You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To create an instance of Secure Workflows, deploy _cloudformation/ecr.yml_ and _cloudformation/resources.yml_ CloudFormation templates in your AWS account. You can take a look at _.github/workflows/release.yml_ for reference.
53
53
54
-
## Functionality Overview
54
+
## Functionality
55
55
56
56
Secure Workflows
57
57
@@ -64,87 +64,42 @@ Secure Workflows
64
64
#### Why is this needed?
65
65
66
66
- The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API
67
-
- If the token is compromised, it can be abused to compromise your environment (e.g. to overwrite releases or source code). This will also impact everyone who use your software in their software supply chain.
67
+
- If the token is compromised, it can be abused to compromise your environment (e.g., to overwrite releases or source code). This compromise will also impact everyone using your software in their supply chain.
68
68
- To limit the damage, [GitHub recommends setting minimum token permissions for the GITHUB_TOKEN](https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/).
69
69
70
70
#### Before and After the fix
71
71
72
-
Before the fix, your workflow may look like this (no permissions set)
73
-
74
-
```yaml
75
-
jobs:
76
-
closeissue:
77
-
runs-on: ubuntu-latest
78
-
79
-
steps:
80
-
- name: Close Issue
81
-
uses: peter-evans/close-issue@v1
82
-
with:
83
-
issue-number: 1
84
-
comment: Auto-closing issue
85
-
```
86
-
87
-
After the fix, the workflow will have minimum permissions added for the GITHUB token.
88
-
89
-
```yaml
90
-
permissions:
91
-
contents: read
92
-
93
-
jobs:
94
-
closeissue:
95
-
permissions:
96
-
issues: write # for peter-evans/close-issue to close issues
In this pull request, minimum permissions are set automatically for the GITHUB_TOKEN
75
+
76
+
<palign="center"><imgsrc="images/token-perm-example.png"alt="Screenshot of token permissions set in a workflow"width="600" /></p>
106
77
107
78
#### How does SecureWorkflows fix this issue?
108
79
109
80
- SecureWorkflows stores the permissions needed by different GitHub Actions in a [knowledge base](<(https://github.com/step-security/secure-workflows/tree/main/knowledge-base/actions)>)
110
-
- It looks up the permissions needed by each Action in your workflow, and sums the permissions up to come up with a final recommendation
81
+
- It looks up the permissions needed by each Action in your workflow and sums the permissions up to come up with a final recommendation
111
82
- If you are the owner of a GitHub Action, please [contribute to the knowledge base](https://github.com/step-security/secure-workflows/blob/main/knowledge-base/actions/README.md)
112
83
113
84
### 2. Pin Actions to a full length commit SHA
114
85
115
86
#### Why is this needed?
116
87
117
-
- GitHub Action tags and Docker tags are mutatble. This poses a security risk
88
+
- GitHub Action tags and Docker tags are mutable, which poses a security risk
118
89
- If the tag changes you will not have a chance to review the change before it gets used
119
90
- GitHub's Security Hardening for GitHub Actions guide [recommends pinning actions to full length commit for third party actions](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions).
120
91
121
92
#### Before and After the fix
122
93
123
94
Before the fix, your workflow may look like this (use of `v1` and `latest` tags)
This pull request adds the Harden Runner GitHub Action to the workflow file.
120
+
121
+
<palign="center"><imgsrc="images/harden-runner-example.png"width="600"alt="Screenshot of Harden-Runner GitHub Action added to a workflow" /></p>
196
122
197
123
#### How does SecureWorkflows fix this issue?
198
124
199
125
SecureWorkflows updates the YAML file and adds [Harden-Runner GitHub Action](https://github.com/step-security/harden-runner) as the first step to each job.
200
126
127
+
### 4. Add or update Dependabot configuration
128
+
129
+
#### Why is this needed?
130
+
131
+
- You enable Dependabot version updates by checking a `dependabot.yml` configuration file into your repository
132
+
- Dependabot ensures that your repository automatically keeps up with the latest releases of the packages and applications it depends on
133
+
134
+
#### Before and After the fix
135
+
136
+
Before the fix, you might not have a `dependabot.yml` file or it might not cover all ecosystems used in your project.
137
+
138
+
After the fix, the `dependabot.yml` file is added or updated with configuration for all package ecosystems used in your project.
This pull request updates the Dependabot configuration.
143
+
144
+
<palign="center"><imgsrc="images/dependabot-example.png"width="600"alt="Screenshot of Dependabot config updated" /></p>
145
+
146
+
#### How does SecureWorkflows fix this issue?
147
+
148
+
SecureWorkflows updates the `dependabot.yml` file to add missing ecosystems. For example, if the Dependabot configuration updates npm packages but not GitHub Actions, it is updated to add the GitHub Actions ecosystem.
0 commit comments