You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Secure GitHub Actions CI/CD workflows via automated remediations
4
+
Secure your GitHub repo with ease through automated security fixes
7
5
</p>
8
6
9
7
<divalign="center">
10
8
11
-
[](https://stepsecurity.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=secure-workflows)
[](https://stepsecurity.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=secure-repo)
@@ -75,11 +73,11 @@ In this pull request, minimum permissions are set automatically for the GITHUB_T
75
73
76
74
<palign="center"><imgsrc="images/token-perm-example.png"alt="Screenshot of token permissions set in a workflow"width="600" /></p>
77
75
78
-
#### How does SecureWorkflows fix this issue?
76
+
#### How does Secure-Repo fix this issue?
79
77
80
-
-SecureWorkflows stores the permissions needed by different GitHub Actions in a [knowledge base](<(https://github.com/step-security/secure-workflows/tree/main/knowledge-base/actions)>)
78
+
-Secure-Repo stores the permissions needed by different GitHub Actions in a [knowledge base](<(https://github.com/step-security/secure-repo/tree/main/knowledge-base/actions)>)
81
79
- It looks up the permissions needed by each Action in your workflow and sums the permissions up to come up with a final recommendation
82
-
- If you are the owner of a GitHub Action, please [contribute to the knowledge base](https://github.com/step-security/secure-workflows/blob/main/knowledge-base/actions/README.md)
80
+
- If you are the owner of a GitHub Action, please [contribute to the knowledge base](https://github.com/step-security/secure-repo/blob/main/knowledge-base/actions/README.md)
83
81
84
82
### 2. Pin Actions to a full length commit SHA
85
83
@@ -93,17 +91,17 @@ In this pull request, minimum permissions are set automatically for the GITHUB_T
93
91
94
92
Before the fix, your workflow may look like this (use of `v1` and `latest` tags)
95
93
96
-
After the fix, SecureWorkflows pins each Action and docker image to an immutable checksum.
94
+
After the fix, Secure-Repo pins each Action and docker image to an immutable checksum.
In this pull request, the workflow file has the GitHub Actions tags pinned automatically to their full-length commit SHA.
101
99
102
100
<palign="center"><imgsrc="images/pin-example.png"alt="Screenshot of Action pinned to commit SHA"width="600" /></p>
103
101
104
-
#### How does SecureWorkflows fix this issue?
102
+
#### How does Secure-Repo fix this issue?
105
103
106
-
-SecureWorkflows automates the process of getting the commit SHA for each mutable Action version or Docker image tag
104
+
-Secure-Repo automates the process of getting the commit SHA for each mutable Action version or Docker image tag
107
105
- It does this by using GitHub and Docker registry APIs
108
106
109
107
### 3. Add Harden-Runner GitHub Action to each job
@@ -120,9 +118,9 @@ This pull request adds the Harden Runner GitHub Action to the workflow file.
120
118
121
119
<palign="center"><imgsrc="images/harden-runner-example.png"width="600"alt="Screenshot of Harden-Runner GitHub Action added to a workflow" /></p>
122
120
123
-
#### How does SecureWorkflows fix this issue?
121
+
#### How does Secure-Repo fix this issue?
124
122
125
-
SecureWorkflows updates the YAML file and adds [Harden-Runner GitHub Action](https://github.com/step-security/harden-runner) as the first step to each job.
123
+
Secure-Repo updates the YAML file and adds [Harden-Runner GitHub Action](https://github.com/step-security/harden-runner) as the first step to each job.
126
124
127
125
### 4. Add or update Dependabot configuration
128
126
@@ -143,9 +141,9 @@ This pull request updates the Dependabot configuration.
143
141
144
142
<palign="center"><imgsrc="images/dependabot-example.png"width="600"alt="Screenshot of Dependabot config updated" /></p>
145
143
146
-
#### How does SecureWorkflows fix this issue?
144
+
#### How does Secure-Repo fix this issue?
147
145
148
-
SecureWorkflows updates the `dependabot.yml` file to add missing ecosystems. For example, if the Dependabot configuration updates npm packages but not GitHub Actions, it is updated to add the GitHub Actions ecosystem.
146
+
Secure-Repo updates the `dependabot.yml` file to add missing ecosystems. For example, if the Dependabot configuration updates npm packages but not GitHub Actions, it is updated to add the GitHub Actions ecosystem.
149
147
150
148
### 5. Add CodeQL workflow (SAST)
151
149
@@ -163,12 +161,12 @@ After the fix, a `codeql.yml` GitHub Actions workflow gets added to your project
163
161
164
162
This pull request adds CodeQL to the list of workflows.
165
163
166
-
#### How does SecureWorkflows fix this issue?
164
+
#### How does Secure-Repo fix this issue?
167
165
168
-
SecureWorkflows has a [workflow-templates](https://github.com/step-security/secure-workflows/tree/main/workflow-templates) folder. This folder has the default CodeQL workflow, which gets added as part of the pull request. The placeholder for languages in the template gets replaced with languages for your GitHub repository.
166
+
Secure-Repo has a [workflow-templates](https://github.com/step-security/secure-repo/tree/main/workflow-templates) folder. This folder has the default CodeQL workflow, which gets added as part of the pull request. The placeholder for languages in the template gets replaced with languages for your GitHub repository.
169
167
170
168
## Contributing
171
169
172
170
Contributions are welcome!
173
171
174
-
If you are the owner of a GitHub Action, please contribute information about the use of GITHUB_TOKEN for your Action. This will enable the community to automatically calculate minimum token permissions for the GITHUB_TOKEN for their workflows. Check out the [Contributing Guide](https://github.com/step-security/secure-workflows/blob/main/knowledge-base/actions/README.md)
172
+
If you are the owner of a GitHub Action, please contribute information about the use of GITHUB_TOKEN for your Action. This will enable the community to automatically calculate minimum token permissions for the GITHUB_TOKEN for their workflows. Check out the [Contributing Guide](https://github.com/step-security/secure-repo/blob/main/knowledge-base/actions/README.md)
Copy file name to clipboardExpand all lines: knowledge-base/actions/README.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ If you are the owner of a GitHub Action, please contribute information about the
6
6
7
7
To contribute information about the use of `GITHUB_TOKEN` for your Action:
8
8
9
-
1. Add a folder for your GitHub Action under the [`knowledge-base/actions`](https://github.com/step-security/secure-workflows/blob/main/knowledge-base/actions/) folder. It should match the path of your GitHub Action's `action.yml` file. As an example,
9
+
1. Add a folder for your GitHub Action under the [`knowledge-base/actions`](https://github.com/step-security/secure-repo/blob/main/knowledge-base/actions/) folder. It should match the path of your GitHub Action's `action.yml` file. As an example,
10
10
- If your GitHub Action's `action.yml` file is at the root, e.g. https://github.com/stelligent/cfn_nag/blob/master/action.yml, the path should be `knowledge-base/actions/stelligent/cfn_nag`
11
11
- If your GitHub Action's `action.yml` file is in a sub folder, e.g. at https://github.com/snyk/actions/blob/master/gradle/action.yml, the path should be `knowledge-base/actions/snyk/actions/gradle`
12
12
2. In the folder for your GitHub Action, add an `action-security.yml` file.
@@ -19,7 +19,7 @@ For this scenario,
19
19
1. Add a `name` attribute in your `action-security.yml` file. You can set the name to be same as the name in your `action.yml` file.
20
20
2. In a comment just mention that the GitHub token is not used.
21
21
22
-
Here is an [example](https://github.com/step-security/secure-workflows/blob/main/knowledge-base/actions/stelligent/cfn_nag/action-security.yml).
22
+
Here is an [example](https://github.com/step-security/secure-repo/blob/main/knowledge-base/actions/stelligent/cfn_nag/action-security.yml).
23
23
24
24
```yaml
25
25
name: 'Stelligent cfn_nag'# stelligent/cfn_nag
@@ -33,13 +33,13 @@ Note: if your Action just uses `metadata` permission to overcome throttle limits
33
33
For this scenario, follow these steps:
34
34
1. Add a `name` attribute in your `action-security.yml` file. You can set the name to be same as the name in your `action.yml` file.
35
35
2. Mention where you expect the GitHub token.
36
-
- If you expect it as an environment variable, you specify it this way. Here is an [example](https://github.com/step-security/secure-workflows/blob/00c05310c1c97a91b98c46f904e857a617a2fc02/knowledge-base/actions/dev-drprasad/delete-tag-and-release/action-security.yml):
36
+
- If you expect it as an environment variable, you specify it this way. Here is an [example](https://github.com/step-security/secure-repo/blob/00c05310c1c97a91b98c46f904e857a617a2fc02/knowledge-base/actions/dev-drprasad/delete-tag-and-release/action-security.yml):
37
37
```yaml
38
38
name: Delete tag and release
39
39
github-token:
40
40
environment-variable-name: GITHUB_TOKEN
41
41
```
42
-
- If you expect it as an action input, you specify it as shown below. If you set the default value for the token to be the GITHUB_TOKEN, then set the “is-default” attribute to true. Here is an [example](https://github.com/step-security/secure-workflows/blob/main/knowledge-base/actions/irongut/editrelease/action-security.yml):
42
+
- If you expect it as an action input, you specify it as shown below. If you set the default value for the token to be the GITHUB_TOKEN, then set the “is-default” attribute to true. Here is an [example](https://github.com/step-security/secure-repo/blob/main/knowledge-base/actions/irongut/editrelease/action-security.yml):
43
43
```yaml
44
44
name: 'Edit Release'
45
45
github-token:
@@ -48,7 +48,7 @@ For this scenario, follow these steps:
48
48
is-default: false
49
49
```
50
50
3. Mention the permissions needed and a reason for the permissions. The reason must start with the word `to`.
51
-
Here is an [example](https://github.com/step-security/secure-workflows/blob/main/knowledge-base/actions/peter-evans/create-or-update-comment/action-security.yml):
51
+
Here is an [example](https://github.com/step-security/secure-repo/blob/main/knowledge-base/actions/peter-evans/create-or-update-comment/action-security.yml):
52
52
``` yaml
53
53
name: 'Create or Update Comment'
54
54
github-token:
@@ -78,7 +78,7 @@ The above two scenarios should take care of most of the cases. For more advanced
78
78
79
79
This example is for `peter-evans/close-issue` GitHub Action. It shows that the Action expects GitHub token as an action input, the name of the input is `token`, and that it is set to `GITHUB_TOKEN` as the default value. It also shows that the permissions needed for the Action are `issues: write` and the reason for that permission is specified in the `issues-reason` key.
This example is for `github/super-linter` GitHub Action. It shows that the Action expects GitHub token as an environment variable, the name of the environment variable is `GITHUB_TOKEN`. It also shows that the permissions needed for the Action are `statuses: write` and the reason for that permission is specified in the `statuses-reason` key.
This example is for `actions/setup-node` GitHub Action. It shows that the Action expects GitHub token as an Action input. The permissions key is set, but no scopes are defined, since it only uses it for rate-limiting.
As an example, consider this `action-security.yml` for `dessant/lock-threads` GitHub Action. The `issues` scope only applies if either the `with` (action input) does not have `process-only` or `process-only` is set to `issues`.
0 commit comments