chore(ci): harden github actions #229
Conversation
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
WalkthroughAdds two GitHub Actions workflows for CodeQL and dependency review, updates permissions in an existing workflow, and introduces a pre-commit gitleaks hook. Changes
Sequence Diagram(s)sequenceDiagram
actor Dev as Developer
participant GH as GitHub
participant W1 as Workflow: CodeQL
participant W2 as Workflow: Dependency Review
participant W3 as Workflow: main.yaml (tests)
Dev->>GH: Push / Pull Request / Schedule
alt PR to main
GH-->>W1: Trigger CodeQL
GH-->>W2: Trigger Dependency Review
GH-->>W3: Trigger tests
else Push to main
GH-->>W1: Trigger CodeQL
GH-->>W3: Trigger tests
end
rect rgba(200,230,255,0.25)
note over W1: CodeQL
W1->>W1: actions/checkout@<sha>
W1->>W1: init CodeQL (language: python)
W1->>W1: analyze
note over W1: permissions: contents/actions/security-events
end
rect rgba(200,255,200,0.25)
note over W2: Dependency Review
W2->>W2: actions/checkout@<sha>
W2->>W2: dependency-review-action@<sha>
note over W2: permissions: contents: read
end
rect rgba(255,245,200,0.25)
note over W3: Tests
W3->>W3: actions per existing config
note over W3: permissions: contents: read (top-level & job)
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/main.yaml (1)
68-75: Publish job is missing contents: read; checkout will failJob-level permissions override defaults. With only id-token: write, actions/checkout lacks contents: read and will error. Add contents: read.
publish: runs-on: ubuntu-latest if: startsWith(github.ref, 'refs/tags/v') needs: [test] permissions: - id-token: write # Required for PyPI trusted publishing + contents: read # Required by actions/checkout + id-token: write # Required for PyPI trusted publishingOptionally, remove the top-level permissions and define per-job permissions for tighter scope.
🧹 Nitpick comments (4)
.pre-commit-config.yaml (1)
1-5: Enable secret redaction and run in CI stagesAdd gitleaks redact to avoid printing findings; optionally run on push to enforce in CI.
repos: - repo: https://github.com/gitleaks/gitleaks rev: v8.16.3 hooks: - - id: gitleaks + - id: gitleaks + args: ["--redact"] + stages: [commit, push]Optional next: add basic hygiene hooks (trailing-whitespace, end-of-file-fixer, check-yaml) in a follow-up.
.github/workflows/dependency-review.yml (1)
21-22: Fail builds on actionable severities and surface PR feedbackConfigure the action to fail on at least high severity and comment the summary in PRs.
- - name: 'Dependency Review' - uses: actions/dependency-review-action@56339e523c0409420f6c2c9a2f4292bbb3c07dd3 # v4.8.0 + - name: 'Dependency Review' + uses: actions/dependency-review-action@56339e523c0409420f6c2c9a2f4292bbb3c07dd3 # v4.8.0 + with: + fail-on-severity: high + comment-summary-in-pr: true.github/workflows/codeql.yml (2)
43-45: Align checkout version to v5 for consistencymain.yaml uses actions/checkout v5. Use the same here for consistency and Node20 baseline.
- - name: Checkout repository - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
55-59: Autobuild not needed for PythonFor Python-only repos, Autobuild is unnecessary. Safe to remove to trim runtime.
- - name: Autobuild - uses: github/codeql-action/autobuild@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6 + # Autobuild is not required for Python; remove if not building compiled components.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/workflows/codeql.yml(1 hunks).github/workflows/dependency-review.yml(1 hunks).github/workflows/main.yaml(1 hunks).pre-commit-config.yaml(1 hunks)
🔇 Additional comments (1)
.github/workflows/main.yaml (1)
13-15: Top‑level least‑privilege default looks goodSetting contents: read by default is appropriate.
2 participants
Summary
This pull request is created by StepSecurity at the request of @rhamzeh. Please merge the Pull Request to incorporate the requested changes. Please tag @rhamzeh on your message if you have any questions related to the PR.
Security Fixes
Least Privileged GitHub Actions Token Permissions
The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API. GitHub recommends setting minimum token permissions for the GITHUB_TOKEN.
Detect Vulnerabilities with SAST Workflow
Static Code Analysis (also known as Source Code Analysis) is usually performed as part of a Code Review (also known as clear-box testing) and is carried out at the Implementation phase of a Security Development Lifecycle (SDL). Static Code Analysis commonly refers to the running of Static Code Analysis tools that attempt to highlight possible vulnerabilities within ‘static’ (non-running) source code by using techniques such as Taint Analysis and Data Flow Analysis.
Add Dependency Review Workflow
The Dependency Review Workflow enforces dependency reviews on your pull requests. The action scans for vulnerable versions of dependencies introduced by package version changes in pull requests, and warns you about the associated security vulnerabilities. This gives you better visibility of what's changing in a pull request, and helps prevent vulnerabilities being added to your repository.
Maintain Code Quality with Pre-Commit
Pre-commit is a framework for managing and maintaining multi-language pre-commit hooks. Hooks can be any scripts, code, or binaries that run at any stage of the git workflow. Pre-commit hooks are useful for enforcing code quality, code formatting, and detecting security vulnerabilities.
Feedback
For bug reports, feature requests, and general feedback; please email support@stepsecurity.io. To create such PRs, please visit https://app.stepsecurity.io/securerepo.
Signed-off-by: StepSecurity Bot bot@stepsecurity.io
Summary by CodeRabbit