Skip to content

Commit 684a5bc

Browse files
SteveDesmond-caSteveDesmond-ca
committed
Prevent credential leaks in GitHub Actions workflows
1 parent 356ab21 commit 684a5bc

File tree

4 files changed

+80
-75
lines changed

4 files changed

+80
-75
lines changed

‎.github/workflows/CI.yml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,25 @@
11
name: CI
2-
on: [ push, pull_request ]
2+
on: [push, pull_request]
33

44
jobs:
55
Build:
66
runs-on: ubuntu-latest
77

88
steps:
9-
- uses: actions/checkout@v4
9+
- uses: actions/checkout@v4
10+
with:
11+
persist-credentials: false
1012

11-
- name: Setup .NET
12-
uses: actions/setup-dotnet@v4
13-
with:
14-
dotnet-version: 10.0.x
13+
- name: Setup .NET
14+
uses: actions/setup-dotnet@v4
15+
with:
16+
dotnet-version: 10.0.x
1517

16-
- name: Restore
17-
run: dotnet restore
18+
- name: Restore
19+
run: dotnet restore
1820

19-
- name: Build
20-
run: dotnet build --no-restore
21+
- name: Build
22+
run: dotnet build --no-restore
2123

22-
- name: Test
23-
run: dotnet test --no-build --verbosity normal
24+
- name: Test
25+
run: dotnet test --no-build --verbosity normal

‎.github/workflows/CodeQL.yml‎

Lines changed: 35 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,12 @@ name: "CodeQL"
1313

1414
on:
1515
push:
16-
branches: [ main ]
16+
branches: [main]
1717
pull_request:
1818
# The branches below must be a subset of the branches above
19-
branches: [ main ]
19+
branches: [main]
2020
schedule:
21-
- cron: '45 7 * * *'
21+
- cron: "45 7 * * *"
2222

2323
jobs:
2424
analyze:
@@ -32,44 +32,46 @@ jobs:
3232
strategy:
3333
fail-fast: false
3434
matrix:
35-
language: [ 'csharp' ]
35+
language: ["csharp"]
3636
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
3737
# Learn more about CodeQL language support at https://git.io/codeql-language-support
3838

3939
steps:
40-
- name: Checkout repository
41-
uses: actions/checkout@v4
40+
- name: Checkout repository
41+
uses: actions/checkout@v4
42+
with:
43+
persist-credentials: false
4244

43-
# Initializes the CodeQL tools for scanning.
44-
- name: Initialize CodeQL
45-
uses: github/codeql-action/init@v3
46-
with:
47-
languages: ${{ matrix.language }}
48-
# If you wish to specify custom queries, you can do so here or in a config file.
49-
# By default, queries listed here will override any specified in a config file.
50-
# Prefix the list here with "+" to use these queries and those in the config file.
51-
# queries: ./path/to/local/query, your-org/your-repo/queries@main
45+
# Initializes the CodeQL tools for scanning.
46+
- name: Initialize CodeQL
47+
uses: github/codeql-action/init@v3
48+
with:
49+
languages: ${{ matrix.language }}
50+
# If you wish to specify custom queries, you can do so here or in a config file.
51+
# By default, queries listed here will override any specified in a config file.
52+
# Prefix the list here with "+" to use these queries and those in the config file.
53+
# queries: ./path/to/local/query, your-org/your-repo/queries@main
5254

53-
- name: Setup .NET
54-
uses: actions/setup-dotnet@v4
55-
with:
56-
dotnet-version: 10.0.x
55+
- name: Setup .NET
56+
uses: actions/setup-dotnet@v4
57+
with:
58+
dotnet-version: 10.0.x
5759

58-
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
59-
# If this step fails, then you should remove it and run the build manually (see below)
60-
- name: Autobuild
61-
uses: github/codeql-action/autobuild@v3
60+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
61+
# If this step fails, then you should remove it and run the build manually (see below)
62+
- name: Autobuild
63+
uses: github/codeql-action/autobuild@v3
6264

63-
# ℹ️ Command-line programs to run using the OS shell.
64-
# 📚 https://git.io/JvXDl
65+
# ℹ️ Command-line programs to run using the OS shell.
66+
# 📚 https://git.io/JvXDl
6567

66-
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
67-
# and modify them (or add more) to build your code if your project
68-
# uses a compiled language
68+
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
69+
# and modify them (or add more) to build your code if your project
70+
# uses a compiled language
6971

70-
#- run: |
71-
# make bootstrap
72-
# make release
72+
#- run: |
73+
# make bootstrap
74+
# make release
7375

74-
- name: Perform CodeQL Analysis
75-
uses: github/codeql-action/analyze@v3
76+
- name: Perform CodeQL Analysis
77+
uses: github/codeql-action/analyze@v3

‎.github/workflows/Results.yml‎

Lines changed: 28 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,36 @@
11
name: Results
22

3-
on:
4-
push
3+
on: push
54

65
jobs:
76
Publish:
87
runs-on: ubuntu-latest
98

109
steps:
11-
- uses: actions/checkout@v4
12-
13-
- name: Setup .NET
14-
uses: actions/setup-dotnet@v4
15-
with:
16-
dotnet-version: 10.0.x
17-
18-
- name: Build benchmarks
19-
run: dotnet publish -c Release
20-
21-
- name: Run benchmarks
22-
run: dotnet BenchmarkMockNet.dll
23-
working-directory: BenchmarkMockNet/bin/Release/net10.0/publish
24-
25-
- name: Upload results report
26-
uses: actions/upload-artifact@v4
27-
with:
28-
name: Results Report
29-
path: BenchmarkMockNet/bin/Release/net10.0/publish/Results.md
30-
31-
- name: Upload raw results
32-
uses: actions/upload-artifact@v4
33-
with:
34-
name: Raw Results
35-
path: BenchmarkMockNet/bin/Release/net10.0/publish/BenchmarkDotNet.Artifacts/results/*.md
10+
- uses: actions/checkout@v4
11+
with:
12+
persist-credentials: false
13+
14+
- name: Setup .NET
15+
uses: actions/setup-dotnet@v4
16+
with:
17+
dotnet-version: 10.0.x
18+
19+
- name: Build benchmarks
20+
run: dotnet publish -c Release
21+
22+
- name: Run benchmarks
23+
run: dotnet BenchmarkMockNet.dll
24+
working-directory: BenchmarkMockNet/bin/Release/net10.0/publish
25+
26+
- name: Upload results report
27+
uses: actions/upload-artifact@v4
28+
with:
29+
name: Results Report
30+
path: BenchmarkMockNet/bin/Release/net10.0/publish/Results.md
31+
32+
- name: Upload raw results
33+
uses: actions/upload-artifact@v4
34+
with:
35+
name: Raw Results
36+
path: BenchmarkMockNet/bin/Release/net10.0/publish/BenchmarkDotNet.Artifacts/results/*.md

‎.github/workflows/Sonar.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
name: Sonar
22

3-
on:
4-
push
3+
on: push
54

65
jobs:
76
Code-Quality:
@@ -12,6 +11,7 @@ jobs:
1211
- name: Checkout code
1312
uses: actions/checkout@v4
1413
with:
14+
persist-credentials: false
1515
fetch-depth: 0
1616

1717
- name: Setup .NET
@@ -51,4 +51,4 @@ jobs:
5151
run: dotnet-sonarscanner end /d:sonar.token="$SONAR_TOKEN"
5252
env:
5353
SONAR_TOKEN: ${{secrets.SONAR_TOKEN}}
54-
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
54+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

0 commit comments

Comments
 (0)