From 5b66df350e4fcfaea7716e057ac25607676c1b89 Mon Sep 17 00:00:00 2001 From: StepSecurity Bot Date: Fri, 16 Aug 2024 13:50:08 -0700 Subject: [PATCH] [StepSecurity] Apply security best practices (#823) Signed-off-by: StepSecurity Bot Signed-off-by: John Mertic Co-authored-by: John Mertic --- .github/dependabot.yml | 6 ++ .github/workflows/autocommit.yml | 10 ++- .github/workflows/build.yml | 7 ++- .github/workflows/dependency-review.yml | 27 ++++++++ .github/workflows/marksuccessfulbuild.yml | 7 ++- .github/workflows/merge-schedule.yml | 7 ++- .github/workflows/scorecards.yml | 76 +++++++++++++++++++++++ .github/workflows/validate.yml | 19 ------ .pre-commit-config.yaml | 14 +++++ 9 files changed, 150 insertions(+), 23 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/dependency-review.yml create mode 100644 .github/workflows/scorecards.yml delete mode 100644 .github/workflows/validate.yml create mode 100644 .pre-commit-config.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..253bcb76 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: daily diff --git a/.github/workflows/autocommit.yml b/.github/workflows/autocommit.yml index 557da32d..79a4857a 100644 --- a/.github/workflows/autocommit.yml +++ b/.github/workflows/autocommit.yml @@ -5,13 +5,21 @@ on: pull_request: types: [labeled] +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 + with: + egress-policy: audit + - name: Automerge Pull Request if possible - uses: "pascalgn/automerge-action@v0.15.5" + uses: "pascalgn/automerge-action@eb68b061739cb9d81564f8e812d0b3c45f0fb09a # v0.15.5" env: GITHUB_TOKEN: "${{ secrets.PAT }}" MERGE_LABELS: "automerge" diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 75280f63..cf84dc7e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -9,7 +9,12 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: jmertic/lfx-landscape-tools@main + - name: Harden Runner + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 + with: + egress-policy: audit + + - uses: jmertic/lfx-landscape-tools@a90b284fd843ce6ed6421c15ff5c229b8f27f9ae # main env: token: ${{ secrets.PAT }} repository: ${{ github.repository }} diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 00000000..bf2dcfba --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,27 @@ +# Dependency Review Action +# +# This Action will scan dependency manifest files that change as part of a Pull Request, +# surfacing known-vulnerable versions of the packages declared or updated in the PR. +# Once installed, if the workflow run is marked as required, +# PRs introducing known-vulnerable packages will be blocked from merging. +# +# Source repository: https://github.com/actions/dependency-review-action +name: 'Dependency Review' +on: [pull_request] + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Harden Runner + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 + with: + egress-policy: audit + + - name: 'Checkout Repository' + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + - name: 'Dependency Review' + uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4 diff --git a/.github/workflows/marksuccessfulbuild.yml b/.github/workflows/marksuccessfulbuild.yml index 0c643f3c..2b4878c5 100644 --- a/.github/workflows/marksuccessfulbuild.yml +++ b/.github/workflows/marksuccessfulbuild.yml @@ -8,7 +8,12 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: Amwam/issue-comment-action@v1.3.1 + - name: Harden Runner + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 + with: + egress-policy: audit + + - uses: Amwam/issue-comment-action@04d3936db1a2fc02f86cad9db71cf24006019c4d # v1.3.1 if: ${{ github.event.issue.pull_request && contains(github.event.issue.labels.*.name, 'automated-build') }} with: keywords: '["Deploy preview for *omp-landscape* ready"]' diff --git a/.github/workflows/merge-schedule.yml b/.github/workflows/merge-schedule.yml index 7294ae79..a71e4622 100644 --- a/.github/workflows/merge-schedule.yml +++ b/.github/workflows/merge-schedule.yml @@ -13,7 +13,12 @@ jobs: merge_schedule: runs-on: ubuntu-latest steps: - - uses: gr2m/merge-schedule-action@v1 + - name: Harden Runner + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 + with: + egress-policy: audit + + - uses: gr2m/merge-schedule-action@2424cc9572bad3a1feef5f63a61d5ee9d831e3f8 # v1.4.3 with: # Merge method to use. Possible values are merge, squash or # rebase. Default is merge. diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml new file mode 100644 index 00000000..21a3e1d6 --- /dev/null +++ b/.github/workflows/scorecards.yml @@ -0,0 +1,76 @@ +# This workflow uses actions that are not certified by GitHub. They are provided +# by a third-party and are governed by separate terms of service, privacy +# policy, and support documentation. + +name: Scorecard supply-chain security +on: + # For Branch-Protection check. Only the default branch is supported. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection + branch_protection_rule: + # To guarantee Maintained check is occasionally updated. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained + schedule: + - cron: '20 7 * * 2' + push: + branches: ["main"] + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Needed to publish results and get a badge (see publish_results below). + id-token: write + contents: read + actions: read + + steps: + - name: Harden Runner + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 + with: + egress-policy: audit + + - name: "Checkout code" + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3 + with: + results_file: results.sarif + results_format: sarif + # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: + # - you want to enable the Branch-Protection check on a *public* repository, or + # - you are installing Scorecards on a *private* repository + # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. + # repo_token: ${{ secrets.SCORECARD_TOKEN }} + + # Public repositories: + # - Publish results to OpenSSF REST API for easy access by consumers + # - Allows the repository to include the Scorecard badge. + # - See https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories: + # - `publish_results` will always be set to `false`, regardless + # of the value entered here. + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard. + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2 + with: + sarif_file: results.sarif diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml deleted file mode 100644 index 1b15f04c..00000000 --- a/.github/workflows/validate.yml +++ /dev/null @@ -1,19 +0,0 @@ -name: Validate - -on: - merge_group: - pull_request: - branches: - - main - - master - -jobs: - validate-landscape: - runs-on: ubuntu-latest - name: "Validate landscape.yml file" - steps: - - uses: actions/checkout@v4 - - uses: cncf/landscape2-validate-action@v2 - with: - target_kind: data - target_path: ./landscape.yml diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 00000000..d8562a43 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,14 @@ +repos: +- repo: https://github.com/gitleaks/gitleaks + rev: v8.16.3 + hooks: + - id: gitleaks +- repo: https://github.com/jumanjihouse/pre-commit-hooks + rev: 3.0.0 + hooks: + - id: shellcheck +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.4.0 + hooks: + - id: end-of-file-fixer + - id: trailing-whitespace