Skip to content

Commit 916e8ab

Browse files
decofegrandizzyhorsefacts
authored
chore: deps hardening — pin actions, scope permissions (#419)
Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com> Co-authored-by: horsefacts <horsefacts@tempo.xyz>
1 parent 84de27c commit 916e8ab

13 files changed

Lines changed: 106 additions & 43 deletions

‎.changelog/supply-chain-hardening.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
tempo-wallet: patch
3+
tempo-request: patch
4+
---
5+
6+
Pin all GitHub Actions to commit SHAs, fix template injection in CI workflows, scope permissions per-job, replace curl|sh with checksum-verified binary download, add Dependabot cooldown, and suppress unfixable transitive advisories in deny.toml.

‎.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,13 @@ updates:
55
schedule:
66
interval: "weekly"
77
open-pull-requests-limit: 10
8+
cooldown:
9+
default-days: 7
810

911
- package-ecosystem: "github-actions"
1012
directory: "/"
1113
schedule:
1214
interval: "weekly"
1315
open-pull-requests-limit: 10
16+
cooldown:
17+
default-days: 7

‎.github/workflows/build.yml‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,15 @@ on:
77
- "tempo-wallet@*"
88
- "tempo-request@*"
99

10-
permissions:
11-
contents: write
12-
1310
env:
1411
CARGO_TERM_COLOR: always
1512
CARGO_NET_GIT_FETCH_WITH_CLI: "true"
1613

1714
jobs:
1815
parse-tag:
1916
name: Parse tag
17+
permissions:
18+
contents: read
2019
runs-on: ubuntu-latest
2120
outputs:
2221
packages: ${{ steps.parse.outputs.packages }}
@@ -57,6 +56,8 @@ jobs:
5756
5857
build:
5958
name: Build ${{ matrix.package }} (${{ matrix.build.target }})
59+
permissions:
60+
contents: read
6061
needs: [parse-tag]
6162
runs-on: ${{ matrix.build.os }}
6263
strategy:
@@ -79,26 +80,31 @@ jobs:
7980
env:
8081
PACKAGE: ${{ matrix.package }}
8182
steps:
82-
- uses: actions/checkout@v6
83-
- uses: dtolnay/rust-toolchain@stable
83+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
84+
with:
85+
persist-credentials: false
86+
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
8487
with:
8588
target: ${{ matrix.build.target }}
86-
- uses: Swatinem/rust-cache@v2
89+
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
8790
with:
8891
key: ${{ matrix.build.target }}
92+
save-if: false
8993
- name: Configure git auth
9094
run: git config --global url."https://x-access-token:${{ secrets.GH_PAT }}@github.com/".insteadOf "https://github.com/"
9195
- name: Build release binary
9296
run: cargo build --release --target ${{ matrix.build.target }} -p ${{ env.PACKAGE }}
9397
- run: strip target/${{ matrix.build.target }}/release/${{ env.PACKAGE }}
9498
- run: mv target/${{ matrix.build.target }}/release/${{ env.PACKAGE }} ${{ env.PACKAGE }}-${{ matrix.build.suffix }}
95-
- uses: actions/upload-artifact@v7
99+
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
96100
with:
97101
name: ${{ env.PACKAGE }}-${{ matrix.build.suffix }}
98102
path: ${{ env.PACKAGE }}-${{ matrix.build.suffix }}
99103

100104
publish:
101105
name: Publish ${{ matrix.package }}
106+
permissions:
107+
contents: write
102108
needs: [parse-tag, build]
103109
runs-on: ubuntu-latest
104110
strategy:
@@ -110,8 +116,10 @@ jobs:
110116
VERSION: ${{ needs.parse-tag.outputs.version }}
111117
RELEASE_TAG: ${{ needs.parse-tag.outputs.release_tag }}
112118
steps:
113-
- uses: actions/checkout@v6
114-
- uses: actions/download-artifact@v8
119+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
120+
with:
121+
persist-credentials: false
122+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
115123
with:
116124
path: artifacts
117125
pattern: ${{ env.PACKAGE }}-*

‎.github/workflows/changelog-generate.yml‎

Lines changed: 36 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,11 @@ jobs:
2121
steps:
2222
- name: Determine PR source
2323
id: source
24+
env:
25+
HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
26+
THIS_REPO: ${{ github.repository }}
2427
run: |
25-
if [ "${{ github.event.pull_request.head.repo.full_name }}" = "${{ github.repository }}" ]; then
28+
if [ "$HEAD_REPO" = "$THIS_REPO" ]; then
2629
echo "same_repo=true" >> "$GITHUB_OUTPUT"
2730
else
2831
echo "same_repo=false" >> "$GITHUB_OUTPUT"
@@ -42,18 +45,21 @@ jobs:
4245
fi
4346
echo "ref=$REF" >> "$GITHUB_OUTPUT"
4447
45-
- uses: actions/checkout@v6
48+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4649
if: steps.source.outputs.same_repo == 'true'
4750
with:
4851
repository: ${{ github.event.pull_request.head.repo.full_name }}
4952
ref: ${{ github.event.pull_request.head.sha }}
5053
fetch-depth: 0
5154
token: ${{ secrets.GH_PAT }}
55+
persist-credentials: false
5256

5357
- name: Fetch base branch for diff comparison
5458
if: steps.source.outputs.same_repo == 'true'
59+
env:
60+
BASE_REF: ${{ github.base_ref }}
5561
run: |
56-
git fetch origin "${{ github.base_ref }}"
62+
git fetch origin "$BASE_REF"
5763
5864
- name: Configure git credentials for private dependencies
5965
if: steps.source.outputs.same_repo == 'true'
@@ -62,20 +68,31 @@ jobs:
6268
- name: Check for existing changelog
6369
if: steps.source.outputs.same_repo == 'true'
6470
id: existing
71+
env:
72+
BASE_REF: ${{ github.base_ref }}
6573
run: |
66-
if git diff "origin/${{ github.base_ref }}...HEAD" --name-only | grep -q '^\.changelog/.*\.md$'; then
74+
if git diff "origin/${BASE_REF}...HEAD" --name-only | grep -q '^\.changelog/.*\.md$'; then
6775
echo "found=true" >> "$GITHUB_OUTPUT"
6876
else
6977
echo "found=false" >> "$GITHUB_OUTPUT"
7078
fi
7179
7280
- name: Install changelogs
7381
if: steps.source.outputs.same_repo == 'true' && steps.existing.outputs.found == 'false'
74-
run: curl -sSL https://changelogs.sh | sh -s -- changelogs@0.6.2
82+
run: |
83+
EXPECTED_SHA256="34bca37144e400d167f936d83c092da4b032591a74ae8c0175c3a42d716cc54c"
84+
CHANGELOGS_BIN="$RUNNER_TEMP/changelogs"
85+
curl -fsSL "https://github.com/tempoxyz/changelogs/releases/download/changelogs%400.6.2/changelogs-linux-amd64" -o "$CHANGELOGS_BIN"
86+
ACTUAL_SHA256=$(sha256sum "$CHANGELOGS_BIN" | cut -d' ' -f1)
87+
if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
88+
echo "::error::changelogs checksum mismatch: expected $EXPECTED_SHA256, got $ACTUAL_SHA256"
89+
exit 1
90+
fi
91+
chmod +x "$CHANGELOGS_BIN"
7592
7693
- name: Install claude
7794
if: steps.source.outputs.same_repo == 'true' && steps.existing.outputs.found == 'false'
78-
run: npm install -g @anthropic-ai/claude-code
95+
run: npm install -g @anthropic-ai/claude-code@1.0.3
7996

8097
- name: Extract bump level from label
8198
if: steps.source.outputs.same_repo == 'true' && steps.existing.outputs.found == 'false'
@@ -89,7 +106,9 @@ jobs:
89106
env:
90107
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
91108
BUMP_LEVEL: ${{ steps.bump.outputs.level }}
109+
BASE_REF: ${{ github.base_ref }}
92110
run: |
111+
CHANGELOGS_BIN="$RUNNER_TEMP/changelogs"
93112
cat > /tmp/changelog-instructions.md << 'PROMPT'
94113
Generate a changelog entry for this git diff.
95114
@@ -114,28 +133,35 @@ jobs:
114133
{diff}
115134
PROMPT
116135
sed -i "s/BUMP_LEVEL/$BUMP_LEVEL/g" /tmp/changelog-instructions.md
117-
changelogs add --ai "claude -p" --ref "origin/${{ github.base_ref }}" \
136+
"$CHANGELOGS_BIN" add --ai "claude -p" --ref "origin/${BASE_REF}" \
118137
--instructions "$(cat /tmp/changelog-instructions.md)"
119138
120139
- name: Commit and push changelog
121140
if: steps.source.outputs.same_repo == 'true' && steps.existing.outputs.found == 'false'
141+
env:
142+
VALIDATED_REF: ${{ steps.ref.outputs.ref }}
122143
run: |
123144
set -euo pipefail
124145
git config user.name "github-actions[bot]"
125146
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
126147
git add .changelog/
127148
git commit -m "chore: add changelog"
128-
git push origin "HEAD:${{ steps.ref.outputs.ref }}"
149+
git push origin "HEAD:${VALIDATED_REF}"
129150
130151
- name: Comment for fork PRs
131152
if: steps.source.outputs.same_repo != 'true'
132153
env:
133154
GH_TOKEN: ${{ github.token }}
155+
PR_NUMBER: ${{ github.event.number }}
156+
REPO: ${{ github.repository }}
134157
run: |
135-
gh pr comment "${{ github.event.number }}" --repo "${{ github.repository }}" --body "Changelog auto-generation is only supported for same-repo branches. For fork PRs, please add a changelog file manually under .changelog/."
158+
gh pr comment "$PR_NUMBER" --repo "$REPO" --body "Changelog auto-generation is only supported for same-repo branches. For fork PRs, please add a changelog file manually under .changelog/."
136159
137160
- name: Remove label
138161
if: always()
139162
env:
140163
GH_TOKEN: ${{ github.token }}
141-
run: gh pr edit ${{ github.event.number }} --repo "${{ github.repository }}" --remove-label "${{ github.event.label.name }}"
164+
PR_NUMBER: ${{ github.event.number }}
165+
REPO: ${{ github.repository }}
166+
LABEL: ${{ github.event.label.name }}
167+
run: gh pr edit "$PR_NUMBER" --repo "$REPO" --remove-label "$LABEL"

‎.github/workflows/changelog.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,19 @@ jobs:
1414
check:
1515
runs-on: ubuntu-latest
1616
steps:
17-
- uses: actions/checkout@v6
17+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1818
with:
1919
fetch-depth: 0
20+
persist-credentials: false
2021
- name: Run changelog action (same-repo PRs)
2122
if: github.event.pull_request.head.repo.full_name == github.repository
2223
uses: tempoxyz/changelogs/check@b0179e7300997dfa5a631a6a7a2de248bf63310f # changelogs@0.6.3 + unified PR title + install from source
2324
- name: Verify changelog entry exists
2425
if: github.event.pull_request.head.repo.full_name != github.repository
26+
env:
27+
BASE_REF: ${{ github.base_ref }}
2528
run: |
26-
CHANGELOGS=$(git diff --name-only origin/${{ github.base_ref }}...HEAD -- '.changelog/*.md' | grep -v config.toml || true)
29+
CHANGELOGS=$(git diff --name-only "origin/${BASE_REF}...HEAD" -- '.changelog/*.md' | grep -v config.toml || true)
2730
if [ -z "$CHANGELOGS" ]; then
2831
echo "::error::A changelog entry is required for this PR. Add a .changelog/*.md file."
2932
exit 1

‎.github/workflows/lint.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,13 @@ jobs:
2626
permissions:
2727
contents: read
2828
steps:
29-
- uses: actions/checkout@v6
29+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3030
with:
3131
persist-credentials: false
32-
- uses: dtolnay/rust-toolchain@nightly
32+
- uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly
3333
with:
3434
components: clippy
35-
- uses: Swatinem/rust-cache@v2
35+
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
3636
- name: Run clippy
3737
run: cargo clippy --workspace --all-targets --all-features --locked
3838
env:
@@ -45,10 +45,10 @@ jobs:
4545
permissions:
4646
contents: read
4747
steps:
48-
- uses: actions/checkout@v6
48+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4949
with:
5050
persist-credentials: false
51-
- uses: dtolnay/rust-toolchain@nightly
51+
- uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly
5252
with:
5353
components: rustfmt
5454
- name: Check formatting
@@ -61,7 +61,7 @@ jobs:
6161
permissions:
6262
contents: read
6363
steps:
64-
- uses: actions/checkout@v6
64+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6565
with:
6666
persist-credentials: false
6767
- name: Run Tempo Lints
@@ -79,7 +79,7 @@ jobs:
7979
permissions:
8080
contents: read
8181
steps:
82-
- uses: actions/checkout@v6
82+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8383
with:
8484
persist-credentials: false
8585
- uses: crate-ci/typos@02ea592e44b3a53c302f697cddca7641cd051c3d # v1.45.0
@@ -91,10 +91,10 @@ jobs:
9191
permissions:
9292
contents: read
9393
steps:
94-
- uses: actions/checkout@v6
94+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
9595
with:
9696
persist-credentials: false
97-
- uses: dtolnay/rust-toolchain@stable
97+
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
9898
- uses: taiki-e/install-action@7a4939c09608b2a1986b484eca1d16fd0db8ebef # v2.75.5
9999
with:
100100
tool: cargo-deny

‎.github/workflows/pr-audit.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,10 @@ on:
66
issue_comment:
77
types: [created]
88

9+
permissions:
10+
contents: read
11+
pull-requests: read
12+
913
jobs:
1014
pr-audit:
1115
if: >-
@@ -16,4 +20,7 @@ jobs:
1620
contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
1721
)
1822
uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@1a49d3e9f9983a55832d7163faa970b7ba3c1af9
19-
secrets: inherit
23+
secrets:
24+
EVENTS_KEY: ${{ secrets.EVENTS_KEY }}
25+
EVENTS_CERT: ${{ secrets.EVENTS_CERT }}
26+
EVENTS_ARGS: ${{ secrets.EVENTS_ARGS }}

‎.github/workflows/release.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,7 @@ on:
77

88
concurrency: ${{ github.workflow }}-${{ github.ref }}
99

10-
permissions:
11-
contents: write
12-
pull-requests: write
10+
permissions: {}
1311

1412
env:
1513
CARGO_TERM_COLOR: always
@@ -18,11 +16,15 @@ env:
1816
jobs:
1917
release:
2018
runs-on: ubuntu-latest
19+
permissions:
20+
contents: write
21+
pull-requests: write
2122
steps:
22-
- uses: actions/checkout@v6
23+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2324
with:
2425
fetch-depth: 0
2526
token: ${{ secrets.GH_PAT }}
27+
persist-credentials: false
2628

2729
- name: Configure git auth
2830
run: git config --global url."https://x-access-token:${{ secrets.GH_PAT }}@github.com/".insteadOf "https://github.com/"

‎.github/workflows/skill.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
runs-on: ubuntu-latest
1515
timeout-minutes: 5
1616
steps:
17-
- uses: actions/checkout@v6
17+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1818
with:
1919
persist-credentials: false
2020

‎.github/workflows/test.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,11 @@ jobs:
2525
permissions:
2626
contents: read
2727
steps:
28-
- uses: actions/checkout@v6
28+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2929
with:
3030
persist-credentials: false
31-
- uses: dtolnay/rust-toolchain@stable
32-
- uses: Swatinem/rust-cache@v2
31+
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
32+
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
3333
- name: Run tests
3434
run: cargo test --workspace --all-features --locked
3535

@@ -40,10 +40,10 @@ jobs:
4040
permissions:
4141
contents: read
4242
steps:
43-
- uses: actions/checkout@v6
43+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4444
with:
4545
persist-credentials: false
46-
- uses: dtolnay/rust-toolchain@stable
46+
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
4747
- name: Build docs
4848
env:
4949
RUSTDOCFLAGS: -D warnings

0 commit comments

Comments
 (0)