Skip to content

Commit 5e47010

Browse files
step-security-botstep-security-bot
authored
[StepSecurity] Apply security best practices (#59)
Signed-off-by: StepSecurity Bot <[email protected]>
1 parent 8af3d39 commit 5e47010

14 files changed

+165
-36
lines changed

‎.github/dependabot.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,33 @@ updates:
1717
schedule:
1818
# Check for updates to GitHub Actions every weekday
1919
interval: "weekly"
20+
21+
- package-ecosystem: nuget
22+
directory: /DemoInstall/projects/SetSecurity
23+
schedule:
24+
interval: daily
25+
26+
- package-ecosystem: nuget
27+
directory: /DemoInstall/projects/UpdateManifest
28+
schedule:
29+
interval: daily
30+
31+
- package-ecosystem: bundler
32+
directory: /
33+
schedule:
34+
interval: daily
35+
36+
- package-ecosystem: nuget
37+
directory: /NasaStsTvScheduleReader
38+
schedule:
39+
interval: daily
40+
41+
- package-ecosystem: nuget
42+
directory: /NasaTvSchedule
43+
schedule:
44+
interval: daily
45+
46+
- package-ecosystem: nuget
47+
directory: /TimeZoneInfo
48+
schedule:
49+
interval: daily

‎.github/workflows/NewYearUpdateCopyright.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,11 @@ jobs:
1212
permissions:
1313
issues: write
1414
steps:
15+
- name: Harden Runner
16+
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
17+
with:
18+
egress-policy: audit
19+
1520
- name: Happy New Year!
1621
run: |
1722
new_issue_url=$(gh issue create \

‎.github/workflows/ci.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,15 @@ jobs:
1919
env:
2020
JEKYLL_VERSION: ${{ matrix.jekyll }}
2121
steps:
22+
- name: Harden Runner
23+
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
24+
with:
25+
egress-policy: audit
26+
2227
- name: Checkout Repository
23-
uses: actions/[email protected]
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2429
- name: Set Up Ruby 3.3.6
25-
uses: ruby/[email protected]
30+
uses: ruby/setup-ruby@bfefad842bb982ff05b233bcbc1571d97a87e69f # v1.206.0
2631
with:
2732
ruby-version: 3.3.6
2833
bundler-cache: true

‎.github/workflows/codeql.yml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,12 +40,17 @@ jobs:
4040
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
4141

4242
steps:
43+
- name: Harden Runner
44+
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
45+
with:
46+
egress-policy: audit
47+
4348
- name: Checkout repository
44-
uses: actions/[email protected]
49+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4550

4651
# Initializes the CodeQL tools for scanning.
4752
- name: Initialize CodeQL
48-
uses: github/codeql-action/[email protected]
53+
uses: github/codeql-action/autobuild@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e # v2.20.0
4954
with:
5055
languages: ${{ matrix.language }}
5156
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -55,7 +60,7 @@ jobs:
5560
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
5661
# If this step fails, then you should remove it and run the build manually (see below)
5762
- name: Autobuild
58-
uses: github/codeql-action/[email protected]
63+
uses: github/codeql-action/autobuild@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e # v2.20.0
5964

6065
# ℹ️ Command-line programs to run using the OS shell.
6166
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -68,6 +73,6 @@ jobs:
6873
# ./location_of_script_within_repo/buildscript.sh
6974

7075
- name: Perform CodeQL Analysis
71-
uses: github/codeql-action/[email protected]
76+
uses: github/codeql-action/analyze@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e # v2.20.0
7277
with:
7378
category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-review.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,12 @@ jobs:
1616
dependency-review:
1717
runs-on: ubuntu-latest
1818
steps:
19+
- name: Harden Runner
20+
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
21+
with:
22+
egress-policy: audit
23+
1924
- name: 'Checkout Repository'
20-
uses: actions/[email protected]
25+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2126
- name: 'Dependency Review'
22-
uses: actions/[email protected]
27+
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0

‎.github/workflows/jekyll-gh-pages.yml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,17 +25,22 @@ jobs:
2525
build:
2626
runs-on: ubuntu-latest
2727
steps:
28+
- name: Harden Runner
29+
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
30+
with:
31+
egress-policy: audit
32+
2833
- name: Checkout
29-
uses: actions/[email protected]
34+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
3035
- name: Setup Pages
31-
uses: actions/[email protected]
36+
uses: actions/configure-pages@f156874f8191504dae5b037505266ed5dda6c382 # v3.0.6
3237
- name: Build with Jekyll
33-
uses: actions/[email protected]
38+
uses: actions/jekyll-build-pages@058068233b22675635bdf8dfa178d6ae77f12694 # v1.0.8
3439
with:
3540
source: ./
3641
destination: ./_site
3742
- name: Upload GitHub Pages artifact
38-
uses: actions/[email protected]
43+
uses: actions/upload-pages-artifact@a753861a5debcf57bf8b404356158c8e1e33150c # v2.0.0
3944

4045
# Deployment job
4146
deploy:
@@ -45,6 +50,11 @@ jobs:
4550
runs-on: ubuntu-latest
4651
needs: build
4752
steps:
53+
- name: Harden Runner
54+
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
55+
with:
56+
egress-policy: audit
57+
4858
- name: Deploy to GitHub Pages
4959
id: deployment
50-
uses: actions/[email protected]
60+
uses: actions/deploy-pages@12ab2b16cf43a7a061fe99da74b6f8f11fb77f5b # v2.0.3

‎.github/workflows/jekyll.yml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,17 +31,22 @@ jobs:
3131
build:
3232
runs-on: ubuntu-latest
3333
steps:
34+
- name: Harden Runner
35+
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
36+
with:
37+
egress-policy: audit
38+
3439
- name: Checkout
35-
uses: actions/[email protected]
40+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3641
- name: Setup Ruby
37-
uses: ruby/[email protected]
42+
uses: ruby/setup-ruby@bfefad842bb982ff05b233bcbc1571d97a87e69f # v1.206.0
3843
with:
3944
ruby-version: '3.3.6' # Not needed with a .ruby-version file
4045
bundler-cache: true # runs 'bundle install' and caches installed gems automatically
4146
cache-version: 1 # Increment this number if you need to re-download cached gems
4247
- name: Setup Pages
4348
id: pages
44-
uses: actions/[email protected]
49+
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
4550
- name: Build with Jekyll
4651
# Outputs to the './_site' directory by default
4752
run: bundle exec jekyll build --trace --incremental --baseurl "${{ steps.pages.outputs.base_path }}"
@@ -51,7 +56,7 @@ jobs:
5156
LOG_LEVEL: debug
5257
- name: Upload artifact
5358
# Automatically uploads an artifact from the './_site' directory by default
54-
uses: actions/[email protected]
59+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
5560

5661
# Deployment job
5762
deploy:
@@ -61,6 +66,11 @@ jobs:
6166
runs-on: ubuntu-latest
6267
needs: build
6368
steps:
69+
- name: Harden Runner
70+
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
71+
with:
72+
egress-policy: audit
73+
6474
- name: Deploy to GitHub Pages
6575
id: deployment
66-
uses: actions/[email protected]
76+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

‎.github/workflows/pages.yml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,17 +31,22 @@ jobs:
3131
build:
3232
runs-on: ubuntu-latest
3333
steps:
34+
- name: Harden Runner
35+
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
36+
with:
37+
egress-policy: audit
38+
3439
- name: Checkout
35-
uses: actions/[email protected]
40+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3641
- name: Setup Ruby
37-
uses: ruby/[email protected]
42+
uses: ruby/setup-ruby@bfefad842bb982ff05b233bcbc1571d97a87e69f # v1.206.0
3843
with:
3944
ruby-version: '3.3.6' # Not needed with a .ruby-version file
4045
bundler-cache: true # runs 'bundle install' and caches installed gems automatically
4146
cache-version: 1 # Increment this number if you need to re-download cached gems
4247
- name: Setup Pages
4348
id: pages
44-
uses: actions/[email protected]
49+
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
4550
- name: Build with Jekyll
4651
# Outputs to the './_site' directory by default
4752
run: bundle exec jekyll build --trace --incremental --baseurl "${{ steps.pages.outputs.base_path }}"
@@ -51,7 +56,7 @@ jobs:
5156
LOG_LEVEL: debug
5257
- name: Upload artifact
5358
# Automatically uploads an artifact from the './_site' directory by default
54-
uses: actions/[email protected]
59+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
5560

5661
# Deployment job
5762
deploy:
@@ -61,6 +66,11 @@ jobs:
6166
runs-on: ubuntu-latest
6267
needs: build
6368
steps:
69+
- name: Harden Runner
70+
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
71+
with:
72+
egress-policy: audit
73+
6474
- name: Deploy to GitHub Pages
6575
id: deployment
66-
uses: actions/[email protected]
76+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

‎.github/workflows/permission_advisor.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,12 @@ jobs:
2121
advisor:
2222
runs-on: ubuntu-latest
2323
steps:
24-
- uses: GitHubSecurityLab/actions-permissions/[email protected]
24+
- name: Harden Runner
25+
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
26+
with:
27+
egress-policy: audit
28+
29+
- uses: GitHubSecurityLab/actions-permissions/advisor@babd69bc8d78e6cdece903dfdcfb72d4e1a4f00d # v1.0.2-beta5
2530
with:
2631
name: ${{ inputs.name }}
2732
count: ${{ inputs.count }}

‎.github/workflows/readme-checker.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,15 @@ jobs:
88
lint:
99
runs-on: ubuntu-latest
1010
steps:
11+
- name: Harden Runner
12+
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
13+
with:
14+
egress-policy: audit
15+
1116
- name: Checkout
12-
uses: actions/[email protected]
17+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1318
- name: Checking markdown
14-
uses: DavidAnson/[email protected]
19+
uses: DavidAnson/markdownlint-cli2-action@eb5ca3ab411449c66620fe7f1b3c9e10547144b0 # v18.0.0
1520
with:
1621
globs: |
1722
*.md

0 commit comments

Comments
 (0)