Skip to content

Commit 787aa9d

Browse files
jeromevdlscottgerring
jeromevdl
and
scottgerring
authored
chore: secure github actions using hash instead of versions (#1232)
* secure github actions using hash instead of versions * delete docs.yaml * fix hash for dcos --------- Co-authored-by: Scott Gerring <scottgerring@users.noreply.github.com>
1 parent 1fb444a commit 787aa9d

File tree

11 files changed

+65
-32
lines changed

11 files changed

+65
-32
lines changed

‎.github/workflows/auto-merge.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ jobs:
1717
runs-on: ubuntu-latest
1818
if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success' && github.actor == 'dependabot[bot]'
1919
steps:
20-
- uses: actions/checkout@v3
21-
- uses: ahmadnassri/action-workflow-run-wait@v1
20+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
21+
- uses: ahmadnassri/action-workflow-run-wait@2aa3d9e1a12ecaaa9908e368eaf2123bb084323e # v1.4.4
2222
with:
2323
timeout: 300000
2424
- name: 'Download artifact'
25-
uses: actions/github-script@v3.1.0
25+
uses: actions/github-script@47f7cf65b5ced0830a325f705cad64f2f58dddf7 # v3.1.0
2626
with:
2727
script: |
2828
var artifacts = await github.actions.listWorkflowRunArtifacts({
@@ -43,7 +43,7 @@ jobs:
4343
fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(download.data));
4444
- run: unzip pr.zip
4545
- name: Create review
46-
uses: actions/github-script@v3
46+
uses: actions/github-script@47f7cf65b5ced0830a325f705cad64f2f58dddf7 # v3.1.0
4747
with:
4848
script: |
4949
var fs = require('fs');

‎.github/workflows/build-docs.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ jobs:
2222
docs:
2323
runs-on: ubuntu-latest
2424
steps:
25-
- uses: actions/checkout@v3
25+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
2626
- name: Set up Python
27-
uses: actions/setup-python@v4
27+
uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0 # v4.6.1
2828
with:
2929
python-version: "3.8"
3030
- name: Capture branch and tag

‎.github/workflows/build.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -54,17 +54,17 @@ jobs:
5454
JAVA: ${{ matrix.java }}
5555
AWS_REGION: eu-west-1
5656
steps:
57-
- uses: actions/checkout@v3
57+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
5858
- name: Setup java
59-
uses: actions/setup-java@v3
59+
uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3.11.0
6060
with:
6161
distribution: 'corretto'
6262
java-version: ${{ matrix.java }}
6363
cache: 'maven'
6464
- name: Build with Maven
6565
run: mvn -B install --file pom.xml
6666
- name: Upload coverage to Codecov
67-
uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # 3.1.1
67+
uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
6868
if: ${{ matrix.java == '11' }} # publish results once
6969
with:
7070
files: ./powertools-cloudformation/target/site/jacoco/jacoco.xml,./powertools-core/target/site/jacoco/jacoco.xml,./powertools-idempotency/target/site/jacoco/jacoco.xml,./powertools-logging/target/site/jacoco/jacoco.xml,./powertools-metrics/target/site/jacoco/jacoco.xml,./powertools-parameters/target/site/jacoco/jacoco.xml,./powertools-serialization/target/site/jacoco/jacoco.xml,./powertools-sqs/target/site/jacoco/jacoco.xml,./powertools-tracing/target/site/jacoco/jacoco.xml,./powertools-validation/target/site/jacoco/jacoco.xml
@@ -78,7 +78,7 @@ jobs:
7878
mkdir -p ./pr
7979
echo ${{ github.event.number }}
8080
echo ${{ github.event.number }} > ./pr/NR
81-
- uses: actions/upload-artifact@v2
81+
- uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
8282
name: Upload artifact
8383
with:
8484
name: pr

‎.github/workflows/dispatch_analytics.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
environment: analytics
3030
steps:
3131
- name: Configure AWS credentials
32-
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef
32+
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
3333
with:
3434
aws-region: eu-central-1
3535
role-to-assume: ${{ secrets.AWS_ANALYTICS_ROLE_ARN }}

‎.github/workflows/docs.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ jobs:
1616
runs-on: ubuntu-latest
1717
environment: Docs
1818
steps:
19-
- uses: actions/checkout@v3
19+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
2020
- name: Set up Python
21-
uses: actions/setup-python@v4
21+
uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0 # v4.6.1
2222
with:
2323
python-version: "3.8"
2424
- name: Capture branch and tag

‎.github/workflows/publish.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,16 @@ jobs:
88
publish:
99
runs-on: ubuntu-latest
1010
steps:
11-
- uses: actions/checkout@v3
11+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
1212
- name: Set up Maven Central Repository
13-
uses: actions/setup-java@v2
13+
uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3.11.0
1414
with:
15-
distribution: 'zulu'
15+
distribution: 'corretto'
1616
java-version: 8
1717
server-id: ossrh
1818
server-username: MAVEN_USERNAME
1919
server-password: MAVEN_PASSWORD
20+
# TODO: use environments https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment
2021
gpg-private-key: ${{ secrets.GPG_SIGNING_KEY }} # Value of the GPG private key to import
2122
gpg-passphrase: GPG_PASSPHRASE # env variable for GPG private key passphrase
2223
- name: Set release notes tag
@@ -30,7 +31,7 @@ jobs:
3031
MAVEN_PASSWORD: ${{ secrets.OSSRH_JIRA_PASSWORD }}
3132
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
3233
- name: Close issues related to this release
33-
uses: actions/github-script@v5
34+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
3435
with:
3536
script: |
3637
const post_release = require('.github/workflows/post_release.js')

‎.github/workflows/release-drafter.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,6 @@ jobs:
1010
update_release_draft:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: release-drafter/release-drafter@v5
13+
- uses: release-drafter/release-drafter@569eb7ee3a85817ab916c8f8ff03a5bd96c9c83e # v5.23.0
1414
env:
1515
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-prep.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,50 +10,50 @@ jobs:
1010
build:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/checkout@v3
13+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
1414
- name: Get current date
1515
id: date
1616
run: echo "::set-output name=date::$(date +'%Y-%m-%d')"
1717
- name: Set current release version env variable
1818
run: |
1919
echo "CURRENT_VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)" >> $GITHUB_ENV
2020
- name: Find and Replace ${{ env.CURRENT_VERSION }} with ${{ github.event.inputs.targetRelease }} in mkdocs.yml
21-
uses: jacobtomlinson/gha-find-replace@v2
21+
uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2.0.0
2222
with:
2323
find: 'version: ${{ env.CURRENT_VERSION }}'
2424
replace: 'version: ${{ github.event.inputs.targetRelease }}'
2525
regex: false
2626
include: "mkdocs.yml"
2727
- name: Find and Replace ${{ env.CURRENT_VERSION }} with ${{ github.event.inputs.targetRelease }} in main pom.xml
28-
uses: jacobtomlinson/gha-find-replace@v2
28+
uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2.0.0
2929
with:
3030
find: ${{ env.CURRENT_VERSION }}
3131
replace: ${{ github.event.inputs.targetRelease }}
3232
regex: false
3333
include: "pom.xml"
3434
- name: Find and Replace ${{ env.CURRENT_VERSION }} with ${{ github.event.inputs.targetRelease }} in modules pom.xml
35-
uses: jacobtomlinson/gha-find-replace@v2
35+
uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2.0.0
3636
with:
3737
find: ${{ env.CURRENT_VERSION }}
3838
replace: ${{ github.event.inputs.targetRelease }}
3939
regex: false
4040
include: "**/*pom.xml"
4141
- name: Find and Replace ${{ env.CURRENT_VERSION }} with ${{ github.event.inputs.targetRelease }} in build.gradle
42-
uses: jacobtomlinson/gha-find-replace@v2
42+
uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2.0.0
4343
with:
4444
find: ${{ env.CURRENT_VERSION }}
4545
replace: ${{ github.event.inputs.targetRelease }}
4646
regex: false
4747
include: "**/*build.gradle"
4848
- name: Find and Replace ${{ env.CURRENT_VERSION }} with ${{ github.event.inputs.targetRelease }} in README.md
49-
uses: jacobtomlinson/gha-find-replace@v2
49+
uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2.0.0
5050
with:
5151
find: ${{ env.CURRENT_VERSION }}
5252
replace: ${{ github.event.inputs.targetRelease }}
5353
regex: false
5454
include: "README.md"
5555
- name: Create changelog placeholder for ${{ github.event.inputs.targetRelease }}
56-
uses: jacobtomlinson/gha-find-replace@v2
56+
uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2.0.0
5757
with:
5858
find: '## [Unreleased]'
5959
replace: |
@@ -66,7 +66,7 @@ jobs:
6666
regex: false
6767
include: CHANGELOG.md
6868
- name: Create Release Pull Request
69-
uses: peter-evans/create-pull-request@v3
69+
uses: peter-evans/create-pull-request@18f7dc018cc2cd597073088f7c7591b9d1c02672 # v3.14.0
7070
with:
7171
commit-message: chore:prep release ${{ github.event.inputs.targetRelease }}
7272
token: ${{ secrets.RELEASE }}

‎.github/workflows/run-e2e-tests.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,15 +41,15 @@ jobs:
4141
id-token: write # needed to interact with GitHub's OIDC Token endpoint.
4242
contents: read
4343
steps:
44-
- uses: actions/checkout@v3
44+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
4545
- name: Setup java
46-
uses: actions/setup-java@v3
46+
uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3.11.0
4747
with:
4848
distribution: 'corretto'
4949
java-version: ${{ matrix.java }}
5050
cache: maven
5151
- name: Setup AWS credentials
52-
uses: aws-actions/configure-aws-credentials@v1.6.1
52+
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
5353
with:
5454
role-to-assume: ${{ secrets.AWS_ROLE_ARN_TO_ASSUME }}
5555
aws-region: ${{ env.AWS_DEFAULT_REGION }}

‎.github/workflows/secure_workflows.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Lockdown untrusted workflows
2+
3+
# PROCESS
4+
#
5+
# 1. Scans for any external GitHub Action being used without version pinning (@<commit-sha> vs @v3)
6+
# 2. Scans for insecure practices for inline bash scripts (shellcheck)
7+
# 3. Fail CI and prevent PRs to be merged if any malpractice is found
8+
9+
# USAGE
10+
#
11+
# Always triggered on new PR, PR changes and PR merge.
12+
13+
14+
on:
15+
push:
16+
paths:
17+
- ".github/workflows/**"
18+
pull_request:
19+
paths:
20+
- ".github/workflows/**"
21+
22+
jobs:
23+
enforce_pinned_workflows:
24+
name: Harden Security
25+
runs-on: ubuntu-latest
26+
permissions:
27+
contents: read # checkout code and subsequently GitHub action workflows
28+
steps:
29+
- name: Checkout code
30+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
31+
- name: Ensure 3rd party workflows have SHA pinned
32+
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@555a30da2656b4a7cf47b107800bef097723363e # v2.1.3

0 commit comments

Comments
 (0)