Skip to content

Commit 1bb621c

Browse files
SteveDesmond-caSteveDesmond-ca
committed
Prevent credential leaks in GitHub Actions workflows
1 parent e80fb94 commit 1bb621c

File tree

4 files changed

+135
-129
lines changed

4 files changed

+135
-129
lines changed

‎.github/workflows/CI.yml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,25 @@
11
name: CI
2-
on: [ push, pull_request ]
2+
on: [push, pull_request]
33

44
jobs:
55
Build:
66
runs-on: ubuntu-latest
77

88
steps:
9-
- uses: actions/checkout@v4
9+
- uses: actions/checkout@v4
10+
with:
11+
persist-credentials: false
1012

11-
- name: Setup .NET
12-
uses: actions/setup-dotnet@v4
13-
with:
14-
dotnet-version: 10.0.x
13+
- name: Setup .NET
14+
uses: actions/setup-dotnet@v4
15+
with:
16+
dotnet-version: 10.0.x
1517

16-
- name: Restore
17-
run: dotnet restore
18+
- name: Restore
19+
run: dotnet restore
1820

19-
- name: Build
20-
run: dotnet build --no-restore
21+
- name: Build
22+
run: dotnet build --no-restore
2123

22-
- name: Test
23-
run: dotnet test --no-build
24+
- name: Test
25+
run: dotnet test --no-build

‎.github/workflows/CodeQL.yml‎

Lines changed: 35 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,12 @@ name: "CodeQL"
1313

1414
on:
1515
push:
16-
branches: [ main ]
16+
branches: [main]
1717
pull_request:
1818
# The branches below must be a subset of the branches above
19-
branches: [ main ]
19+
branches: [main]
2020
schedule:
21-
- cron: '45 7 * * *'
21+
- cron: "45 7 * * *"
2222

2323
jobs:
2424
analyze:
@@ -32,44 +32,46 @@ jobs:
3232
strategy:
3333
fail-fast: false
3434
matrix:
35-
language: [ 'csharp' ]
35+
language: ["csharp"]
3636
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
3737
# Learn more about CodeQL language support at https://git.io/codeql-language-support
3838

3939
steps:
40-
- name: Checkout repository
41-
uses: actions/checkout@v4
40+
- name: Checkout repository
41+
uses: actions/checkout@v4
42+
with:
43+
persist-credentials: false
4244

43-
# Initializes the CodeQL tools for scanning.
44-
- name: Initialize CodeQL
45-
uses: github/codeql-action/init@v3
46-
with:
47-
languages: ${{ matrix.language }}
48-
# If you wish to specify custom queries, you can do so here or in a config file.
49-
# By default, queries listed here will override any specified in a config file.
50-
# Prefix the list here with "+" to use these queries and those in the config file.
51-
# queries: ./path/to/local/query, your-org/your-repo/queries@main
45+
# Initializes the CodeQL tools for scanning.
46+
- name: Initialize CodeQL
47+
uses: github/codeql-action/init@v3
48+
with:
49+
languages: ${{ matrix.language }}
50+
# If you wish to specify custom queries, you can do so here or in a config file.
51+
# By default, queries listed here will override any specified in a config file.
52+
# Prefix the list here with "+" to use these queries and those in the config file.
53+
# queries: ./path/to/local/query, your-org/your-repo/queries@main
5254

53-
- name: Setup .NET
54-
uses: actions/setup-dotnet@v4
55-
with:
56-
dotnet-version: 10.0.x
55+
- name: Setup .NET
56+
uses: actions/setup-dotnet@v4
57+
with:
58+
dotnet-version: 10.0.x
5759

58-
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
59-
# If this step fails, then you should remove it and run the build manually (see below)
60-
- name: Autobuild
61-
uses: github/codeql-action/autobuild@v3
60+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
61+
# If this step fails, then you should remove it and run the build manually (see below)
62+
- name: Autobuild
63+
uses: github/codeql-action/autobuild@v3
6264

63-
# ℹ️ Command-line programs to run using the OS shell.
64-
# 📚 https://git.io/JvXDl
65+
# ℹ️ Command-line programs to run using the OS shell.
66+
# 📚 https://git.io/JvXDl
6567

66-
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
67-
# and modify them (or add more) to build your code if your project
68-
# uses a compiled language
68+
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
69+
# and modify them (or add more) to build your code if your project
70+
# uses a compiled language
6971

70-
#- run: |
71-
# make bootstrap
72-
# make release
72+
#- run: |
73+
# make bootstrap
74+
# make release
7375

74-
- name: Perform CodeQL Analysis
75-
uses: github/codeql-action/analyze@v3
76+
- name: Perform CodeQL Analysis
77+
uses: github/codeql-action/analyze@v3

‎.github/workflows/Release.yml‎

Lines changed: 42 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: Release
22
on:
33
push:
44
tags:
5-
- '*'
5+
- "*"
66

77
defaults:
88
run:
@@ -17,43 +17,44 @@ jobs:
1717
targets: linux-x64 linux-arm64 linux-arm osx-x64 osx-arm64 win-x64 win-arm64
1818

1919
steps:
20-
- uses: actions/checkout@v4
21-
with:
22-
ref: ${{ github.ref }}
23-
24-
- uses: actions/setup-dotnet@v4
25-
with:
26-
dotnet-version: 10.0.x
27-
28-
- name: Run tests
29-
run: dotnet test
30-
31-
- name: Publish binaries
32-
run: |
33-
for target in $targets
34-
do
35-
dotnet publish src -c Release -r $target -o publish/$target -p:PublishTrimmed=true,PublishReadyToRun=true,PublishReadyToRunComposite=true,PublishSingleFile=true,TieredCompilation=false
36-
done
37-
38-
- name: Create release files
39-
working-directory: publish
40-
run: |
41-
for target in $targets
42-
do
43-
cd $target
44-
zip -9 ../LoadTestToolbox_$(echo ${{ github.ref }} | sed 's/refs\/tags\///')_$target.zip *
45-
cd ..
46-
done
47-
48-
- name: Create release
49-
uses: softprops/action-gh-release@v2.5.0
50-
with:
51-
files: publish/LoadTestToolbox_*.zip
52-
53-
- name: Build NuGet Package
54-
run: dotnet pack -c Release -p:ContinuousIntegrationBuild=true
55-
56-
- name: Push NuGet Package
57-
run: dotnet nuget push src/bin/Release/LoadTestToolbox.$(echo ${{ github.ref }} | sed 's/refs\/tags\///').nupkg -k $NUGET_TOKEN -s https://api.nuget.org/v3/index.json
58-
env:
59-
NUGET_TOKEN: ${{secrets.NUGET_TOKEN}}
20+
- uses: actions/checkout@v4
21+
with:
22+
persist-credentials: false
23+
ref: ${{ github.ref }}
24+
25+
- uses: actions/setup-dotnet@v4
26+
with:
27+
dotnet-version: 10.0.x
28+
29+
- name: Run tests
30+
run: dotnet test
31+
32+
- name: Publish binaries
33+
run: |
34+
for target in $targets
35+
do
36+
dotnet publish src -c Release -r $target -o publish/$target -p:PublishTrimmed=true,PublishReadyToRun=true,PublishReadyToRunComposite=true,PublishSingleFile=true,TieredCompilation=false
37+
done
38+
39+
- name: Create release files
40+
working-directory: publish
41+
run: |
42+
for target in $targets
43+
do
44+
cd $target
45+
zip -9 ../LoadTestToolbox_$(echo ${{ github.ref }} | sed 's/refs\/tags\///')_$target.zip *
46+
cd ..
47+
done
48+
49+
- name: Create release
50+
uses: softprops/action-gh-release@v2.5.0
51+
with:
52+
files: publish/LoadTestToolbox_*.zip
53+
54+
- name: Build NuGet Package
55+
run: dotnet pack -c Release -p:ContinuousIntegrationBuild=true
56+
57+
- name: Push NuGet Package
58+
run: dotnet nuget push src/bin/Release/LoadTestToolbox.$(echo ${{ github.ref }} | sed 's/refs\/tags\///').nupkg -k $NUGET_TOKEN -s https://api.nuget.org/v3/index.json
59+
env:
60+
NUGET_TOKEN: ${{secrets.NUGET_TOKEN}}

‎.github/workflows/Sonar.yml‎

Lines changed: 44 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -7,46 +7,47 @@ jobs:
77
if: github.actor != 'dependabot[bot]'
88

99
steps:
10-
- name: Checkout code
11-
uses: actions/checkout@v4
12-
with:
13-
fetch-depth: 0
14-
15-
- name: Setup .NET
16-
uses: actions/setup-dotnet@v4
17-
with:
18-
dotnet-version: 10.0.x
19-
20-
- name: Install Java
21-
uses: actions/setup-java@v4
22-
with:
23-
distribution: microsoft
24-
java-version: 21
25-
26-
- name: Install Sonar Scanner
27-
run: dotnet tool install --global dotnet-sonarscanner
28-
29-
- name: Install dependencies
30-
run: dotnet restore
31-
32-
- name: Start Sonar Analysis
33-
run: dotnet-sonarscanner begin /d:sonar.host.url="https://sonarcloud.io" /d:sonar.token="$SONAR_TOKEN" /o:"ecoapm" /k:"ecoAPM_LoadTestToolbox" /d:sonar.cs.vstest.reportsPaths="test/TestResults/results.trx" /d:sonar.cs.opencover.reportsPaths="test/TestResults/coverage.opencover.xml"
34-
env:
35-
SONAR_TOKEN: ${{secrets.SONAR_TOKEN}}
36-
37-
- name: Build
38-
run: dotnet build --no-restore
39-
env:
40-
SONAR_DOTNET_ENABLE_CONCURRENT_EXECUTION: true
41-
42-
- name: Test
43-
run: dotnet test --no-build --logger "trx;LogFileName=results.trx" --collect:"XPlat Code Coverage" -- DataCollectionRunSettings.DataCollectors.DataCollector.Configuration.Format=opencover
44-
45-
- name: Move Code Coverage
46-
run: mv test/TestResults/**/*.xml test/TestResults
47-
48-
- name: Finish Sonar Analysis
49-
run: dotnet-sonarscanner end /d:sonar.token="$SONAR_TOKEN"
50-
env:
51-
SONAR_TOKEN: ${{secrets.SONAR_TOKEN}}
52-
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
10+
- name: Checkout code
11+
uses: actions/checkout@v4
12+
with:
13+
persist-credentials: false
14+
fetch-depth: 0
15+
16+
- name: Setup .NET
17+
uses: actions/setup-dotnet@v4
18+
with:
19+
dotnet-version: 10.0.x
20+
21+
- name: Install Java
22+
uses: actions/setup-java@v4
23+
with:
24+
distribution: microsoft
25+
java-version: 21
26+
27+
- name: Install Sonar Scanner
28+
run: dotnet tool install --global dotnet-sonarscanner
29+
30+
- name: Install dependencies
31+
run: dotnet restore
32+
33+
- name: Start Sonar Analysis
34+
run: dotnet-sonarscanner begin /d:sonar.host.url="https://sonarcloud.io" /d:sonar.token="$SONAR_TOKEN" /o:"ecoapm" /k:"ecoAPM_LoadTestToolbox" /d:sonar.cs.vstest.reportsPaths="test/TestResults/results.trx" /d:sonar.cs.opencover.reportsPaths="test/TestResults/coverage.opencover.xml"
35+
env:
36+
SONAR_TOKEN: ${{secrets.SONAR_TOKEN}}
37+
38+
- name: Build
39+
run: dotnet build --no-restore
40+
env:
41+
SONAR_DOTNET_ENABLE_CONCURRENT_EXECUTION: true
42+
43+
- name: Test
44+
run: dotnet test --no-build --logger "trx;LogFileName=results.trx" --collect:"XPlat Code Coverage" -- DataCollectionRunSettings.DataCollectors.DataCollector.Configuration.Format=opencover
45+
46+
- name: Move Code Coverage
47+
run: mv test/TestResults/**/*.xml test/TestResults
48+
49+
- name: Finish Sonar Analysis
50+
run: dotnet-sonarscanner end /d:sonar.token="$SONAR_TOKEN"
51+
env:
52+
SONAR_TOKEN: ${{secrets.SONAR_TOKEN}}
53+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

0 commit comments

Comments
 (0)