Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[StepSecurity] Apply security best practices #42

Merged
merged 6 commits into from
Nov 6, 2024
Merged

[StepSecurity] Apply security best practices #42

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d65905c
[StepSecurity] Apply security best practices
step-security-bot Nov 6, 2024
b53778c
Delete .github/dependabot.yml
babenek Nov 6, 2024
2198e56
Delete .github/workflows/codeql.yml
babenek Nov 6, 2024
4594511
Delete .github/workflows/dependency-review.yml
babenek Nov 6, 2024
7d5cdd3
Delete .github/workflows/scorecards.yml
babenek Nov 6, 2024
68a7fdb
Delete .pre-commit-config.yaml
babenek Nov 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions .github/workflows/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,19 @@ jobs:

steps:

- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit

- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.event.pull_request.head.sha }}

- name: CredSweeper test
# TODO: change @action to release point with the action
uses: Samsung/CredSweeper@main
uses: Samsung/CredSweeper@8682ea7d68bf3dfe96e2ea1fad3f04b9b167993b # main
with:
# args - arguments to credsweeper tool. See default values in action.yml
args: --path ./tests/samples/ --save-json
Expand All @@ -40,7 +45,7 @@ jobs:

- name: CredSweeper report
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: output.json
path: output.json
Expand Down
70 changes: 49 additions & 21 deletions .github/workflows/benchmark.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,9 @@ on:
pull_request:
branches: [ main ]

permissions:
contents: read

jobs:

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
Expand All @@ -19,8 +22,13 @@ jobs:

steps:

- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit

- name: Checkout CredData
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: Samsung/CredData

Expand All @@ -34,14 +42,14 @@ jobs:

- name: Cache data
id: cache-data
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: data
key: cred-data-${{ hashFiles('checksums.md5') }}

- name: Set up Python 3.10
if: steps.cache-data.outputs.cache-hit != 'true'
uses: actions/setup-python@v4
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
with:
python-version: "3.10"

Expand Down Expand Up @@ -69,8 +77,13 @@ jobs:

steps:

- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit

- name: Checkout CredData
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: Samsung/CredData

Expand All @@ -84,7 +97,7 @@ jobs:

- name: Cache data
id: cache-data
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: data
key: cred-data-${{ hashFiles('checksums.md5') }}
Expand All @@ -98,7 +111,7 @@ jobs:
run: ls -al . && ls -al data

- name: Set up Python 3.10
uses: actions/setup-python@v4
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
with:
python-version: "3.10"

Expand All @@ -109,7 +122,7 @@ jobs:
run: python -m pip install --requirement requirements.txt

- name: Checkout CredSweeper
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.event.pull_request.head.sha }}
path: temp/CredSweeper
Expand All @@ -129,21 +142,21 @@ jobs:

- name: Upload CredSweeper log
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: credsweeper
path: credsweeper.${{ github.event.pull_request.head.sha }}.log

- name: Upload CredSweeper report
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: report
path: report.${{ github.event.pull_request.head.sha }}.json

- name: Upload benchmark output
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: benchmark
path: benchmark.${{ github.event.pull_request.head.sha }}.log
Expand All @@ -166,8 +179,13 @@ jobs:

steps:

- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit

- name: Checkout CredData
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: Samsung/CredData

Expand All @@ -181,7 +199,7 @@ jobs:

- name: Cache data
id: cache-data
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: data
key: cred-data-${{ hashFiles('checksums.md5') }}
Expand All @@ -195,7 +213,7 @@ jobs:
run: rm -rf data/0* data/2* data/7* data/8* data/a* data/b* data/d* data/e* data/f*

- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v4
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
with:
python-version: ${{ matrix.python-version }}

Expand Down Expand Up @@ -231,7 +249,7 @@ jobs:
python -m pip uninstall -y credsweeper

- name: Checkout base CredSweeper
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.event.pull_request.base.sha }}
path: temp/CredSweeper.base
Expand All @@ -257,7 +275,7 @@ jobs:
echo "BASE_TIME=${BASE_TIME}" >> $GITHUB_ENV

- name: Checkout current CredSweeper
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.event.pull_request.head.sha }}
path: temp/CredSweeper.head
Expand Down Expand Up @@ -348,8 +366,13 @@ jobs:

steps:

- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit

- name: Checkout CredData
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: Samsung/CredData

Expand All @@ -363,7 +386,7 @@ jobs:

- name: Cache data
id: cache-data
uses: actions/cache@v4
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: data
key: cred-data-${{ hashFiles('checksums.md5') }}
Expand All @@ -382,15 +405,15 @@ jobs:

- name: Set up Python 3.10
if: steps.cache-data.outputs.cache-hit != 'true'
uses: actions/setup-python@v3
uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3.1.4
with:
python-version: "3.10"

- name: Update PIP
run: python -m pip install --upgrade pip

- name: Checkout current CredSweeper
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.event.pull_request.head.sha }}
path: CredSweeper.head
Expand Down Expand Up @@ -435,15 +458,20 @@ jobs:
runs-on: ubuntu-latest
if: ${{ 'push' == github.event_name }} or ${{ 'Samsung/CredSweeper' == github.event.pull_request.head.repo.full_name }}
steps:
- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit

- name: Checkout CredSweeper PR
if: ${{ 'pull_request' == github.event_name }}
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.event.pull_request.head.sha }}

- name: Checkout CredSweeper HEAD
if: ${{ 'push' == github.event_name }}
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.event.head }}

Expand Down
14 changes: 11 additions & 3 deletions .github/workflows/check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ on:
pull_request:
branches: [ main ]

permissions:
contents: read

jobs:

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
Expand All @@ -20,9 +23,14 @@ jobs:

# # # MUST be full history to check git workflow

- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit

- name: Checkout
id: code_checkout
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
Expand Down Expand Up @@ -66,7 +74,7 @@ jobs:
- name: Set up Python
if: ${{ always() && steps.code_checkout.conclusion == 'success' }}
id: setup_python
uses: actions/setup-python@v4
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
with:
python-version: "3.11"

Expand Down Expand Up @@ -166,7 +174,7 @@ jobs:

- name: FLAKE 8 reports
if: ${{ failure() && steps.test_flake8.conclusion == 'failure' }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: flake8_report
path: flake8.txt
Expand Down
18 changes: 13 additions & 5 deletions .github/workflows/fuzz.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,9 @@ on:
pull_request:
branches: [ main ]

permissions:
contents: read

jobs:

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
Expand All @@ -20,16 +23,21 @@ jobs:

steps:

- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit

- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.event.pull_request.head.sha }}

- name: Backup corpus
run: cp -r fuzz/corpus corpus.bak

- name: Set up Python
uses: actions/setup-python@v4
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
with:
python-version: "3.11"

Expand All @@ -46,7 +54,7 @@ jobs:

- name: Store coverage report
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: htmlcov
path: htmlcov
Expand All @@ -73,7 +81,7 @@ jobs:

- name: New corpus upload
if: ${{ env.NEW_CORPUS > 0 }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: new_corpus
path: new_corpus
Expand All @@ -96,7 +104,7 @@ jobs:

- name: Crash corpus upload
if: ${{ env.CRASH_CORPUS > 0 }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: crash_corpus
path: crash_corpus
Expand Down
14 changes: 11 additions & 3 deletions .github/workflows/pypi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,17 +11,25 @@ on:
release:
types: [ released ]

permissions:
contents: read

jobs:
deploy:
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit

- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.event.pull_request.head.sha }}

- name: Set up Python
uses: actions/setup-python@v4
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
with:
python-version: "3.8"

Expand All @@ -33,7 +41,7 @@ jobs:

- name: Publish
if: ${{ 'release' == github.event_name }}
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@61da13deb5f5124fb1536194f82ed3d9bbc7e8f3 # release/v1
with:
user: __token__
password: ${{ secrets.PYPI_PASSWORD }}
Loading
Loading