Skip to content

Commit 376f288

Browse files
[SECURITY] Additional security hardening for CI/CD (- WIP #485 -)
Changes in file .github/actions/check-control/action.yml: * Improved hardening Changes in file .github/actions/checkout-and-rebuild/action.yml: * Improved hardening Changes in file .github/actions/run-minimal-acceptance-tests/action.yml: * Improved hardening Changes in file .github/actions/setup-py-reqs/action.yml: * Improved hardening Changes in file .github/workflows/CI-CHGLOG.yml: * Improved hardening Changes in file .github/workflows/CI-DOCS.yml: * Improved hardening Changes in file .github/workflows/CI-MATs.yml: * Improved hardening Changes in file .github/workflows/Tests.yml: * Improved hardening
1 parent 708905a commit 376f288

File tree

8 files changed

+24
-8
lines changed

8 files changed

+24
-8
lines changed

.github/actions/check-control/action.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,12 +107,14 @@ runs:
107107
using: composite
108108
steps:
109109
- id: output_sha
110-
if: ${{ !cancelled() }}
110+
if: ${{ (github.repository == 'reactive-firewall-org/multicast') && !cancelled() }}
111+
env:
112+
CI_INPUT_TARGET_SHA: '${{ inputs.sha }}'
111113
shell: bash
112114
run: |
113115
set -euo pipefail
114116
115-
raw_input='${{ inputs.sha }}'
117+
raw_input="${CI_INPUT_TARGET_SHA}"
116118
117119
# Reject NUL or newline immediately
118120
if printf '%s' "$raw_input" | grep -q '[^[:print:]]'; then

.github/actions/checkout-and-rebuild/action.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,11 @@ runs:
7272
token: ${{ inputs.token }}
7373
- name: "Checkout Target Commit by SHA"
7474
shell: bash
75+
env:
76+
CI_INPUT_TARGET_SHA: ${{ inputs.sha }}
7577
run: |
7678
printf "%s\n" "::group::target-commit"
77-
git checkout --force --detach ${{ inputs.sha }} --
79+
git checkout --force --detach "${CI_INPUT_TARGET_SHA}" --
7880
printf "%s\n" "::endgroup::"
7981
if: ${{ (github.sha != inputs.sha) && success() }}
8082
- id: output_branch_name

.github/actions/run-minimal-acceptance-tests/action.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,11 +81,13 @@ runs:
8181
- name: "Calculate Commit SHA"
8282
id: output_sha
8383
if: ${{ !cancelled() }}
84+
env:
85+
CI_INPUT_TARGET_SHA: '${{ inputs.sha }}'
8486
shell: bash
8587
run: |
8688
set -euo pipefail
8789
88-
raw_input='${{ inputs.sha }}'
90+
raw_input="${CI_INPUT_TARGET_SHA}"
8991
9092
# Reject NUL or newline immediately
9193
if printf '%s' "$raw_input" | grep -q '[^[:print:]]'; then

.github/actions/setup-py-reqs/action.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,13 @@ runs:
6666
- name: "Calculate Commit SHA"
6767
id: output_sha
6868
if: ${{ !cancelled() }}
69+
env:
70+
CI_INPUT_TARGET_SHA: '${{ inputs.sha }}'
6971
shell: bash
7072
run: |
7173
set -euo pipefail
7274
73-
raw_input='${{ inputs.sha }}'
75+
raw_input="${CI_INPUT_TARGET_SHA}"
7476
7577
# Reject NUL or newline immediately
7678
if printf '%s' "$raw_input" | grep -q '[^[:print:]]'; then

.github/workflows/CI-CHGLOG.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ jobs:
6161
echo "should_run=true" >> "$GITHUB_OUTPUT"
6262
else
6363
echo "should_run=false" >> "$GITHUB_OUTPUT"
64+
exit 1 ;
6465
fi
6566
- id: get_trigger_id
6667
if: ${{ (steps.check.outputs.should_run == 'true') && success() }}

.github/workflows/CI-DOCS.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ jobs:
5858
echo "should_run=true" >> "$GITHUB_OUTPUT"
5959
else
6060
echo "should_run=false" >> "$GITHUB_OUTPUT"
61+
exit 1 ;
6162
fi
6263
- id: get_trigger_id
6364
if: ${{ (steps.check.outputs.should_run == 'true') && success() }}

.github/workflows/CI-MATs.yml

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -65,9 +65,10 @@ jobs:
6565
echo "should_run=true" >> "$GITHUB_OUTPUT"
6666
else
6767
echo "should_run=false" >> "$GITHUB_OUTPUT"
68+
exit 1 ;
6869
fi
6970
- id: get_trigger_id
70-
if: ${{ (steps.check.outputs.should_run == 'true') && success() }}
71+
if: ${{ (github.repository == 'reactive-firewall-org/multicast') && (steps.check.outputs.should_run == 'true') && success() }}
7172
run: |
7273
ID_VALUE=$(gh api "${{ github.event.workflow_run.url }}" --jq '.id')
7374
if [[ -n "$ID_VALUE" ]]; then
@@ -106,6 +107,8 @@ jobs:
106107
persist-credentials: false
107108
ref: ${{ steps.load_build_info.outputs.build_sha }}
108109
fetch-depth: 0
110+
repository: reactive-firewall-org/multicast
111+
token: ${{ env.GH_TOKEN }}
109112
- name: "Queue MATs GitHub Check"
110113
id: output_mats_check_id
111114
uses: ./.github/actions/check-control
@@ -118,10 +121,10 @@ jobs:
118121
workflow-run-id: ${{ steps.output_run_id.outputs.mats_id }}
119122
details-url: ${{ steps.output_run_id.outputs.mats_url }}
120123
- name: Checkout target commit
121-
if: ${{ (steps.check.outputs.should_run == 'true') && success() }}
124+
if: ${{ (github.repository == 'reactive-firewall-org/multicast') && (steps.check.outputs.should_run == 'true') && success() }}
122125
run: git checkout ${{ steps.load_build_info.outputs.build_sha }}
123126
- id: get_env
124-
if: ${{ (steps.check.outputs.should_run == 'true') && success() }}
127+
if: ${{ (github.repository == 'reactive-firewall-org/multicast') && (steps.check.outputs.should_run == 'true') && success() }}
125128
run: |
126129
echo "branch=$(git name-rev --name-only $(git log -1 --format=%H) | cut -d~ -f1-1)" >> "$GITHUB_OUTPUT"
127130
echo "parent_sha=$(git merge-base $(git log -1 --format=%H) refs/remotes/origin/stable)" >> "$GITHUB_OUTPUT"

.github/workflows/Tests.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ jobs:
8282
echo "should_run=true" >> "$GITHUB_OUTPUT"
8383
else
8484
echo "should_run=false" >> "$GITHUB_OUTPUT"
85+
exit 1 ;
8586
fi
8687
- id: get_trigger_id
8788
if: ${{ (steps.check.outputs.should_run == 'true') && success() }}
@@ -123,6 +124,8 @@ jobs:
123124
persist-credentials: false
124125
ref: ${{ steps.load_build_info.outputs.build_sha }}
125126
sparse-checkout: '.github/actions/check-control'
127+
repository: reactive-firewall-org/multicast
128+
github-token: ${{ env.GH_TOKEN }}
126129
- name: "Queue Tests GitHub Check"
127130
id: output_tests_check_id
128131
uses: ./.github/actions/check-control

0 commit comments

Comments
 (0)