Skip to content

Commit 920aa14

Browse files
step-security-botjaronoff97
step-security-bot
and
jaronoff97
authored
[StepSecurity] Apply security best practices (#3870)
* [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> * Update dependabot.yml --------- Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: Jacob Aronoff <jaronoff97@users.noreply.github.com>
1 parent 63d731e commit 920aa14

21 files changed

+197
-128
lines changed

‎.github/workflows/auto-update-java-agent.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
latest-version: ${{ steps.check-versions.outputs.latest-version }}
1515
already-opened: ${{ steps.check-versions.outputs.already-opened }}
1616
steps:
17-
- uses: actions/checkout@v4
17+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1818

1919
- id: check-versions
2020
name: Check versions
@@ -49,7 +49,7 @@ jobs:
4949
needs:
5050
- check-versions
5151
steps:
52-
- uses: actions/checkout@v4
52+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5353

5454
- name: Update version
5555
env:

‎.github/workflows/changelog.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,18 +20,21 @@ concurrency:
2020
group: ${{ github.workflow }}-${{ github.head_ref }}
2121
cancel-in-progress: true
2222

23+
permissions:
24+
contents: read
25+
2326
jobs:
2427
changelog:
2528
runs-on: ubuntu-latest
2629
if: ${{ !contains(github.event.pull_request.labels.*.name, 'dependencies') && !contains(github.event.pull_request.labels.*.name, 'Skip Changelog') && !contains(github.event.pull_request.title, '[chore]')}}
2730

2831
steps:
2932
- name: Checkout Repo
30-
uses: actions/checkout@v4
33+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3134
with:
3235
fetch-depth: 0
3336
- name: Setup Go
34-
uses: actions/setup-go@v5
37+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
3538
with:
3639
go-version: "~1.24.2"
3740

‎.github/workflows/continuous-integration.yaml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,16 @@ jobs:
1616
runs-on: ubuntu-22.04
1717
steps:
1818
- name: Check out code into the Go module directory
19-
uses: actions/checkout@v4
19+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2020

2121
- name: Set up Go
22-
uses: actions/setup-go@v5
22+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
2323
id: setup-go
2424
with:
2525
go-version: "~1.24.2"
2626

2727
- name: Cache tools
28-
uses: actions/cache@v4
28+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
2929
with:
3030
path: bin
3131
key: tools-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Makefile') }}-${{ steps.setup-go.outputs.go-version }}
@@ -41,24 +41,24 @@ jobs:
4141
runs-on: ubuntu-22.04
4242
steps:
4343
- name: Check out code into the Go module directory
44-
uses: actions/checkout@v4
44+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4545

4646
- name: Set up Go
47-
uses: actions/setup-go@v5
47+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
4848
id: setup-go
4949
with:
5050
go-version: "~1.24.2"
5151

5252
- name: Cache tools
53-
uses: actions/cache@v4
53+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
5454
with:
5555
path: bin
5656
key: tools-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Makefile') }}-${{ steps.setup-go.outputs.go-version }}
5757

5858
- name: Install tools
5959
run: make install-tools
6060

61-
- uses: actions/cache@v4
61+
- uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
6262
with:
6363
path: |
6464
/home/runner/.cache/golangci-lint
@@ -74,23 +74,23 @@ jobs:
7474
runs-on: ubuntu-22.04
7575
steps:
7676
- name: Check out code into the Go module directory
77-
uses: actions/checkout@v4
77+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7878

7979
- name: Set up Go
80-
uses: actions/setup-go@v5
80+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
8181
with:
8282
go-version: "~1.24.2"
8383

8484
- name: Initialize CodeQL
85-
uses: github/codeql-action/init@v3
85+
uses: github/codeql-action/init@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
8686
with:
8787
languages: go
8888

8989
- name: Autobuild
90-
uses: github/codeql-action/autobuild@v3
90+
uses: github/codeql-action/autobuild@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
9191

9292
- name: Perform CodeQL Analysis
93-
uses: github/codeql-action/analyze@v3
93+
uses: github/codeql-action/analyze@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
9494

9595
- name: Govulncheck
96-
uses: golang/govulncheck-action@v1
96+
uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4

‎.github/workflows/dependency-review.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: 'Checkout Repository'
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21+
- name: 'Dependency Review'
22+
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0

‎.github/workflows/e2e.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ concurrency:
1010
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
1111
cancel-in-progress: true
1212

13+
permissions:
14+
contents: read
15+
1316
jobs:
1417
e2e-tests:
1518
runs-on: ubuntu-22.04
@@ -56,15 +59,15 @@ jobs:
5659
setup: "enable-targetallocator-cr prepare-e2e"
5760
steps:
5861
- name: Check out code into the Go module directory
59-
uses: actions/checkout@v4
62+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6063
- name: Set up Go
61-
uses: actions/setup-go@v5
64+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
6265
id: setup-go
6366
with:
6467
go-version: "~1.24.2"
6568

6669
- name: Cache tools
67-
uses: actions/cache@v4
70+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
6871
with:
6972
path: bin
7073
key: tools-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Makefile') }}-${{ steps.setup-go.outputs.go-version }}

‎.github/workflows/publish-autoinstrumentation-apache-httpd.yaml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,47 +17,50 @@ concurrency:
1717
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
1818
cancel-in-progress: true
1919

20+
permissions:
21+
contents: read
22+
2023
jobs:
2124
publish:
2225
runs-on: ubuntu-22.04
2326

2427
steps:
25-
- uses: actions/checkout@v4
28+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2629

2730
- name: Read version
2831
run: echo "VERSION=$(cat autoinstrumentation/apache-httpd/version.txt)" >> $GITHUB_ENV
2932

3033
- name: Docker meta
3134
id: meta
32-
uses: docker/metadata-action@v5
35+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
3336
with:
3437
images: ghcr.io/open-telemetry/opentelemetry-operator/autoinstrumentation-apache-httpd
3538
tags: |
3639
type=match,pattern=v(.*),group=1,value=v${{ env.VERSION }}
3740
3841
- name: Set up QEMU
39-
uses: docker/setup-qemu-action@v3
42+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
4043

4144
- name: Set up Docker Buildx
42-
uses: docker/setup-buildx-action@v3
45+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
4346

4447
- name: Cache Docker layers
45-
uses: actions/cache@v4
48+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
4649
with:
4750
path: /tmp/.buildx-cache
4851
key: ${{ runner.os }}-buildx-${{ github.sha }}
4952
restore-keys: |
5053
${{ runner.os }}-buildx-
5154
5255
- name: Login to GitHub Package Registry
53-
uses: docker/login-action@v3
56+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
5457
with:
5558
registry: ghcr.io
5659
username: ${{ github.repository_owner }}
5760
password: ${{ secrets.GITHUB_TOKEN }}
5861

5962
- name: Build and push
60-
uses: docker/build-push-action@v6
63+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
6164
with:
6265
context: autoinstrumentation/apache-httpd
6366
platforms: linux/amd64

‎.github/workflows/publish-autoinstrumentation-dotnet.yaml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,19 +17,22 @@ concurrency:
1717
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
1818
cancel-in-progress: true
1919

20+
permissions:
21+
contents: read
22+
2023
jobs:
2124
publish:
2225
runs-on: ubuntu-22.04
2326

2427
steps:
25-
- uses: actions/checkout@v4
28+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2629

2730
- name: Read version
2831
run: echo "VERSION=$(cat autoinstrumentation/dotnet/version.txt)" >> $GITHUB_ENV
2932

3033
- name: Docker meta
3134
id: meta
32-
uses: docker/metadata-action@v5
35+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
3336
with:
3437
images: |
3538
otel/autoinstrumentation-dotnet
@@ -38,36 +41,36 @@ jobs:
3841
type=match,pattern=v(.*),group=1,value=v${{ env.VERSION }}
3942
4043
- name: Set up QEMU
41-
uses: docker/setup-qemu-action@v3
44+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
4245

4346
- name: Set up Docker Buildx
44-
uses: docker/setup-buildx-action@v3
47+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
4548

4649
- name: Cache Docker layers
47-
uses: actions/cache@v4
50+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
4851
with:
4952
path: /tmp/.buildx-cache
5053
key: ${{ runner.os }}-buildx-${{ github.sha }}
5154
restore-keys: |
5255
${{ runner.os }}-buildx-
5356
5457
- name: Log into Docker.io
55-
uses: docker/login-action@v3
58+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
5659
if: ${{ github.event_name == 'push' }}
5760
with:
5861
username: ${{ secrets.DOCKER_USERNAME }}
5962
password: ${{ secrets.DOCKER_PASSWORD }}
6063

6164
- name: Login to GitHub Package Registry
62-
uses: docker/login-action@v3
65+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
6366
if: ${{ github.event_name == 'push' }}
6467
with:
6568
registry: ghcr.io
6669
username: ${{ github.repository_owner }}
6770
password: ${{ secrets.GITHUB_TOKEN }}
6871

6972
- name: Build and push
70-
uses: docker/build-push-action@v6
73+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
7174
with:
7275
context: autoinstrumentation/dotnet
7376
platforms: linux/amd64,linux/arm64

‎.github/workflows/publish-autoinstrumentation-java.yaml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,19 +18,22 @@ concurrency:
1818
cancel-in-progress: true
1919

2020

21+
permissions:
22+
contents: read
23+
2124
jobs:
2225
publish:
2326
runs-on: ubuntu-22.04
2427

2528
steps:
26-
- uses: actions/checkout@v4
29+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2730

2831
- name: Read version
2932
run: echo "VERSION=$(cat autoinstrumentation/java/version.txt)" >> $GITHUB_ENV
3033

3134
- name: Docker meta
3235
id: meta
33-
uses: docker/metadata-action@v5
36+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
3437
with:
3538
images: |
3639
otel/autoinstrumentation-java
@@ -40,36 +43,36 @@ jobs:
4043
type=semver,pattern={{major}},value=v${{ env.VERSION }}
4144
4245
- name: Set up QEMU
43-
uses: docker/setup-qemu-action@v3
46+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
4447

4548
- name: Set up Docker Buildx
46-
uses: docker/setup-buildx-action@v3
49+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
4750

4851
- name: Cache Docker layers
49-
uses: actions/cache@v4
52+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
5053
with:
5154
path: /tmp/.buildx-cache
5255
key: ${{ runner.os }}-buildx-${{ github.sha }}
5356
restore-keys: |
5457
${{ runner.os }}-buildx-
5558
5659
- name: Log into Docker.io
57-
uses: docker/login-action@v3
60+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
5861
if: ${{ github.event_name == 'push' }}
5962
with:
6063
username: ${{ secrets.DOCKER_USERNAME }}
6164
password: ${{ secrets.DOCKER_PASSWORD }}
6265

6366
- name: Login to GitHub Package Registry
64-
uses: docker/login-action@v3
67+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
6568
if: ${{ github.event_name == 'push' }}
6669
with:
6770
registry: ghcr.io
6871
username: ${{ github.repository_owner }}
6972
password: ${{ secrets.GITHUB_TOKEN }}
7073

7174
- name: Build and push
72-
uses: docker/build-push-action@v6
75+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
7376
with:
7477
context: autoinstrumentation/java
7578
platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le

0 commit comments

Comments
 (0)