Skip to content

Commit e2ea363

Browse files
step-security-botstep-security-bot
authored
[StepSecurity] Apply security best practices (#214)
* [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot <[email protected]>
1 parent b0de26f commit e2ea363

File tree

8 files changed

+524
-5
lines changed

8 files changed

+524
-5
lines changed

‎.github/dependabot.yml‎

Lines changed: 276 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,276 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: daily
7+
8+
- package-ecosystem: npm
9+
directory: /1_hello_world/nan
10+
schedule:
11+
interval: daily
12+
13+
- package-ecosystem: npm
14+
directory: /1_hello_world/napi
15+
schedule:
16+
interval: daily
17+
18+
- package-ecosystem: npm
19+
directory: /1_hello_world/node-addon-api-addon-class
20+
schedule:
21+
interval: daily
22+
23+
- package-ecosystem: npm
24+
directory: /1_hello_world/node-addon-api
25+
schedule:
26+
interval: daily
27+
28+
- package-ecosystem: npm
29+
directory: /2_function_arguments/nan
30+
schedule:
31+
interval: daily
32+
33+
- package-ecosystem: npm
34+
directory: /2_function_arguments/napi
35+
schedule:
36+
interval: daily
37+
38+
- package-ecosystem: npm
39+
directory: /2_function_arguments/node-addon-api
40+
schedule:
41+
interval: daily
42+
43+
- package-ecosystem: npm
44+
directory: /3_callbacks/nan
45+
schedule:
46+
interval: daily
47+
48+
- package-ecosystem: npm
49+
directory: /3_callbacks/napi
50+
schedule:
51+
interval: daily
52+
53+
- package-ecosystem: npm
54+
directory: /3_callbacks/node-addon-api
55+
schedule:
56+
interval: daily
57+
58+
- package-ecosystem: npm
59+
directory: /4_object_factory/nan
60+
schedule:
61+
interval: daily
62+
63+
- package-ecosystem: npm
64+
directory: /4_object_factory/napi
65+
schedule:
66+
interval: daily
67+
68+
- package-ecosystem: npm
69+
directory: /4_object_factory/node-addon-api
70+
schedule:
71+
interval: daily
72+
73+
- package-ecosystem: npm
74+
directory: /5_function_factory/nan
75+
schedule:
76+
interval: daily
77+
78+
- package-ecosystem: npm
79+
directory: /5_function_factory/napi
80+
schedule:
81+
interval: daily
82+
83+
- package-ecosystem: npm
84+
directory: /5_function_factory/node-addon-api
85+
schedule:
86+
interval: daily
87+
88+
- package-ecosystem: npm
89+
directory: /6_object_wrap/nan
90+
schedule:
91+
interval: daily
92+
93+
- package-ecosystem: npm
94+
directory: /6_object_wrap/napi
95+
schedule:
96+
interval: daily
97+
98+
- package-ecosystem: npm
99+
directory: /6_object_wrap/node-addon-api
100+
schedule:
101+
interval: daily
102+
103+
- package-ecosystem: npm
104+
directory: /7_factory_wrap/nan
105+
schedule:
106+
interval: daily
107+
108+
- package-ecosystem: npm
109+
directory: /7_factory_wrap/napi
110+
schedule:
111+
interval: daily
112+
113+
- package-ecosystem: npm
114+
directory: /7_factory_wrap/node-addon-api
115+
schedule:
116+
interval: daily
117+
118+
- package-ecosystem: npm
119+
directory: /8_passing_wrapped/nan
120+
schedule:
121+
interval: daily
122+
123+
- package-ecosystem: npm
124+
directory: /8_passing_wrapped/napi
125+
schedule:
126+
interval: daily
127+
128+
- package-ecosystem: npm
129+
directory: /8_passing_wrapped/node-addon-api
130+
schedule:
131+
interval: daily
132+
133+
- package-ecosystem: npm
134+
directory: /a-first-project/node-addon-api
135+
schedule:
136+
interval: daily
137+
138+
- package-ecosystem: npm
139+
directory: /array_buffer_to_native/node-addon-api
140+
schedule:
141+
interval: daily
142+
143+
- package-ecosystem: npm
144+
directory: /async-iterator/node-addon-api
145+
schedule:
146+
interval: daily
147+
148+
- package-ecosystem: npm
149+
directory: /async_pi_estimate/nan
150+
schedule:
151+
interval: daily
152+
153+
- package-ecosystem: npm
154+
directory: /async_pi_estimate/node-addon-api
155+
schedule:
156+
interval: daily
157+
158+
- package-ecosystem: npm
159+
directory: /async_work_promise/napi
160+
schedule:
161+
interval: daily
162+
163+
- package-ecosystem: npm
164+
directory: /async_work_promise/node-addon-api
165+
schedule:
166+
interval: daily
167+
168+
- package-ecosystem: npm
169+
directory: /async_work_thread_safe_function/napi
170+
schedule:
171+
interval: daily
172+
173+
- package-ecosystem: npm
174+
directory: /build_with_cmake/napi
175+
schedule:
176+
interval: daily
177+
178+
- package-ecosystem: npm
179+
directory: /build_with_cmake/node-addon-api
180+
schedule:
181+
interval: daily
182+
183+
- package-ecosystem: npm
184+
directory: /call-js-from-async-worker-execute/node-addon-api
185+
schedule:
186+
interval: daily
187+
188+
- package-ecosystem: npm
189+
directory: /emit_event_from_cpp/node-addon-api
190+
schedule:
191+
interval: daily
192+
193+
- package-ecosystem: npm
194+
directory: /function-reference-demo/node-addon-api
195+
schedule:
196+
interval: daily
197+
198+
- package-ecosystem: npm
199+
directory: /inherits_from_event_emitter/node-addon-api
200+
schedule:
201+
interval: daily
202+
203+
- package-ecosystem: npm
204+
directory: /multiple_load/napi
205+
schedule:
206+
interval: daily
207+
208+
- package-ecosystem: npm
209+
directory: /multiple_load/node_10
210+
schedule:
211+
interval: daily
212+
213+
- package-ecosystem: npm
214+
directory: /napi-asyncworker-example/node-addon-api
215+
schedule:
216+
interval: daily
217+
218+
- package-ecosystem: npm
219+
directory: /object-template-demo/nan
220+
schedule:
221+
interval: daily
222+
223+
- package-ecosystem: npm
224+
directory: /object-template-demo/napi
225+
schedule:
226+
interval: daily
227+
228+
- package-ecosystem: npm
229+
directory: /object-wrap-demo/node-addon-api
230+
schedule:
231+
interval: daily
232+
233+
- package-ecosystem: npm
234+
directory: /
235+
schedule:
236+
interval: daily
237+
238+
- package-ecosystem: npm
239+
directory: /promise-callback-demo/node-addon-api
240+
schedule:
241+
interval: daily
242+
243+
- package-ecosystem: npm
244+
directory: /thread_safe_function_counting/node-addon-api
245+
schedule:
246+
interval: daily
247+
248+
- package-ecosystem: npm
249+
directory: /thread_safe_function_round_trip/napi
250+
schedule:
251+
interval: daily
252+
253+
- package-ecosystem: npm
254+
directory: /threadsafe-async-iterator/node-addon-api
255+
schedule:
256+
interval: daily
257+
258+
- package-ecosystem: npm
259+
directory: /typed_array_to_native/node-addon-api
260+
schedule:
261+
interval: daily
262+
263+
- package-ecosystem: npm
264+
directory: /typed_threadsafe_function/node-addon-api
265+
schedule:
266+
interval: daily
267+
268+
- package-ecosystem: npm
269+
directory: /typescript_with_addon/node-addon-api
270+
schedule:
271+
interval: daily
272+
273+
- package-ecosystem: npm
274+
directory: /website
275+
schedule:
276+
interval: daily

‎.github/workflows/codeql.yml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: ["main"]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: ["main"]
20+
schedule:
21+
- cron: "0 0 * * 1"
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
analyze:
28+
name: Analyze
29+
runs-on: ubuntu-latest
30+
permissions:
31+
actions: read
32+
contents: read
33+
security-events: write
34+
35+
strategy:
36+
fail-fast: false
37+
matrix:
38+
language: ["cpp", "javascript", "typescript"]
39+
# CodeQL supports [ $supported-codeql-languages ]
40+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
41+
42+
steps:
43+
- name: Harden Runner
44+
uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845 # v2.4.1
45+
with:
46+
egress-policy: audit
47+
48+
- name: Checkout repository
49+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
50+
51+
# Initializes the CodeQL tools for scanning.
52+
- name: Initialize CodeQL
53+
uses: github/codeql-action/init@46ed16ded91731b2df79a2893d3aea8e9f03b5c4 # v2.20.3
54+
with:
55+
languages: ${{ matrix.language }}
56+
# If you wish to specify custom queries, you can do so here or in a config file.
57+
# By default, queries listed here will override any specified in a config file.
58+
# Prefix the list here with "+" to use these queries and those in the config file.
59+
60+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
61+
# If this step fails, then you should remove it and run the build manually (see below)
62+
# - name: Autobuild
63+
# uses: github/codeql-action/autobuild@46ed16ded91731b2df79a2893d3aea8e9f03b5c4 # v2.20.3
64+
65+
- name: Use Node.js v18.x
66+
if: matrix.language == 'cpp'
67+
uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
68+
with:
69+
node-version: 18.x
70+
71+
- name: Build cpp
72+
if: matrix.language == 'cpp'
73+
run: |
74+
npm install -g [email protected] && npm install && npm test
75+
76+
# ℹ️ Command-line programs to run using the OS shell.
77+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
78+
79+
# If the Autobuild fails above, remove it and uncomment the following three lines.
80+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
81+
82+
# - run: |
83+
# echo "Run, Build Application using script"
84+
# ./location_of_script_within_repo/buildscript.sh
85+
86+
- name: Perform CodeQL Analysis
87+
uses: github/codeql-action/analyze@46ed16ded91731b2df79a2893d3aea8e9f03b5c4 # v2.20.3
88+
with:
89+
category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-review.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Harden Runner
20+
uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845 # v2.4.1
21+
with:
22+
egress-policy: audit
23+
24+
- name: 'Checkout Repository'
25+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
26+
- name: 'Dependency Review'
27+
uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1

0 commit comments

Comments
 (0)