Skip to content

Commit 4c098df

Browse files
step-security-botstep-security-bot
authored
ci: Harden GitHub Actions [StepSecurity] (#328)
[StepSecurity] ci: Harden GitHub Actions Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
1 parent d7c7113 commit 4c098df

File tree

13 files changed

+114
-3
lines changed

13 files changed

+114
-3
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 38 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,11 @@ jobs:
2727
changed-tests-files: ${{ steps.changed-files-yaml.outputs.tests_any_changed }}
2828
steps:
2929
# Checkout the repository
30+
- name: Harden the runner (Audit all outbound calls)
31+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
32+
with:
33+
egress-policy: audit
34+
3035
- name: Checkout Code
3136
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3237
- name: Get changed files
@@ -58,6 +63,11 @@ jobs:
5863
needs: [test, msrv, rustfmt, clippy]
5964
runs-on: ubuntu-latest
6065
steps:
66+
- name: Harden the runner (Audit all outbound calls)
67+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
68+
with:
69+
egress-policy: audit
70+
6171
- name: Failed
6272
run: exit 1
6373
if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
@@ -69,6 +79,11 @@ jobs:
6979
timeout-minutes: 10
7080
steps:
7181
# Checkout the repository
82+
- name: Harden the runner (Audit all outbound calls)
83+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
84+
with:
85+
egress-policy: audit
86+
7287
- name: Checkout Code
7388
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7489
- name: Prepare
@@ -79,7 +94,7 @@ jobs:
7994
- name: Get cache-hit output
8095
run: 'echo "Cache hit >>>>>: ${{ steps.init.outputs.cache-hit }}"'
8196
- name: Install cargo hack
82-
uses: taiki-e/install-action@cargo-hack
97+
uses: taiki-e/install-action@7689010b667477e55299b24c373cdf719c945fdf # cargo-hack
8398

8499
# Check the minimum supported Rust version
85100
- name: Default features
@@ -92,6 +107,11 @@ jobs:
92107
timeout-minutes: 10
93108
steps:
94109
# Checkout the repository
110+
- name: Harden the runner (Audit all outbound calls)
111+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
112+
with:
113+
egress-policy: audit
114+
95115
- name: Checkout Code
96116
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
97117
- name: Prepare
@@ -115,6 +135,11 @@ jobs:
115135
timeout-minutes: 10
116136
steps:
117137
# Checkout the repository
138+
- name: Harden the runner (Audit all outbound calls)
139+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
140+
with:
141+
egress-policy: audit
142+
118143
- name: Checkout Code
119144
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
120145
- name: Prepare
@@ -138,6 +163,11 @@ jobs:
138163
timeout-minutes: 20
139164
steps:
140165
# Checkout the repository
166+
- name: Harden the runner (Audit all outbound calls)
167+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
168+
with:
169+
egress-policy: audit
170+
141171
- name: Checkout Code
142172
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
143173
- name: Prepare
@@ -150,9 +180,9 @@ jobs:
150180
- name: Get cache-hit output
151181
run: 'echo "Cache hit >>>>>: ${{ steps.init.outputs.cache-hit }}"'
152182
- name: Install cargo hack
153-
uses: taiki-e/install-action@cargo-hack
183+
uses: taiki-e/install-action@7689010b667477e55299b24c373cdf719c945fdf # cargo-hack
154184
- name: Install cargo-llvm-cov
155-
uses: taiki-e/install-action@cargo-llvm-cov
185+
uses: taiki-e/install-action@16edcff251c6bb06f6878981359f84b77b28e7e2 # cargo-llvm-cov
156186
- name: Build
157187
run: cargo test --no-run --locked
158188

@@ -212,6 +242,11 @@ jobs:
212242
${{ github.event.pull_request.draft == false && needs.changed_files.outputs.changed-docker-files == 'true' }}
213243
steps:
214244
# Checkout the repository
245+
- name: Harden the runner (Audit all outbound calls)
246+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
247+
with:
248+
egress-policy: audit
249+
215250
- name: Checkout Code
216251
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
217252
- name: Prepare

‎.github/workflows/codeql.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ on:
88
schedule:
99
- cron: '20 2 * * 3'
1010

11+
permissions:
12+
contents: read
13+
1114
jobs:
1215
analyze:
1316
name: Analyze (${{ matrix.language }})
@@ -32,6 +35,11 @@ jobs:
3235
- language: rust
3336
build-mode: none
3437
steps:
38+
- name: Harden the runner (Audit all outbound calls)
39+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
40+
with:
41+
egress-policy: audit
42+
3543
- name: Checkout repository
3644
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.5.4
3745

‎.github/workflows/pr-title.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,11 @@ jobs:
1111
validate:
1212
runs-on: ubuntu-latest
1313
steps:
14+
- name: Harden the runner (Audit all outbound calls)
15+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
16+
with:
17+
egress-policy: audit
18+
1419
- uses: thehanimo/pr-title-checker@7fbfe05602bdd86f926d3fb3bccb6f3aed43bc70 # v1.4.3
1520
with:
1621
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/rc.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,11 @@ jobs:
2222
create-release-branch:
2323
runs-on: ubuntu-latest
2424
steps:
25+
- name: Harden the runner (Audit all outbound calls)
26+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
27+
with:
28+
egress-policy: audit
29+
2530
- uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
2631
id: gh-app-token
2732
with:

‎.github/workflows/release-bins.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,11 @@ jobs:
3838
TAG: ${{ inputs.tag || github.event.inputs.tag }}
3939
RUSTUP_TOOLCHAIN: stable-${{ matrix.arch }}
4040
steps:
41+
- name: Harden the runner (Audit all outbound calls)
42+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
43+
with:
44+
egress-policy: audit
45+
4146
- name: Get github app token
4247
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
4348
id: gh-app-token
@@ -83,6 +88,11 @@ jobs:
8388
env:
8489
TAG: ${{ needs.build.outputs.release_tag }}
8590
steps:
91+
- name: Harden the runner (Audit all outbound calls)
92+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
93+
with:
94+
egress-policy: audit
95+
8696
- name: Get github app token
8797
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
8898
id: gh-app-token

‎.github/workflows/release-docker.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@ jobs:
1717
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
1818
SLACK_CHANNEL: '#oss-releases'
1919
steps:
20+
- name: Harden the runner (Audit all outbound calls)
21+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
22+
with:
23+
egress-policy: audit
24+
2025
- name: Slack notification
2126
uses: act10ns/slack@44541246747a30eb3102d87f7a4cc5471b0ffb7d # v2.1.0
2227
with:

‎.github/workflows/release-docs.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@ jobs:
2828
SLACK_CHANNEL: '#oss-releases'
2929
TAG: ${{ inputs.tag || github.event.inputs.tag }}
3030
steps:
31+
- name: Harden the runner (Audit all outbound calls)
32+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
33+
with:
34+
egress-policy: audit
35+
3136
- name: Get github app token
3237
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
3338
id: gh-app-token

‎.github/workflows/release-please.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,11 @@ jobs:
2424
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
2525
SLACK_CHANNEL: '#oss-releases'
2626
steps:
27+
- name: Harden the runner (Audit all outbound calls)
28+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
29+
with:
30+
egress-policy: audit
31+
2732
- name: Get github app token
2833
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
2934
id: gh-app-token
@@ -113,6 +118,11 @@ jobs:
113118
needs: release-please
114119
if: ${{ needs.release-please.outputs.release_created == 'false' && needs.release-please.outputs.pr_created == 'true' }}
115120
steps:
121+
- name: Harden the runner (Audit all outbound calls)
122+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
123+
with:
124+
egress-policy: audit
125+
116126
- name: Get github app token
117127
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
118128
id: gh-app-token

‎.github/workflows/release-sbom.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,11 @@ jobs:
1616
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
1717
SLACK_CHANNEL: '#oss-releases'
1818
steps:
19+
- name: Harden the runner (Audit all outbound calls)
20+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
21+
with:
22+
egress-policy: audit
23+
1924
- name: Get github app token
2025
uses: actions/create-github-app-token@af35edadc00be37caa72ed9f3e6d5f7801bfdf09 # v1.11.7
2126
id: gh-app-token

‎.github/workflows/rust-docs-url.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@ jobs:
2121
runs-on: ubuntu-latest
2222
environment: release
2323
steps:
24+
- name: Harden the runner (Audit all outbound calls)
25+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
26+
with:
27+
egress-policy: audit
28+
2429
- uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
2530
id: gh-app-token
2631
with:

0 commit comments

Comments
 (0)