gha-hazmat/.github/workflows/pypi-manual-credential.yml at main · woodruffw/gha-hazmat · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# pypi-manual-credential.yml
#
# what: PyPI supports credentialless publishing through "trusted publishing,"
# which uses the GitHub Actions OIDC IdP under the hood. this eliminates
# the need for manually configured long-lived API credential, and therefore
# reduces the risk of accidental credential exfiltration.
#
# how: a PyPI publishing workflow that doesn't use trusted publishing
# is more vulnerable to credential exfiltration, e.g. via accidental
# logging or a malicious component action.

name: example
on: [push]

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write # mandatory for trusted publishing
    steps:
      # OK: uses ambient OIDC credential
      - name: not-vulnerable-1
        uses: pypa/gh-action-pypi-publish@release/v1

      # NOT OK: uses manual API token
      - name: vulnerable-2
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_TOKEN }}

      # OK: uses ambient OIDC credential for TestPyPI
      - name: not-vulnerable-3
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/

      # OK: uses ambient OIDC credential for PyPI, explicit URL
      - name: not-vulnerable-4
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://upload.pypi.org/legacy/

      # OK: uses ambient OIDC credential for PyPI, explicit URL, deprecated form
      - name: not-vulnerable-5
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository_url: https://upload.pypi.org/legacy/

      # OK: uses manual API token for non-PyPI index
      - name: not-vulnerable-6
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://example.com/legacy
          password: ${{ secrets.NON_PYPI_TOKEN }}

      # NOT OK: uses manual API token for PyPI, explicit url
      - name: vulnerable-7
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://upload.pypi.org/legacy/
          password: ${{ secrets.PYPI_TOKEN }}


      # NOT OK: uses manual API token for TestPyPI
      - name: vulnerable-8
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/
          password: ${{ secrets.TEST_PYPI_TOKEN }}

      # NOT OK: uses manual API token for PyPI, explicit url, deprecated form
      - name: vulnerable-9
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository_url: https://upload.pypi.org/legacy/
          password: ${{ secrets.PYPI_TOKEN }}


      # NOT OK: uses manual API token for TestPyPI, explcit url, deprecated form
      - name: vulnerable-10
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository_url: https://test.pypi.org/legacy/
          password: ${{ secrets.TEST_PYPI_TOKEN }}