Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[StepSecurity] ci: Harden GitHub Actions #36

Closed
wants to merge 15 commits into from
Closed

[StepSecurity] ci: Harden GitHub Actions #36

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
369fb5f
[StepSecurity] ci: Harden GitHub Actions
step-security-bot Mar 14, 2024
a245732
* Apply a small fix before doing more testing J:DEF-160
JPLachance Mar 22, 2024
c4feff1
* Grant missing permissions J:DEF-160
JPLachance Mar 22, 2024
b88ceb6
* Test another thing J:DEF-160
JPLachance Mar 22, 2024
15e4317
Merge branch 'main' into stepsecurity_remediation_1710452002
JPLachance Mar 22, 2024
0ff46f2
* Another day, another test J:DEF-160
JPLachance Mar 22, 2024
1935fcf
Merge remote-tracking branch 'step-security-bot/stepsecurity_remediat…
JPLachance Mar 22, 2024
82f0c93
* Hardening stuff is not easy J:DEF-160
JPLachance Mar 22, 2024
75b815b
* Keep things simple for now J:DEF-160
JPLachance Mar 22, 2024
9d0645a
* Woops J:DEF-160
JPLachance Mar 22, 2024
c1dad85
* Do a troll test J:DEF-160
JPLachance Mar 22, 2024
211d96d
* Another test for the road J:DEF-160
JPLachance Mar 22, 2024
468ab8e
* I'm about to give up J:DEF-160
JPLachance Mar 22, 2024
274776c
* Ok, I give up J:DEF-160
JPLachance Mar 22, 2024
53536e0
* Add a missing test J:DEF-160
JPLachance Mar 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/dependency-review.yml
View file
Open in desktop
JPLachance marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -23,17 +23,17 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout scan target
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Checkout licenses
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
repository: coveo/dependency-allowed-licenses
path: coveo-dependency-allowed-licenses

- name: Select configuration
id: select-config
uses: actions/github-script@v7
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
env:
INPUTS: ${{ toJSON(inputs) }}
with:
Expand All @@ -53,7 +53,7 @@ jobs:
core.setFailure(`Could not determine configuration for inputs: ${inputs}`)

- name: Scan
uses: actions/dependency-review-action@v4
uses: actions/dependency-review-action@9129d7d40b8c12c1ed0f60400d00c92d437adcce # v4.1.3
with:
comment-summary-in-pr: ${{ inputs.comment-summary-in-pr }}
fail-on-severity: high
Expand Down
11 changes: 7 additions & 4 deletions .github/workflows/java-maven-openjdk-codeql.yml
View file
Open in desktop
JPLachance marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,9 @@ on:
required: true
type: number

permissions:
contents: read

jobs:
analyze-java:
name: Analyze Java
Expand All @@ -44,15 +47,15 @@ jobs:
- run: echo "HOME=/root" >> $GITHUB_ENV

- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Initialize CodeQL
uses: github/codeql-action/init@v3
uses: github/codeql-action/init@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
with:
languages: java

- name: Cache maven dependencies
uses: actions/cache@v4
uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
with:
path: ~/.m2
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
Expand All @@ -63,6 +66,6 @@ jobs:
run: mvn ${{ inputs.mvn-additional-arguments }} -T1C --also-make --batch-mode --strict-checksums --update-snapshots -Dmaven.gitcommitid.skip=true -DskipTests clean test-compile

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
uses: github/codeql-action/analyze@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
with:
category: "/language:java"
9 changes: 6 additions & 3 deletions .github/workflows/java-maven-openjdk-dependency-submission.yml
View file
Open in desktop
JPLachance marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,9 @@ on:
required: true
type: number

permissions:
contents: read

jobs:
submit-dependencies:
name: Submit dependencies
Expand All @@ -41,18 +44,18 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Cache maven dependencies
uses: actions/cache@v4
uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
with:
path: ~/.m2
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: |
${{ runner.os }}-maven-

- name: Submit Dependency Snapshot
uses: advanced-security/maven-dependency-submission-action@v3
uses: advanced-security/maven-dependency-submission-action@fcd7eab6b6d22946badc98d1e62665cdee93e0ae # v3.0.3
with:
directory: ${{ inputs.directory }}
maven-args: -Dscopes=compile,provided,runtime,system
Loading