Skip to content

Commit ccaf12e

Browse files
stepsecurity-app[bot]stepsecurity-app[bot]
authored
[StepSecurity] Apply security best practices (#481)
Signed-off-by: StepSecurity Bot <[email protected]> Co-authored-by: stepsecurity-app[bot] <188008098+stepsecurity-app[bot]@users.noreply.github.com>
1 parent b10fc7a commit ccaf12e

File tree

2 files changed

+90
-39
lines changed

2 files changed

+90
-39
lines changed

‎.github/workflows/docker.yml‎

Lines changed: 63 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ env:
1515
RETH_IMAGE_NAME: node-reth
1616
NETHERMIND_IMAGE_NAME: node-nethermind
1717

18+
permissions:
19+
contents: read
20+
1821
jobs:
1922
geth:
2023
strategy:
@@ -26,30 +29,35 @@ jobs:
2629
runs-on: ubuntu-24.04-arm
2730
runs-on: ${{ matrix.settings.runs-on }}
2831
steps:
32+
- name: Harden the runner (Audit all outbound calls)
33+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
34+
with:
35+
egress-policy: audit
36+
2937
- name: Checkout
30-
uses: actions/checkout@v3
38+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
3139

3240
- name: Log into the Container registry
33-
uses: docker/login-action@v3
41+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
3442
with:
3543
registry: ${{ env.REGISTRY }}
3644
username: ${{ github.actor }}
3745
password: ${{ secrets.GITHUB_TOKEN }}
3846

3947
- name: Extract metadata for the Docker image
4048
id: meta
41-
uses: docker/metadata-action@v4
49+
uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0
4250
with:
4351
images: |
4452
${{ env.NAMESPACE }}/${{ env.GETH_DEPRECATED_IMAGE_NAME }}
4553
${{ env.NAMESPACE }}/${{ env.GETH_IMAGE_NAME }}
4654
4755
- name: Set up Docker Buildx
48-
uses: docker/setup-buildx-action@v3
56+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
4957

5058
- name: Build and push the Docker image
5159
id: build
52-
uses: docker/build-push-action@v6
60+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
5361
with:
5462
context: .
5563
file: geth/Dockerfile
@@ -70,7 +78,7 @@ jobs:
7078
echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
7179
7280
- name: Upload digest
73-
uses: actions/upload-artifact@v4
81+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7482
with:
7583
name: digests-geth-${{ env.PLATFORM_PAIR }}
7684
path: ${{ runner.temp }}/digests/*
@@ -88,29 +96,34 @@ jobs:
8896
features: jemalloc,optimism
8997
runs-on: ${{ matrix.settings.runs-on }}
9098
steps:
99+
- name: Harden the runner (Audit all outbound calls)
100+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
101+
with:
102+
egress-policy: audit
103+
91104
- name: Checkout
92-
uses: actions/checkout@v2
105+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
93106

94107
- name: Log into the Container registry
95-
uses: docker/login-action@v3
108+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
96109
with:
97110
registry: ${{ env.REGISTRY }}
98111
username: ${{ github.actor }}
99112
password: ${{ secrets.GITHUB_TOKEN }}
100113

101114
- name: Extract metadata for the Docker image
102115
id: meta
103-
uses: docker/metadata-action@v4
116+
uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0
104117
with:
105118
images: |
106119
${{ env.NAMESPACE }}/${{ env.RETH_IMAGE_NAME }}
107120
108121
- name: Set up Docker Buildx
109-
uses: docker/setup-buildx-action@v3
122+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
110123

111124
- name: Build and push the Docker image
112125
id: build
113-
uses: docker/build-push-action@v6
126+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
114127
with:
115128
context: .
116129
file: reth/Dockerfile
@@ -133,7 +146,7 @@ jobs:
133146
echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
134147
135148
- name: Upload digest
136-
uses: actions/upload-artifact@v4
149+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
137150
with:
138151
name: digests-reth-${{ env.PLATFORM_PAIR }}
139152
path: ${{ runner.temp }}/digests/*
@@ -150,29 +163,34 @@ jobs:
150163
runs-on: ubuntu-24.04-arm
151164
runs-on: ${{ matrix.settings.runs-on }}
152165
steps:
166+
- name: Harden the runner (Audit all outbound calls)
167+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
168+
with:
169+
egress-policy: audit
170+
153171
- name: Checkout
154-
uses: actions/checkout@v2
172+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
155173

156174
- name: Log into the Container registry
157-
uses: docker/login-action@v3
175+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
158176
with:
159177
registry: ${{ env.REGISTRY }}
160178
username: ${{ github.actor }}
161179
password: ${{ secrets.GITHUB_TOKEN }}
162180

163181
- name: Set up Docker Buildx
164-
uses: docker/setup-buildx-action@v3
182+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
165183

166184
- name: Extract metadata for the Docker image
167185
id: meta
168-
uses: docker/metadata-action@v4
186+
uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0
169187
with:
170188
images: |
171189
${{ env.NAMESPACE }}/${{ env.NETHERMIND_IMAGE_NAME }}
172190
173191
- name: Build and push the Docker image
174192
id: build
175-
uses: docker/build-push-action@v6
193+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
176194
with:
177195
context: .
178196
file: nethermind/Dockerfile
@@ -193,7 +211,7 @@ jobs:
193211
echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
194212
195213
- name: Upload digest
196-
uses: actions/upload-artifact@v4
214+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
197215
with:
198216
name: digests-nethermind-${{ env.PLATFORM_PAIR }}
199217
path: ${{ runner.temp }}/digests/*
@@ -206,26 +224,31 @@ jobs:
206224
needs:
207225
- geth
208226
steps:
227+
- name: Harden the runner (Audit all outbound calls)
228+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
229+
with:
230+
egress-policy: audit
231+
209232
- name: Download digests
210-
uses: actions/download-artifact@v4
233+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
211234
with:
212235
path: ${{ runner.temp }}/digests
213236
pattern: digests-geth-*
214237
merge-multiple: true
215238

216239
- name: Log into the Container registry
217-
uses: docker/login-action@v3
240+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
218241
with:
219242
registry: ${{ env.REGISTRY }}
220243
username: ${{ github.actor }}
221244
password: ${{ secrets.GITHUB_TOKEN }}
222245

223246
- name: Set up Docker Buildx
224-
uses: docker/setup-buildx-action@v3
247+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
225248

226249
- name: Extract metadata for the Docker image
227250
id: meta
228-
uses: docker/metadata-action@v5
251+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
229252
with:
230253
images: |
231254
${{ env.NAMESPACE }}/${{ env.GETH_DEPRECATED_IMAGE_NAME }}
@@ -249,26 +272,31 @@ jobs:
249272
needs:
250273
- reth
251274
steps:
275+
- name: Harden the runner (Audit all outbound calls)
276+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
277+
with:
278+
egress-policy: audit
279+
252280
- name: Download digests
253-
uses: actions/download-artifact@v4
281+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
254282
with:
255283
path: ${{ runner.temp }}/digests
256284
pattern: digests-reth-*
257285
merge-multiple: true
258286

259287
- name: Log into the Container registry
260-
uses: docker/login-action@v3
288+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
261289
with:
262290
registry: ${{ env.REGISTRY }}
263291
username: ${{ github.actor }}
264292
password: ${{ secrets.GITHUB_TOKEN }}
265293

266294
- name: Set up Docker Buildx
267-
uses: docker/setup-buildx-action@v3
295+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
268296

269297
- name: Extract metadata for the Docker image
270298
id: meta
271-
uses: docker/metadata-action@v5
299+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
272300
with:
273301
images: |
274302
${{ env.NAMESPACE }}/${{ env.RETH_IMAGE_NAME }}
@@ -288,26 +316,31 @@ jobs:
288316
needs:
289317
- nethermind
290318
steps:
319+
- name: Harden the runner (Audit all outbound calls)
320+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
321+
with:
322+
egress-policy: audit
323+
291324
- name: Download digests
292-
uses: actions/download-artifact@v4
325+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
293326
with:
294327
path: ${{ runner.temp }}/digests
295328
pattern: digests-nethermind-*
296329
merge-multiple: true
297330

298331
- name: Log into the Container registry
299-
uses: docker/login-action@v3
332+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
300333
with:
301334
registry: ${{ env.REGISTRY }}
302335
username: ${{ github.actor }}
303336
password: ${{ secrets.GITHUB_TOKEN }}
304337

305338
- name: Set up Docker Buildx
306-
uses: docker/setup-buildx-action@v3
339+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
307340

308341
- name: Extract metadata for the Docker image
309342
id: meta
310-
uses: docker/metadata-action@v5
343+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
311344
with:
312345
images: |
313346
${{ env.NAMESPACE }}/${{ env.NETHERMIND_IMAGE_NAME }}

‎.github/workflows/pr.yml‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ on:
44
pull_request:
55
workflow_dispatch:
66

7+
permissions:
8+
contents: read
9+
710
jobs:
811
geth:
912
strategy:
@@ -15,16 +18,21 @@ jobs:
1518
runs-on: ubuntu-24.04-arm
1619
runs-on: ${{ matrix.settings.runs-on }}
1720
steps:
21+
- name: Harden the runner (Audit all outbound calls)
22+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
23+
with:
24+
egress-policy: audit
25+
1826
- name: Checkout
19-
uses: actions/checkout@v3
27+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
2028
with:
2129
ref: ${{ github.event.pull_request.head.sha }}
2230

2331
- name: Set up Docker Buildx
24-
uses: docker/setup-buildx-action@v3
32+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
2533

2634
- name: Build the Docker image
27-
uses: docker/build-push-action@v6
35+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
2836
with:
2937
context: .
3038
file: geth/Dockerfile
@@ -43,14 +51,19 @@ jobs:
4351
features: jemalloc,optimism
4452
runs-on: ${{ matrix.settings.runs-on}}
4553
steps:
54+
- name: Harden the runner (Audit all outbound calls)
55+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
56+
with:
57+
egress-policy: audit
58+
4659
- name: Checkout
47-
uses: actions/checkout@v3
60+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
4861
with:
4962
ref: ${{ github.event.pull_request.head.sha }}
5063
- name: Set up Docker Buildx
51-
uses: docker/setup-buildx-action@v3
64+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
5265
- name: Build the Docker image
53-
uses: docker/build-push-action@v6
66+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
5467
with:
5568
context: .
5669
file: reth/Dockerfile
@@ -69,14 +82,19 @@ jobs:
6982
runs-on: ubuntu-24.04-arm
7083
runs-on: ${{ matrix.settings.runs-on}}
7184
steps:
85+
- name: Harden the runner (Audit all outbound calls)
86+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
87+
with:
88+
egress-policy: audit
89+
7290
- name: Checkout
73-
uses: actions/checkout@v3
91+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
7492
with:
7593
ref: ${{ github.event.pull_request.head.sha }}
7694
- name: Set up Docker Buildx
77-
uses: docker/setup-buildx-action@v3
95+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
7896
- name: Build the Docker image
79-
uses: docker/build-push-action@v6
97+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
8098
with:
8199
context: .
82100
file: nethermind/Dockerfile

0 commit comments

Comments
 (0)