Skip to content

Commit 490f19b

Browse files
bacciottibacciotti
authored
[COST-5517] Applying security best practices in GH actions (#5333)
* Applying security best practices.
1 parent 70a48ce commit 490f19b

File tree

3 files changed

+74
-67
lines changed

3 files changed

+74
-67
lines changed

‎.github/workflows/check-image.yml

-34
This file was deleted.

‎.github/workflows/ci.yml

+50-17
Original file line numberDiff line numberDiff line change
@@ -8,22 +8,31 @@ on:
88
branches:
99
- main
1010

11+
permissions:
12+
contents: read
13+
issues: write
14+
1115
jobs:
1216
sanity:
1317
name: Sanity
1418
runs-on: ubuntu-20.04
1519

1620
steps:
21+
- name: Harden Runner
22+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
23+
with:
24+
egress-policy: audit
25+
1726
- name: Checkout
18-
uses: actions/[email protected]
27+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
1928

2029
- name: Install Python
21-
uses: actions/[email protected]
30+
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
2231
with:
2332
python-version: '3.11'
2433

2534
- name: Run pre-commit checks
26-
uses: pre-commit/[email protected]
35+
uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
2736
env:
2837
SETUPTOOLS_USE_DISTUTILS: stdlib
2938

@@ -35,8 +44,13 @@ jobs:
3544
runs-on: ubuntu-20.04
3645

3746
steps:
47+
- name: Harden Runner
48+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
49+
with:
50+
egress-policy: audit
51+
3852
- name: Checkout
39-
uses: actions/[email protected]
53+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
4054
with:
4155
fetch-depth: 0
4256

@@ -57,7 +71,7 @@ jobs:
5771

5872
- name: Get changed files
5973
id: changed-files
60-
uses: tj-actions/[email protected]
74+
uses: tj-actions/changed-files@d6babd6899969df1a11d14c368283ea4436bca78 # v44.5.2
6175
with:
6276
files_from_source_file: docker-files.txt
6377

@@ -70,7 +84,7 @@ jobs:
7084
7185
- name: Setting smokes-required label
7286
if: env.RUN_TESTS == 'true'
73-
uses: actions/[email protected]
87+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
7488
continue-on-error: true
7589
with:
7690
script: |
@@ -89,7 +103,7 @@ jobs:
89103
90104
- name: Remove smokes-required label
91105
if: env.RUN_TESTS != 'true'
92-
uses: actions/[email protected]
106+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
93107
continue-on-error: true
94108
with:
95109
script: |
@@ -113,14 +127,19 @@ jobs:
113127
run_tests: ${{ steps.check-files-or-fork.outputs.run_tests }}
114128

115129
steps:
130+
- name: Harden Runner
131+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
132+
with:
133+
egress-policy: audit
134+
116135
- name: Checkout
117-
uses: actions/[email protected]
136+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
118137
with:
119138
fetch-depth: 0
120139

121140
- name: Get changed files
122141
id: changed-files
123-
uses: tj-actions/[email protected]
142+
uses: tj-actions/changed-files@d6babd6899969df1a11d14c368283ea4436bca78 # v44.5.2
124143
with:
125144
files: |
126145
db_functions/**
@@ -158,9 +177,14 @@ jobs:
158177
COMPOSE_FILE: .github/postgres/docker-compose.yaml
159178

160179
steps:
180+
- name: Harden Runner
181+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
182+
with:
183+
egress-policy: audit
184+
161185
- name: Checkout
162186
if: needs.changed-files.outputs.run_tests == 'true'
163-
uses: actions/[email protected]
187+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
164188
with:
165189
fetch-depth: 0
166190

@@ -174,7 +198,7 @@ jobs:
174198

175199
- name: Set up Python ${{ matrix.python-version }}
176200
if: needs.changed-files.outputs.run_tests == 'true'
177-
uses: actions/[email protected]
201+
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
178202
with:
179203
python-version: ${{ matrix.python-version }}
180204

@@ -185,7 +209,7 @@ jobs:
185209
- name: Cache dependencies
186210
if: needs.changed-files.outputs.run_tests == 'true'
187211
id: cache-dependencies
188-
uses: actions/[email protected]
212+
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
189213
with:
190214
path: |
191215
~/.cache/pipenv
@@ -243,35 +267,44 @@ jobs:
243267

244268
- name: Upload test coverage file
245269
if: steps.unit_tests_run.outcome == 'success'
246-
uses: actions/[email protected]
270+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
247271
with:
248272
name: coverage
249273
path: coverage.xml
250274
overwrite: true
251275

252276
coverage:
253277
name: Coverage
254-
needs: [changed-files,units]
278+
needs: [ changed-files,units ]
255279
runs-on: ubuntu-20.04
280+
permissions:
281+
contents: write
282+
statuses: write
283+
256284
steps:
257285

286+
- name: Harden Runner
287+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
288+
with:
289+
egress-policy: audit
290+
258291
- name: Checkout
259292
# this checkout is required for the coverage report. If we don't do this, then
260293
# the uploaded report is invalid and codecov doesn't know how to process it.
261294
if: needs.changed-files.outputs.run_tests == 'true'
262-
uses: actions/[email protected]
295+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
263296
with:
264297
fetch-depth: 0
265298

266299
- name: Download coverage result from units
267300
if: needs.changed-files.outputs.run_tests == 'true'
268-
uses: actions/[email protected]
301+
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
269302
with:
270303
name: coverage
271304

272305
- name: Upload coverage to Codecov
273306
if: needs.changed-files.outputs.run_tests == 'true'
274-
uses: codecov/[email protected]
307+
uses: codecov/codecov-action@125fc84a9a348dbcf27191600683ec096ec9021c # v4.4.1
275308
env:
276309
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
277310
with:

‎.github/workflows/pre-release.yaml

+24-16
Original file line numberDiff line numberDiff line change
@@ -7,34 +7,42 @@ on:
77
description: 'Release commit'
88
required: true
99

10+
permissions:
11+
contents: write
12+
1013
jobs:
1114
pre-release:
1215
name: Pre-release
1316
runs-on: ubuntu-20.04
1417

1518
steps:
19+
- name: Harden Runner
20+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
21+
with:
22+
egress-policy: audit
23+
1624
- name: Checkout
17-
uses: actions/[email protected]
25+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
1826
with:
1927
fetch-depth: 0
2028

2129
- name: Determine minor version
2230
id: tag-setter
2331
run: |
24-
DATE=$(date +"%Y.%m.%d")
25-
PREV_RELEASE=$(git tag --list | tail -1)
26-
PREV_DATE="${PREV_RELEASE%.*}"
27-
MINOR_VERSION=0
28-
case $PREV_DATE in
29-
*"$DATE"*)
30-
MINOR_VERSION=${PREV_RELEASE##*.}
31-
MINOR_VERSION=$((MINOR_VERSION+1))
32-
;;
33-
*)
34-
MINOR_VERSION=0
35-
;;
36-
esac
37-
echo "TAG_VERSION=r.$DATE.$MINOR_VERSION" >> $GITHUB_ENV
32+
DATE=$(date +"%Y.%m.%d")
33+
PREV_RELEASE=$(git tag --list | tail -1)
34+
PREV_DATE="${PREV_RELEASE%.*}"
35+
MINOR_VERSION=0
36+
case $PREV_DATE in
37+
*"$DATE"*)
38+
MINOR_VERSION=${PREV_RELEASE##*.}
39+
MINOR_VERSION=$((MINOR_VERSION+1))
40+
;;
41+
*)
42+
MINOR_VERSION=0
43+
;;
44+
esac
45+
echo "TAG_VERSION=r.$DATE.$MINOR_VERSION" >> $GITHUB_ENV
3846
3947
- name: Set the release commit
4048
run: echo "RELEASE_COMMIT=${{ github.event.inputs.commit }}" >> $GITHUB_ENV
@@ -43,7 +51,7 @@ jobs:
4351
run: bash .github/scripts/get_description.sh
4452

4553
- name: Set release body
46-
uses: ncipollo/[email protected]
54+
uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0
4755
with:
4856
bodyFile: release_body.md
4957
commit: ${{ github.event.inputs.commit }}

0 commit comments

Comments
 (0)