[StepSecurity] ci: Harden GitHub Actions #427
Conversation
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
There was a problem hiding this comment.
Please find StepSecurity AI-CodeWise code comments inline or below.
.github/workflows/int.yml
Please refer to 1 inline comments.
Feedback
We appreciate your feedback in helping us improve the service! To provide feedback, please use emojis on this comment. If you find a comment helpful, give it a 👍. If they aren't useful, kindly express that with a 👎. If you have questions or detailed feedback, please create n GitHub issue in StepSecurity/AI-CodeWise.
| @@ -33,6 +33,6 @@ jobs: | |||
| aws-region: us-west-2 | |||
| - run: aws s3 cp ./agent s3://step-security-agent/refs/heads/int/agent --acl public-read | |||
| - name: Integration test | |||
| uses: docker://ghcr.io/step-security/integration-test/int:latest | |||
| uses: docker://ghcr.io/step-security/integration-test/int:latest@sha256:947868b3c9f456695d89a06ef9c1a9194a579f0b2bd5a724a4b864b9a0d6787d | |||
There was a problem hiding this comment.
[Medium]Pin also the version of the ghcr.io/step-security/integration-test/int Docker image
The Docker image ghcr.io/step-security/integration-test/int is pulled from the latest tag which may include breaking changes. Pin the version of the ghcr.io/step-security/integration-test/int Docker image to a specific tag or digest.
Summary
This pull request is created by StepSecurity at the request of @varunsh-coder. Please merge the Pull Request to incorporate the requested changes. Please tag @varunsh-coder on your message if you have any questions related to the PR.
Security Fixes
Pinned Dependencies
GitHub Action tags and Docker tags are mutatble. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.
Harden Runner
Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without
sudoaccess.Harden runner usage
You can find link to view insights and policy recommendation in the build log
Please refer to documentation to find more details.
Feedback
For bug reports, feature requests, and general feedback; please email support@stepsecurity.io. To create such PRs, please visit https://app.stepsecurity.io/securerepo.
Signed-off-by: StepSecurity Bot bot@stepsecurity.io