Skip to content

Commit a4e88f2

Browse files
step-security-botstep-security-bot
authored
[StepSecurity] Apply security best practices (#570)
Signed-off-by: StepSecurity Bot <[email protected]>
1 parent ac8f19c commit a4e88f2

14 files changed

+125
-28
lines changed

‎.github/dependabot.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,13 @@ updates:
1717
schedule:
1818
# Check for updates to GitHub Actions every weekday
1919
interval: "weekly"
20+
21+
- package-ecosystem: bundler
22+
directory: /
23+
schedule:
24+
interval: daily
25+
26+
- package-ecosystem: npm
27+
directory: /
28+
schedule:
29+
interval: daily

‎.github/workflows/MetricsActions.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
# Lines below let you run workflow manually and on each commit
77
workflow_dispatch:
88
push: {branches: ["main", "_staging", "master"]}
9+
permissions:
10+
contents: read
11+
912
jobs:
1013
github-metrics:
1114
runs-on: ubuntu-latest
@@ -14,7 +17,12 @@ jobs:
1417
permissions:
1518
contents: write
1619
steps:
17-
- uses: lowlighter/metrics@latest
20+
- name: Harden the runner (Audit all outbound calls)
21+
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
22+
with:
23+
egress-policy: audit
24+
25+
- uses: lowlighter/metrics@65836723097537a54cd8eb90f61839426b4266b6 # latest
1826
with:
1927
token: ${{ secrets.METRICS_TOKEN }}
2028
output: RalphHightowerMetrics.svg

‎.github/workflows/NewYearUpdateCopyright.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,11 @@ jobs:
1212
permissions:
1313
issues: write
1414
steps:
15+
- name: Harden the runner (Audit all outbound calls)
16+
uses: step-security/harden-runner@v2
17+
with:
18+
egress-policy: audit
19+
1520
- name: Happy New Year!
1621
run: |
1722
new_issue_url=$(gh issue create \

‎.github/workflows/ci.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,15 @@ jobs:
1919
env:
2020
JEKYLL_VERSION: ${{ matrix.jekyll }}
2121
steps:
22+
- name: Harden the runner (Audit all outbound calls)
23+
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
24+
with:
25+
egress-policy: audit
26+
2227
- name: Checkout Repository
23-
uses: actions/[email protected]
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2429
- name: Set Up Ruby 3.3.6
25-
uses: ruby/[email protected]
30+
uses: ruby/setup-ruby@922ebc4c5262cd14e07bb0e1db020984b6c064fe # v1.226.0
2631
with:
2732
ruby-version: 3.3.6
2833
bundler-cache: true

‎.github/workflows/codeql.yml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,12 +40,17 @@ jobs:
4040
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
4141

4242
steps:
43+
- name: Harden the runner (Audit all outbound calls)
44+
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
45+
with:
46+
egress-policy: audit
47+
4348
- name: Checkout repository
44-
uses: actions/[email protected]
49+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4550

4651
# Initializes the CodeQL tools for scanning.
4752
- name: Initialize CodeQL
48-
uses: github/codeql-action/[email protected]
53+
uses: github/codeql-action/autobuild@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
4954
with:
5055
languages: ${{ matrix.language }}
5156
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -55,7 +60,7 @@ jobs:
5560
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
5661
# If this step fails, then you should remove it and run the build manually (see below)
5762
- name: Autobuild
58-
uses: github/codeql-action/[email protected]
63+
uses: github/codeql-action/autobuild@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
5964

6065
# ℹ️ Command-line programs to run using the OS shell.
6166
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -68,6 +73,6 @@ jobs:
6873
# ./location_of_script_within_repo/buildscript.sh
6974

7075
- name: Perform CodeQL Analysis
71-
uses: github/codeql-action/[email protected]
76+
uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
7277
with:
7378
category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-review.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,12 @@ jobs:
1616
dependency-review:
1717
runs-on: ubuntu-latest
1818
steps:
19+
- name: Harden the runner (Audit all outbound calls)
20+
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
21+
with:
22+
egress-policy: audit
23+
1924
- name: 'Checkout Repository'
20-
uses: actions/[email protected]
25+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2126
- name: 'Dependency Review'
22-
uses: actions/[email protected]
27+
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0

‎.github/workflows/jekyll.yml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,17 +31,22 @@ jobs:
3131
build:
3232
runs-on: ubuntu-22.04
3333
steps:
34+
- name: Harden the runner (Audit all outbound calls)
35+
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
36+
with:
37+
egress-policy: audit
38+
3439
- name: Checkout
35-
uses: actions/[email protected]
40+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3641
- name: Setup Ruby
37-
uses: ruby/[email protected]
42+
uses: ruby/setup-ruby@922ebc4c5262cd14e07bb0e1db020984b6c064fe # v1.226.0
3843
with:
3944
ruby-version: '3.3.6' # Not needed with a .ruby-version file
4045
bundler-cache: true # runs 'bundle install' and caches installed gems automatically
4146
cache-version: 1 # Increment this number if you need to re-download cached gems
4247
- name: Setup Pages
4348
id: pages
44-
uses: actions/[email protected]
49+
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
4550
- name: Build with Jekyll
4651
# Outputs to the './_site' directory by default
4752
run: bundle exec jekyll build --trace --incremental --baseurl "${{ steps.pages.outputs.base_path }}"
@@ -51,7 +56,7 @@ jobs:
5156
LOG_LEVEL: debug
5257
- name: Upload artifact
5358
# Automatically uploads an artifact from the './_site' directory by default
54-
uses: actions/[email protected]
59+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
5560

5661
# Deployment job
5762
deploy:
@@ -61,6 +66,11 @@ jobs:
6166
runs-on: ubuntu-latest
6267
needs: build
6368
steps:
69+
- name: Harden the runner (Audit all outbound calls)
70+
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
71+
with:
72+
egress-policy: audit
73+
6474
- name: Deploy to GitHub Pages
6575
id: deployment
66-
uses: actions/[email protected]
76+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

‎.github/workflows/permission_advisor.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,12 @@ jobs:
2121
advisor:
2222
runs-on: ubuntu-latest
2323
steps:
24-
- uses: GitHubSecurityLab/actions-permissions/[email protected]
24+
- name: Harden the runner (Audit all outbound calls)
25+
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
26+
with:
27+
egress-policy: audit
28+
29+
- uses: GitHubSecurityLab/actions-permissions/advisor@babd69bc8d78e6cdece903dfdcfb72d4e1a4f00d # v1.0.2-beta5
2530
with:
2631
name: ${{ inputs.name }}
2732
count: ${{ inputs.count }}

‎.github/workflows/readme-checker.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,15 @@ jobs:
88
lint:
99
runs-on: ubuntu-latest
1010
steps:
11+
- name: Harden the runner (Audit all outbound calls)
12+
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
13+
with:
14+
egress-policy: audit
15+
1116
- name: Checkout
12-
uses: actions/[email protected]
17+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1318
- name: Checking markdown
14-
uses: DavidAnson/[email protected]
19+
uses: DavidAnson/markdownlint-cli2-action@05f32210e84442804257b2a6f20b273450ec8265 # v19.1.0
1520
with:
1621
globs: |
1722
*.md

‎.github/workflows/release.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,13 @@ jobs:
1818
name: release
1919
runs-on: ubuntu-latest
2020
steps:
21-
- uses: actions/[email protected]
22-
- uses: actions/[email protected]
21+
- name: Harden the runner (Audit all outbound calls)
22+
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
23+
with:
24+
egress-policy: audit
25+
26+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
27+
- uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
2328
with:
2429
cache: npm
2530
node-version: lts/*

0 commit comments

Comments
 (0)