chore: [StepSecurity] Apply security best practices (#137)

GoogleCloudPlatform · Apr 4, 2023 · ed6afaa · ed6afaa
1 parent 360b7d6
commit ed6afaa
Show file tree

Hide file tree

Showing 5 changed files with 66 additions and 13 deletions.
diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
@@ -13,28 +13,33 @@ jobs:
         php-version: [ '7.4','8.0','8.1','8.2' ]
     name: PHP ${{ matrix.php-version }} Conformance Test
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@03bee3930647ebbf994244c21ddbc0d4933aab4f # v2.3.0
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
     - name: Setup PHP ${{ matrix.php-version }}
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@d30ad8b1843ace22e6698ab99bbafaa747b6bd0d # v2
       with:
         php-version: ${{ matrix.php-version }}
 
     - name: Install Dependencies
-      uses: nick-invision/retry@v1
+      uses: nick-invision/retry@39da88d5f7d15a96aed861dbabbe8b7443e3182a # v1.0.4
       with:
         timeout_minutes: 10
         max_attempts: 3
         command: composer install
 
     - name: Setup Go
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2.2.0
       with:
         go-version: '1.15'
 
     - name: Run HTTP conformance tests
-      uses: GoogleCloudPlatform/functions-framework-conformance/action@v1.2.1
+      uses: GoogleCloudPlatform/functions-framework-conformance/action@e42b1533877f1b639f508ec7fbcfb5be31aca663 # v1.2.1
       env:
         FUNCTION_TARGET: 'httpFunc'
         FUNCTION_SIGNATURE_TYPE: 'http'
@@ -46,7 +51,7 @@ jobs:
         cmd: "'php -S localhost:8080 router.php'"
 
     - name: Run Declarative HTTP conformance tests
-      uses: GoogleCloudPlatform/functions-framework-conformance/action@v1.2.1
+      uses: GoogleCloudPlatform/functions-framework-conformance/action@e42b1533877f1b639f508ec7fbcfb5be31aca663 # v1.2.1
       env:
         FUNCTION_TARGET: 'declarativeHttpFunc'
         FUNCTION_SOURCE: ${{ github.workspace }}/tests/conformance/index.php
@@ -57,7 +62,7 @@ jobs:
         cmd: "'php -S localhost:8080 router.php'"
 
     - name: Run CloudEvent conformance tests
-      uses: GoogleCloudPlatform/functions-framework-conformance/action@v1.2.1
+      uses: GoogleCloudPlatform/functions-framework-conformance/action@e42b1533877f1b639f508ec7fbcfb5be31aca663 # v1.2.1
       env:
         FUNCTION_TARGET: 'cloudEventFunc'
         FUNCTION_SIGNATURE_TYPE: 'cloudevent'
@@ -70,7 +75,7 @@ jobs:
         cmd: "'php -S localhost:8080 router.php'"
 
     - name: Run Declarative CloudEvent conformance tests
-      uses: GoogleCloudPlatform/functions-framework-conformance/action@v1.2.1
+      uses: GoogleCloudPlatform/functions-framework-conformance/action@e42b1533877f1b639f508ec7fbcfb5be31aca663 # v1.2.1
       env:
         FUNCTION_TARGET: 'declarativeCloudEventFunc'
         FUNCTION_SOURCE: ${{ github.workspace }}/tests/conformance/index.php

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -0,0 +1,27 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required, 
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@03bee3930647ebbf994244c21ddbc0d4933aab4f # v2.3.0
+        with:
+          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
@@ -4,12 +4,20 @@ on:
     branches:
       - main
   pull_request:
+permissions:
+  contents: read
+
 jobs:
   php-cs-fixer:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - name: Harden Runner
+      uses: step-security/harden-runner@03bee3930647ebbf994244c21ddbc0d4933aab4f # v2.3.0
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
     - name: PHP-CS-Fixer
-      uses: docker://oskarstark/php-cs-fixer-ga
+      uses: docker://oskarstark/php-cs-fixer-ga:latest@sha256:73ae29e0cf222d3e132651af5bfb84ac3f210d58cd98e8f863d0b47f8ee0346f
       with:
         args: . --diff --dry-run
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -24,6 +24,11 @@ jobs:
       id-token: write
 
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@03bee3930647ebbf994244c21ddbc0d4933aab4f # v2.3.0
+        with:
+          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
       - name: "Checkout code"
         uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
         with:

diff --git a/.github/workflows/unit.yml b/.github/workflows/unit.yml
@@ -4,6 +4,9 @@ on:
     branches:
       - main
   pull_request:
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ matrix.operating-system }}
@@ -13,14 +16,19 @@ jobs:
         php-versions: [ '7.4','8.0','8.1','8.2' ]
     name: PHP ${{ matrix.php-versions }} Unit Test
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@03bee3930647ebbf994244c21ddbc0d4933aab4f # v2.3.0
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
     - name: Uses PHP ${{ matrix.php-versions }}
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@d30ad8b1843ace22e6698ab99bbafaa747b6bd0d # v2
       with:
         php-version: ${{ matrix.php-versions }}
     - name: Install Dependencies
-      uses: nick-invision/retry@v1
+      uses: nick-invision/retry@39da88d5f7d15a96aed861dbabbe8b7443e3182a # v1.0.4
       with:
         timeout_minutes: 10
         max_attempts: 3