[StepSecurity] ci: Harden GitHub Actions#9803
Conversation
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
step-security-bot
requested review from
hzyitc,
igorpecovnik and
rpardini
as code owners
github-actions
Bot
added
size/medium
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (2)
📝 WalkthroughWalkthroughThis PR pins 30+ GitHub Actions across 25 workflows and a composite action definition to specific commit SHAs instead of floating version tags. A new egress auditing step is added to the kernel security workflow. ChangesGitHub Actions pinning for supply chain security
🎯 2 (Simple) | ⏱️ ~12 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
Needs review
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (4)
.github/workflows/maintenance-check-kernel-security.yml (1)
33-33: ⚡ Quick winConsider enforcing egress after baseline
At Line 33,
egress-policy: auditis non-blocking. After collecting stable outbound destinations, consider switching toblock+ explicit allowlist to convert this from detection-only to prevention.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/maintenance-check-kernel-security.yml at line 33, The current policy sets "egress-policy: audit" which only detects outbound traffic; after you've collected stable outbound destinations switch this to "egress-policy: block" and implement an explicit allowlist of required destinations (DNS, package registries, registries, telemetry endpoints, etc.) so egress is prevented by default; update the workflow configuration where "egress-policy: audit" appears and add the corresponding allowlist entries and documentation for any exceptions to ensure legitimate traffic isn't blocked..github/workflows/maintenance-validate-board-configs.yml (1)
25-30: ⚡ Quick winDisable persisted checkout credentials for least privilege
At Line 25, consider adding
persist-credentials: false. This job only needs a local checkout + diff, so keeping the token out of git config reduces credential exposure surface with minimal impact.Proposed change
- name: "Checkout PR" uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: + persist-credentials: false # Need the merge-base to compute changed files; depth 0 is # heaviest but bulletproof. Most PRs are small enough this # is fine; switch to fetch-depth: 2 + explicit base ref if # repo size becomes a problem. fetch-depth: 0🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/maintenance-validate-board-configs.yml around lines 25 - 30, Modify the checkout step's inputs to disable persisted GitHub token by adding persist-credentials: false alongside the existing fetch-depth: 0 under the same "with:" block so the checkout action (the step that currently sets fetch-depth: 0) does not write the workflow token into git config and reduces credential exposure..github/workflows/maintenance-security-scan.yml (1)
64-64: ⚡ Quick winRemove the stale SHA comment on Line 64.
This orphaned hash/version note is not associated with an active action reference and may mislead future updates.
Suggested cleanup
- `#5f532563584d71fdef14ee64d17bafb34f751ce5` # v1.0.26🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/maintenance-security-scan.yml at line 64, Remove the orphaned SHA comment ("#5f532563584d71fdef14ee64d17bafb34f751ce5 # v1.0.26") from the workflow file: delete that standalone hash/comment so there is no stale reference left unassociated with any actions or steps; ensure no other lines rely on that comment and commit the cleaned .github/workflows/maintenance-security-scan.yml.action.yml (1)
117-526: Establish a process for maintaining pinned action versions.While pinning actions to commit SHAs improves security by preventing unexpected updates, it also means security patches won't be automatically applied. Consider:
- Setting up Dependabot or Renovate to monitor and propose updates to pinned actions
- Regularly reviewing pinned versions for security advisories
- Documenting the update process for these pinned actions
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@action.yml` around lines 117 - 526, The workflow pins many GitHub Actions to commit SHAs (e.g., descriptinc/free-disk-space@1b4b157..., crazy-max/ghaction-import-gpg@2dc316de..., actions/checkout@de0fac2..., ncipollo/release-action@339a818...), which is good for immutability but needs an established update process; add a short maintenance section to the repo explaining how to keep these pins current, enable an automated dependency bot (Dependabot or Renovate) to open PRs that update pinned action SHAs, and include a checklist for reviewers to verify and test action updates (security advisories, CI smoke run, and commit-SHA verification) so maintainers know how to safely accept updates for the pinned actions referenced in this workflow.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/maintenance-label-on-approval.yml:
- Line 22: Replace the incorrect pinned SHAs for the GitHub Actions so the
commit SHA matches the claimed tag: update the
j-fulbright/label-when-approved-action entry currently using
`@911c622c75f8ea99ee00cdd66e2cd888bac530c6` (tag v1.2) to use the correct SHA
a3ae55f3410295075243901b4af55ecfd88292c9, and update the actions/github-script
entry currently using `@3a2844b7e9c422d3c10d287c895573f7108da1b3` (tag v9.0.0) to
use the correct SHA d746ffe35508b1917358783b479e04febd2b8f71; locate those lines
by the action identifiers j-fulbright/label-when-approved-action and
actions/github-script and replace the SHA suffixes accordingly.
In @.github/workflows/maintenance-welcome-pr.yml:
- Line 17: The pinned commit SHA for the action used in the workflow (the uses
line "plbstl/first-contribution@7c31f41b0e7a70adfcae06cf964679f61af6780b") is
incorrect for v4.3.0; update that SHA to the correct commit
"418ab40c44ca34a58151b3ad7657ae34fb9a82ca" (or change the tag if you intended a
different version) so the uses entry matches the intended v4.3.0 release.
---
Nitpick comments:
In @.github/workflows/maintenance-check-kernel-security.yml:
- Line 33: The current policy sets "egress-policy: audit" which only detects
outbound traffic; after you've collected stable outbound destinations switch
this to "egress-policy: block" and implement an explicit allowlist of required
destinations (DNS, package registries, registries, telemetry endpoints, etc.) so
egress is prevented by default; update the workflow configuration where
"egress-policy: audit" appears and add the corresponding allowlist entries and
documentation for any exceptions to ensure legitimate traffic isn't blocked.
In @.github/workflows/maintenance-security-scan.yml:
- Line 64: Remove the orphaned SHA comment
("#5f532563584d71fdef14ee64d17bafb34f751ce5 # v1.0.26") from the workflow file:
delete that standalone hash/comment so there is no stale reference left
unassociated with any actions or steps; ensure no other lines rely on that
comment and commit the cleaned .github/workflows/maintenance-security-scan.yml.
In @.github/workflows/maintenance-validate-board-configs.yml:
- Around line 25-30: Modify the checkout step's inputs to disable persisted
GitHub token by adding persist-credentials: false alongside the existing
fetch-depth: 0 under the same "with:" block so the checkout action (the step
that currently sets fetch-depth: 0) does not write the workflow token into git
config and reduces credential exposure.
In `@action.yml`:
- Around line 117-526: The workflow pins many GitHub Actions to commit SHAs
(e.g., descriptinc/free-disk-space@1b4b157...,
crazy-max/ghaction-import-gpg@2dc316de..., actions/checkout@de0fac2...,
ncipollo/release-action@339a818...), which is good for immutability but needs an
established update process; add a short maintenance section to the repo
explaining how to keep these pins current, enable an automated dependency bot
(Dependabot or Renovate) to open PRs that update pinned action SHAs, and include
a checklist for reviewers to verify and test action updates (security
advisories, CI smoke run, and commit-SHA verification) so maintainers know how
to safely accept updates for the pinned actions referenced in this workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 951bc288-f3a5-4f75-8d8d-587745ecafc9
📒 Files selected for processing (24)
.github/workflows/data-jira-ticket.yml.github/workflows/data-sync-board-list.yml.github/workflows/data-sync-labels.yml.github/workflows/data-sync-maintainers.yml.github/workflows/data-sync-tools.yml.github/workflows/infrastructure-dispatch-to-fork.yml.github/workflows/infrastructure-mirror-to-codeberg.yml.github/workflows/maintenance-announce-merge.yml.github/workflows/maintenance-announce-pr.yml.github/workflows/maintenance-auto-label.yml.github/workflows/maintenance-build-artifacts.yml.github/workflows/maintenance-check-board-assets.yml.github/workflows/maintenance-check-kernel-security.yml.github/workflows/maintenance-clean-workflow-logs.yml.github/workflows/maintenance-label-on-approval.yml.github/workflows/maintenance-lint-scripts.yml.github/workflows/maintenance-listen-review.yml.github/workflows/maintenance-rewrite-kernel-configs.yml.github/workflows/maintenance-rewrite-kernel-patches.yml.github/workflows/maintenance-security-scan.yml.github/workflows/maintenance-validate-board-configs.yml.github/workflows/maintenance-welcome-issue.yml.github/workflows/maintenance-welcome-pr.ymlaction.yml
|
Just a year or so ago, I myself was against such paranoia. But since then, there have been several successful attacks on supply chains, and I have changed my attitude towards this technique. |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
iav
left a comment
iav
left a comment
There was a problem hiding this comment.
let's try to turn more paranoidal
|
✅ This PR has been reviewed and approved — all set for merge! |
|
@coderabbitai — applying the same two-step API lookup methodology you used for
All three "incorrect" SHAs you flagged are actually the tag-object SHAs returned by Could you retract the |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain
🏁 Script executed: Length of output: 339 The flags appear to be in the main review body rather than inline comments. Let me check the PR reviews. 🏁 Script executed: Length of output: 455 🏁 Script executed: Length of output: 942
Unfortunately the two remaining flags ( To summarise the correction for anyone reading the PR:
Both flags in the review body should be disregarded — all pinned SHAs in this PR are correct. Apologies for the noise. (ↀᴥↀ)? ✏️ Learnings added
|
- maintenance-security-scan.yml: drop orphan SHA comment (`#5f532563...` # v1.0.26) left behind by the StepSecurity-bot generator; the line above (`uses: github/codeql-action/upload-sarif@… # v4.35.4`) is the actual pin. - maintenance-validate-board-configs.yml: add persist-credentials: false to the actions/checkout step. The job only diffs board configs and never pushes, so keeping the workflow token out of git config reduces credential exposure with no functional impact. Assisted-by: Claude:claude-opus-4.7
github-actions
Bot
added
Needs review
|
✅ This PR has been reviewed and approved — all set for merge! |
|
Most of the Armbian action scripts live in https://github.com/armbian/armbian.github.io repo. Probably doing this there too? |
I can't — I have no permissions to create PR there. |
3 participants
Summary
This pull request is created by StepSecurity at the request of @iav. Please merge the Pull Request to incorporate the requested changes. Please tag @iav on your message if you have any questions related to the PR.
Security Fixes
Pinned Dependencies
GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.
Harden Runner
Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without
sudoaccess. See how popular open-source projects use Harden-Runner here.Harden runner usage
You can find link to view insights and policy recommendation in the build log
Please refer to documentation to find more details.
Feedback
For bug reports, feature requests, and general feedback; please email support@stepsecurity.io. To create such PRs, please visit https://app.stepsecurity.io/securerepo.
Signed-off-by: StepSecurity Bot bot@stepsecurity.io
Summary by CodeRabbit
Chores
Security