Skip to content

Commit dd7171c

Browse files
step-security-botutpilla
step-security-bot
and
utpilla
authored
ci: [StepSecurity] Harden GitHub Actions (#242)
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: Utkarsh Umesan Pillai <66651184+utpilla@users.noreply.github.com>
1 parent cbb2606 commit dd7171c

File tree

4 files changed

+81
-26
lines changed

4 files changed

+81
-26
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 65 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -29,23 +29,28 @@ jobs:
2929
runs-on: ${{ matrix.os }}
3030
continue-on-error: ${{ matrix.rust == 'beta' }}
3131
steps:
32+
- name: Harden the runner (Audit all outbound calls)
33+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
34+
with:
35+
egress-policy: audit
36+
3237
- name: Free disk space
3338
if: ${{ matrix.os == 'ubuntu-latest'}}
3439
run: |
3540
df -h
3641
sudo rm -rf /usr/local/lib/android
3742
sudo rm -rf /usr/share/dotnet
3843
df -h
39-
- uses: actions/checkout@v4
44+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4045
with:
4146
submodules: true
42-
- uses: dtolnay/rust-toolchain@master
47+
- uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0
4348
with:
4449
toolchain: ${{ matrix.rust }}
4550
components: rustfmt
4651
- name: "Set rustup profile"
4752
run: rustup set profile minimal
48-
- uses: arduino/setup-protoc@v3
53+
- uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
4954
with:
5055
repo-token: ${{ secrets.GITHUB_TOKEN }}
5156
- name: Test (Windows)
@@ -62,14 +67,19 @@ jobs:
6267
os: [ubuntu-latest, windows-latest, macos-latest, ubuntu-22.04-arm]
6368
runs-on: ${{ matrix.os }}
6469
steps:
65-
- uses: actions/checkout@v4
70+
- name: Harden the runner (Audit all outbound calls)
71+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
72+
with:
73+
egress-policy: audit
74+
75+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6676
with:
6777
submodules: true
68-
- uses: dtolnay/rust-toolchain@master
78+
- uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0
6979
with:
7080
toolchain: stable
7181
components: rustfmt,clippy
72-
- uses: arduino/setup-protoc@v3
82+
- uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
7383
with:
7484
repo-token: ${{ secrets.GITHUB_TOKEN }}
7585
- name: Format
@@ -92,14 +102,19 @@ jobs:
92102
runs-on: ${{ matrix.os }}
93103
continue-on-error: true
94104
steps:
95-
- uses: actions/checkout@v4
105+
- name: Harden the runner (Audit all outbound calls)
106+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
107+
with:
108+
egress-policy: audit
109+
110+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
96111
with:
97112
submodules: true
98113
- name: Set up Rust ${{ matrix.rust }}
99-
uses: dtolnay/rust-toolchain@master
114+
uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0
100115
with:
101116
toolchain: ${{ matrix.rust }}
102-
- uses: taiki-e/install-action@v2
117+
- uses: taiki-e/install-action@a48a50298f98c47e46a957ae6f82c44cc4878e42 # v2.49.47
103118
with:
104119
tool: cargo-msrv
105120
- name: Patch dependencies versions (Unix)
@@ -115,19 +130,29 @@ jobs:
115130
runs-on: ubuntu-latest
116131
continue-on-error: true # Prevent sudden announcement of a new advisory from failing ci
117132
steps:
118-
- uses: actions/checkout@v4
119-
- uses: EmbarkStudios/cargo-deny-action@v2
133+
- name: Harden the runner (Audit all outbound calls)
134+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
135+
with:
136+
egress-policy: audit
137+
138+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
139+
- uses: EmbarkStudios/cargo-deny-action@34899fc7ba81ca6268d5947a7a16b4649013fea1 # v2.0.11
120140
with:
121141
command: check advisories
122142
docs:
123143
continue-on-error: true
124144
runs-on: ubuntu-latest
125145
steps:
126-
- uses: actions/checkout@v4
127-
- uses: dtolnay/rust-toolchain@master
146+
- name: Harden the runner (Audit all outbound calls)
147+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
148+
with:
149+
egress-policy: audit
150+
151+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
152+
- uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0
128153
with:
129154
toolchain: stable
130-
- uses: arduino/setup-protoc@v3
155+
- uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
131156
with:
132157
repo-token: ${{ secrets.GITHUB_TOKEN }}
133158
- name: doc
@@ -139,38 +164,48 @@ jobs:
139164
continue-on-error: true
140165
runs-on: ubuntu-latest
141166
steps:
142-
- uses: actions/checkout@v4
167+
- name: Harden the runner (Audit all outbound calls)
168+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
169+
with:
170+
egress-policy: audit
171+
172+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
143173
with:
144174
submodules: true
145-
- uses: dtolnay/rust-toolchain@master
175+
- uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0
146176
with:
147177
toolchain: stable
148178
components: llvm-tools-preview
149-
- uses: arduino/setup-protoc@v3
179+
- uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
150180
with:
151181
repo-token: ${{ secrets.GITHUB_TOKEN }}
152182
- name: cargo install cargo-llvm-cov
153-
uses: taiki-e/install-action@cargo-llvm-cov
183+
uses: taiki-e/install-action@9cfaca2426fcec262716306a13a478bd3b36200f # cargo-llvm-cov
154184
- name: cargo generate-lockfile
155185
if: hashFiles('Cargo.lock') == ''
156186
run: cargo generate-lockfile
157187
- name: cargo llvm-cov
158188
run: cargo llvm-cov --locked --all-features --workspace --lcov --output-path lcov.info
159189
- name: Upload to codecov.io
160-
uses: codecov/codecov-action@v4
190+
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
161191
with:
162192
fail_ci_if_error: true
163193
cargo-machete:
164194
continue-on-error: true
165195
runs-on: ubuntu-latest
166196
steps:
167-
- uses: actions/checkout@v4
197+
- name: Harden the runner (Audit all outbound calls)
198+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
199+
with:
200+
egress-policy: audit
201+
202+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
168203
with:
169204
submodules: true
170-
- uses: dtolnay/rust-toolchain@master
205+
- uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0
171206
with:
172207
toolchain: stable
173-
- uses: taiki-e/install-action@v2
208+
- uses: taiki-e/install-action@a48a50298f98c47e46a957ae6f82c44cc4878e42 # v2.49.47
174209
with:
175210
tool: cargo-machete
176211
- name: cargo machete
@@ -179,13 +214,18 @@ jobs:
179214
continue-on-error: true
180215
runs-on: ubuntu-latest
181216
steps:
182-
- uses: actions/checkout@v4
217+
- name: Harden the runner (Audit all outbound calls)
218+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
219+
with:
220+
egress-policy: audit
221+
222+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
183223
with:
184224
submodules: true
185-
- uses: dtolnay/rust-toolchain@master
225+
- uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0
186226
with:
187227
toolchain: stable
188-
- uses: taiki-e/install-action@v2
228+
- uses: taiki-e/install-action@a48a50298f98c47e46a957ae6f82c44cc4878e42 # v2.49.47
189229
with:
190230
tool: cargo-workspace-lints
191231
- name: cargo workspace-lints

‎.github/workflows/fossa.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,11 @@ jobs:
1212
fossa:
1313
runs-on: ubuntu-latest
1414
steps:
15+
- name: Harden the runner (Audit all outbound calls)
16+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
17+
with:
18+
egress-policy: audit
19+
1520
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1621

1722
- uses: fossas/fossa-action@93a52ecf7c3ac7eb40f5de77fd69b1a19524de94 # v1.5.0

‎.github/workflows/ossf-scorecard.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ jobs:
1919
# Needed for GitHub OIDC token if publish_results is true
2020
id-token: write
2121
steps:
22+
- name: Harden the runner (Audit all outbound calls)
23+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
24+
with:
25+
egress-policy: audit
26+
2227
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2328
with:
2429
persist-credentials: false

‎.github/workflows/pr_naming.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,13 @@ jobs:
88
validate-pr-title:
99
runs-on: ubuntu-latest
1010
steps:
11+
- name: Harden the runner (Audit all outbound calls)
12+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
13+
with:
14+
egress-policy: audit
15+
1116
- name: PR Conventional Commit Validation
12-
uses: ytanikin/pr-conventional-commits@1.4.1
17+
uses: ytanikin/pr-conventional-commits@8267db1bacc237419f9ed0228bb9d94e94271a1d # 1.4.1
1318
with:
1419
task_types: '["build","chore","ci","docs","feat","fix","perf","refactor","revert","test"]'
1520
add_label: 'false'

0 commit comments

Comments
 (0)