
33+
2634
- name: "Checkout"
27-
uses: actions/checkout@v4
35+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2836
with:
2937
fetch-depth: 0
3038

3139
- name: "Install PHP"
32-
uses: "shivammathur/setup-php@v2"
40+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
3341
with:
3442
coverage: "none"
3543
php-version: "8.2"
3644

37-
- uses: "ramsey/composer-install@v3"
45+
- uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
3846

3947
- name: "Install BackwardCompatibilityCheck"
4048
run: |

‎.github/workflows/block-merge-commits.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,12 @@ jobs:
99
runs-on: ubuntu-latest
1010

1111
steps:
12+
- name: Harden the runner (Audit all outbound calls)
13+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
14+
with:
15+
egress-policy: audit
16+
1217
- name: Block Merge Commits
13-
uses: Morishiri/block-merge-commits-action@v1.0.1
18+
uses: Morishiri/block-merge-commits-action@a4554c78def8d874966a8d1e20e2971121443755 # v1.0.1
1419
with:
1520
repo-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/build-issue-bot.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ concurrency:
1818
group: build-issue-bot-${{ github.head_ref || github.run_id }} # will be canceled on subsequent pushes in pull requests but not branches
1919
cancel-in-progress: true
2020

21+
permissions:
22+
contents: read
23+
2124
jobs:
2225
build-issue-bot:
2326
name: "Build Issue Bot"
@@ -33,19 +36,24 @@ jobs:
3336
- "vendor/bin/phpunit"
3437

3538
steps:
39+
- name: Harden the runner (Audit all outbound calls)
40+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
41+
with:
42+
egress-policy: audit
43+
3644
- name: "Checkout"
37-
uses: actions/checkout@v4
45+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3846

3947
- name: "Install PHP"
40-
uses: "shivammathur/setup-php@v2"
48+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
4149
with:
4250
coverage: "none"
4351
php-version: "8.5"
4452

45-
- uses: "ramsey/composer-install@v3"
53+
- uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
4654

4755
- name: "Install issue-bot dependencies"
48-
uses: "ramsey/composer-install@v3"
56+
uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
4957
with:
5058
working-directory: "issue-bot"
5159

‎.github/workflows/changelog-generator.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ concurrency:
1818
group: changelog-${{ github.head_ref || github.run_id }} # will be canceled on subsequent pushes in pull requests but not branches
1919
cancel-in-progress: true
2020

21+
permissions:
22+
contents: read
23+
2124
jobs:
2225
changelog-generator:
2326
name: "Build Changelog Generator"
@@ -26,19 +29,24 @@ jobs:
2629
timeout-minutes: 60
2730

2831
steps:
32+
- name: Harden the runner (Audit all outbound calls)
33+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
34+
with:
35+
egress-policy: audit
36+
2937
- name: "Checkout"
30-
uses: actions/checkout@v4
38+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3139

3240
- name: "Install PHP"
33-
uses: "shivammathur/setup-php@v2"
41+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
3442
with:
3543
coverage: "none"
3644
php-version: "8.2"
3745

38-
- uses: "ramsey/composer-install@v3"
46+
- uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
3947

4048
- name: "Install Changelog Generator dependencies"
41-
uses: "ramsey/composer-install@v3"
49+
uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
4250
with:
4351
working-directory: "changelog-generator"
4452

‎.github/workflows/claude-fix-issue.yml‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ on:
1414
required: true
1515
type: string
1616

17+
permissions:
18+
contents: read
19+
1720
jobs:
1821
fix:
1922
name: "Fix #${{ inputs.issue-number }}"
@@ -25,22 +28,27 @@ jobs:
2528
pull-requests: write
2629

2730
steps:
31+
- name: Harden the runner (Audit all outbound calls)
32+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
33+
with:
34+
egress-policy: audit
35+
2836
- name: "Checkout"
29-
uses: actions/checkout@v4
37+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3038
with:
3139
repository: phpstan/phpstan-src
3240
ref: "2.1.x"
3341
fetch-depth: 0
3442

3543
- name: "Install PHP"
36-
uses: "shivammathur/setup-php@v2"
44+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
3745
with:
3846
coverage: "none"
3947
php-version: "8.4"
4048
ini-file: development
4149
extensions: mbstring
4250

43-
- uses: "ramsey/composer-install@v3"
51+
- uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
4452

4553
- name: "Fetch issue details"
4654
id: issue
@@ -59,7 +67,7 @@ jobs:
5967
echo "$ISSUE_JSON" | jq -r '.body' > /tmp/issue-body.txt
6068
6169
- name: "Run Claude Code"
62-
uses: anthropics/claude-code-action@v1
70+
uses: anthropics/claude-code-action@35a9e0292d36f1186f5d842b14eb575074e8b450 # v1.0.57
6371
with:
6472
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
6573
claude_args: "--model claude-opus-4-6"
@@ -161,7 +169,7 @@ jobs:
161169
162170
- name: "Create Pull Request"
163171
id: create-pr
164-
uses: peter-evans/create-pull-request@v6
172+
uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
165173
with:
166174
branch-suffix: random
167175
delete-branch: true

‎.github/workflows/claude-fix-pr-ci.yml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,14 @@ jobs:
1919
outputs:
2020
status: ${{ steps.waitforstatuschecks.outputs.status }}
2121
steps:
22+
- name: Harden the runner (Audit all outbound calls)
23+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
24+
with:
25+
egress-policy: audit
26+
2227
- name: "Wait for status checks"
2328
id: waitforstatuschecks
24-
uses: "WyriHaximus/github-action-wait-for-status@v1"
29+
uses: "WyriHaximus/github-action-wait-for-status@b809158b20d3e32350fe2d868a124f7f2e0e4253" # v1
2530
with:
2631
ignoreActions: "Wait for CI checks,Fix CI failure,Automerge PRs"
2732
checkInterval: 13
@@ -40,6 +45,11 @@ jobs:
4045
pull-requests: write
4146

4247
steps:
48+
- name: Harden the runner (Audit all outbound calls)
49+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
50+
with:
51+
egress-policy: audit
52+
4353
- name: "Check fix attempt count"
4454
id: check-attempts
4555
env:
@@ -114,14 +124,14 @@ jobs:
114124
115125
- name: "Checkout PR branch"
116126
if: steps.check-attempts.outputs.skip != 'true' && steps.failures.outputs.skip != 'true'
117-
uses: actions/checkout@v4
127+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
118128
with:
119129
ref: ${{ github.head_ref }}
120130
fetch-depth: 0
121131

122132
- name: "Install PHP"
123133
if: steps.check-attempts.outputs.skip != 'true' && steps.failures.outputs.skip != 'true'
124-
uses: "shivammathur/setup-php@v2"
134+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
125135
with:
126136
coverage: "none"
127137
php-version: "8.4"
@@ -130,11 +140,11 @@ jobs:
130140

131141
- name: "Install dependencies"
132142
if: steps.check-attempts.outputs.skip != 'true' && steps.failures.outputs.skip != 'true'
133-
uses: "ramsey/composer-install@v3"
143+
uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
134144

135145
- name: "Run Claude Code"
136146
if: steps.check-attempts.outputs.skip != 'true' && steps.failures.outputs.skip != 'true'
137-
uses: anthropics/claude-code-action@v1
147+
uses: anthropics/claude-code-action@35a9e0292d36f1186f5d842b14eb575074e8b450 # v1.0.57
138148
with:
139149
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
140150
claude_args: "--model claude-opus-4-6"

‎.github/workflows/claude-random-easy-fixes-scheduled.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,21 @@ on:
55
# Run 4 times, once an hour at :15, from 9pm CET (20:00 UTC) to 12am CET (23:00 UTC)
66
- cron: '15 20-23 * * *'
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
trigger:
1013
runs-on: ubuntu-latest
1114
permissions:
1215
contents: read
1316
actions: write
1417
steps:
18+
- name: Harden the runner (Audit all outbound calls)
19+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
20+
with:
21+
egress-policy: audit
22+
1523
- name: Trigger Claude Random Easy Fixes
1624
env:
1725
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/claude-random-easy-fixes.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,11 @@ jobs:
2323
issues: read
2424

2525
steps:
26+
- name: Harden the runner (Audit all outbound calls)
27+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
28+
with:
29+
egress-policy: audit
30+
2631
- name: "Pick random Easy fix issues"
2732
id: pick-issues
2833
env:

0 commit comments

Comments
 (0)