Skip to content

Commit c44c3eb

Browse files
stepsecurity-app[bot]stepsecurity-app[bot]
authored
[StepSecurity] Apply security best practices (#14)
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: stepsecurity-app[bot] <188008098+stepsecurity-app[bot]@users.noreply.github.com>
1 parent dadc4ee commit c44c3eb

File tree

5 files changed

+106
-41
lines changed

5 files changed

+106
-41
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 65 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,16 @@ jobs:
2828
name: Formatting
2929
runs-on: ubuntu-latest
3030
steps:
31+
- name: Harden the runner (Audit all outbound calls)
32+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
33+
with:
34+
egress-policy: audit
35+
3136
- name: Checkout code
32-
uses: actions/checkout@v6
37+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
3338

3439
- name: Install Rust nightly toolchain
35-
uses: dtolnay/rust-toolchain@nightly
40+
uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # nightly
3641
with:
3742
components: rustfmt
3843

@@ -44,11 +49,16 @@ jobs:
4449
name: Clippy
4550
runs-on: ubuntu-latest
4651
steps:
52+
- name: Harden the runner (Audit all outbound calls)
53+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
54+
with:
55+
egress-policy: audit
56+
4757
- name: Checkout code
48-
uses: actions/checkout@v6
58+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
4959

5060
- name: Install Rust toolchain
51-
uses: dtolnay/rust-toolchain@stable
61+
uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
5262
with:
5363
components: clippy
5464

@@ -59,7 +69,7 @@ jobs:
5969
protoc --version
6070
6171
- name: Cache Rust dependencies
62-
uses: Swatinem/rust-cache@v2
72+
uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
6373
with:
6474
shared-key: clippy
6575

@@ -80,11 +90,16 @@ jobs:
8090
matrix:
8191
msrv: ["1.88"]
8292
steps:
93+
- name: Harden the runner (Audit all outbound calls)
94+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
95+
with:
96+
egress-policy: audit
97+
8398
- name: Checkout code
84-
uses: actions/checkout@v6
99+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
85100

86101
- name: Install Rust ${{ matrix.msrv }}
87-
uses: dtolnay/rust-toolchain@master
102+
uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
88103
with:
89104
toolchain: ${{ matrix.msrv }}
90105

@@ -94,7 +109,7 @@ jobs:
94109
sudo apt-get install -y -qq protobuf-compiler
95110
96111
- name: Cache Rust dependencies
97-
uses: Swatinem/rust-cache@v2
112+
uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
98113
with:
99114
shared-key: msrv-${{ matrix.msrv }}
100115

@@ -111,11 +126,16 @@ jobs:
111126
matrix:
112127
os: [ubuntu-latest, macos-latest, windows-latest]
113128
steps:
129+
- name: Harden the runner (Audit all outbound calls)
130+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
131+
with:
132+
egress-policy: audit
133+
114134
- name: Checkout code
115-
uses: actions/checkout@v6
135+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
116136

117137
- name: Install Rust toolchain
118-
uses: dtolnay/rust-toolchain@stable
138+
uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
119139

120140
- name: Install protobuf compiler (Linux)
121141
if: runner.os == 'Linux'
@@ -137,7 +157,7 @@ jobs:
137157
protoc --version
138158
139159
- name: Cache Rust dependencies
140-
uses: Swatinem/rust-cache@v2
160+
uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
141161
with:
142162
shared-key: test-${{ matrix.os }}
143163

@@ -156,19 +176,24 @@ jobs:
156176
needs: [fmt, clippy]
157177
runs-on: ubuntu-latest
158178
steps:
179+
- name: Harden the runner (Audit all outbound calls)
180+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
181+
with:
182+
egress-policy: audit
183+
159184
- name: Checkout code
160-
uses: actions/checkout@v6
185+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
161186

162187
- name: Install Rust toolchain
163-
uses: dtolnay/rust-toolchain@stable
188+
uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
164189

165190
- name: Install protobuf compiler
166191
run: |
167192
sudo apt-get update -qq
168193
sudo apt-get install -y -qq protobuf-compiler
169194
170195
- name: Cache Rust dependencies
171-
uses: Swatinem/rust-cache@v2
196+
uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
172197
with:
173198
shared-key: features
174199

@@ -207,10 +232,10 @@ jobs:
207232
egress-policy: audit
208233

209234
- name: Checkout code
210-
uses: actions/checkout@v6
235+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
211236

212237
- name: Install Rust toolchain
213-
uses: dtolnay/rust-toolchain@stable
238+
uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
214239
with:
215240
components: llvm-tools-preview
216241

@@ -220,12 +245,12 @@ jobs:
220245
sudo apt-get install -y -qq protobuf-compiler
221246
222247
- name: Install cargo-llvm-cov
223-
uses: taiki-e/install-action@v2
248+
uses: taiki-e/install-action@dfcb1ee29051d97c8d0f2d437199570008fd5612 # v2.65.15
224249
with:
225250
tool: cargo-llvm-cov
226251

227252
- name: Cache Rust dependencies
228-
uses: Swatinem/rust-cache@v2
253+
uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
229254
with:
230255
shared-key: coverage
231256

@@ -237,7 +262,7 @@ jobs:
237262
--output-path codecov.json
238263
239264
- name: Upload coverage to Codecov
240-
uses: codecov/codecov-action@v5
265+
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
241266
with:
242267
files: ./codecov.json
243268
fail_ci_if_error: false
@@ -248,19 +273,24 @@ jobs:
248273
name: Documentation
249274
runs-on: ubuntu-latest
250275
steps:
276+
- name: Harden the runner (Audit all outbound calls)
277+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
278+
with:
279+
egress-policy: audit
280+
251281
- name: Checkout code
252-
uses: actions/checkout@v6
282+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
253283

254284
- name: Install Rust nightly toolchain
255-
uses: dtolnay/rust-toolchain@nightly
285+
uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # nightly
256286

257287
- name: Install protobuf compiler
258288
run: |
259289
sudo apt-get update -qq
260290
sudo apt-get install -y -qq protobuf-compiler
261291
262292
- name: Cache Rust dependencies
263-
uses: Swatinem/rust-cache@v2
293+
uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
264294
with:
265295
shared-key: docs
266296

@@ -274,19 +304,24 @@ jobs:
274304
name: Examples
275305
runs-on: ubuntu-latest
276306
steps:
307+
- name: Harden the runner (Audit all outbound calls)
308+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
309+
with:
310+
egress-policy: audit
311+
277312
- name: Checkout code
278-
uses: actions/checkout@v6
313+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
279314

280315
- name: Install Rust toolchain
281-
uses: dtolnay/rust-toolchain@stable
316+
uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
282317

283318
- name: Install protobuf compiler
284319
run: |
285320
sudo apt-get update -qq
286321
sudo apt-get install -y -qq protobuf-compiler
287322
288323
- name: Cache Rust dependencies
289-
uses: Swatinem/rust-cache@v2
324+
uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
290325
with:
291326
shared-key: examples
292327

@@ -300,6 +335,11 @@ jobs:
300335
runs-on: ubuntu-latest
301336
if: always()
302337
steps:
338+
- name: Harden the runner (Audit all outbound calls)
339+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
340+
with:
341+
egress-policy: audit
342+
303343
- name: Check all jobs
304344
env:
305345
FMT_RESULT: ${{ needs.fmt.result }}

‎.github/workflows/codeql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939

4040
- name: Check for changes
4141
id: filter
42-
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
42+
uses: step-security/paths-filter@6eee183b0d2fd101d3f8ee2935c127bca14c5625 # v3.0.5
4343
with:
4444
filters: |
4545
rust:

‎.github/workflows/labeler.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,16 @@ jobs:
1414
label:
1515
runs-on: ubuntu-latest
1616
steps:
17+
- name: Harden the runner (Audit all outbound calls)
18+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
19+
with:
20+
egress-policy: audit
21+
1722
- name: Checkout code
18-
uses: actions/checkout@v6
23+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
1924

2025
- name: Apply labels
21-
uses: actions/labeler@v6
26+
uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
2227
with:
2328
repo-token: ${{ secrets.GITHUB_TOKEN }}
2429
configuration-path: .github/labeler.yml

‎.github/workflows/release.yml‎

Lines changed: 32 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,13 @@ jobs:
3131
outputs:
3232
version: ${{ steps.get_version.outputs.version }}
3333
steps:
34+
- name: Harden the runner (Audit all outbound calls)
35+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
36+
with:
37+
egress-policy: audit
38+
3439
- name: Checkout code
35-
uses: actions/checkout@v6
40+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
3641

3742
- name: Get version from tag
3843
id: get_version
@@ -48,7 +53,7 @@ jobs:
4853
fi
4954
5055
- name: Install Rust toolchain
51-
uses: dtolnay/rust-toolchain@stable
56+
uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
5257

5358
- name: Install protobuf compiler
5459
run: |
@@ -84,11 +89,16 @@ jobs:
8489
permissions:
8590
contents: write
8691
steps:
92+
- name: Harden the runner (Audit all outbound calls)
93+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
94+
with:
95+
egress-policy: audit
96+
8797
- name: Checkout code
88-
uses: actions/checkout@v6
98+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
8999

90100
- name: Create Release
91-
uses: softprops/action-gh-release@v2
101+
uses: step-security/action-gh-release@5f6a6ab53a5a2c000ff3a16fad038291e5b97ce7 # v2.4.2
92102
with:
93103
tag_name: ${{ needs.validate.outputs.version }}
94104
name: ${{ needs.validate.outputs.version }}
@@ -104,23 +114,28 @@ jobs:
104114
environment: release
105115
if: github.event.inputs.dry_run != 'true'
106116
steps:
117+
- name: Harden the runner (Audit all outbound calls)
118+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
119+
with:
120+
egress-policy: audit
121+
107122
- name: Checkout code
108-
uses: actions/checkout@v6
123+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
109124

110125
- name: Install Rust toolchain
111-
uses: dtolnay/rust-toolchain@stable
126+
uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
112127

113128
- name: Install protobuf compiler
114129
run: |
115130
sudo apt-get update -qq
116131
sudo apt-get install -y -qq protobuf-compiler
117132
118133
- name: Cache Rust dependencies
119-
uses: Swatinem/rust-cache@v2
134+
uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
120135

121136
# Use OIDC-based trusted publishing
122137
- name: Authenticate with crates.io
123-
uses: rust-lang/crates-io-auth-action@v1
138+
uses: rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec # v1.0.3
124139
id: auth
125140

126141
# Publish inferadb-derive first (if it exists and is a dependency)
@@ -151,19 +166,24 @@ jobs:
151166
permissions:
152167
contents: write
153168
steps:
169+
- name: Harden the runner (Audit all outbound calls)
170+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
171+
with:
172+
egress-policy: audit
173+
154174
- name: Checkout code
155-
uses: actions/checkout@v6
175+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
156176

157177
- name: Install Rust toolchain
158-
uses: dtolnay/rust-toolchain@nightly
178+
uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # nightly
159179

160180
- name: Install protobuf compiler
161181
run: |
162182
sudo apt-get update -qq
163183
sudo apt-get install -y -qq protobuf-compiler
164184
165185
- name: Cache Rust dependencies
166-
uses: Swatinem/rust-cache@v2
186+
uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2
167187

168188
- name: Build documentation
169189
env:
@@ -175,7 +195,7 @@ jobs:
175195
echo '<meta http-equiv="refresh" content="0; url=inferadb">' > target/doc/index.html
176196
177197
- name: Upload documentation artifact
178-
uses: actions/upload-artifact@v6
198+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
179199
with:
180200
name: documentation
181201
path: target/doc

‎.github/workflows/security.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
3030

3131
- name: Check for dependency changes
32-
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
32+
uses: step-security/paths-filter@6eee183b0d2fd101d3f8ee2935c127bca14c5625 # v3.0.5
3333
id: filter
3434
with:
3535
filters: |

0 commit comments

Comments
 (0)