Read GitHub Action' "security hardening" guide and act on it

[paulo-ferraz-oliveira]

Is your feature request related to a problem?

Potential problems, yes...

Describe the feature you'd like

Give https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions a good read an act on it; otherwise create issues in this repo. to have actions to improve in the future.

Describe alternatives you've considered

None.

Additional context

Not available.

[paulo-ferraz-oliveira]

And also: https://cycode.com/blog/github-actions-vulnerabilities/

[paulo-ferraz-oliveira]

I'm starting to read now.

[paulo-ferraz-oliveira]

The stuff I looked at, from GitHub's guide...

• no secrets
  • we mention secrets.GITHUB_TOKEN, but that's supposed to be secure per GitHub itself
  • also acted on Permissions for the GITHUB_TOKEN
  • no security risk detected
• codeowners
  • not taken into account, for the moment
  • no security risk detected
• script injections
  • no direct source of code injection (for our workflows) was identified
• Settings > Code security and analysis
  • acted on
  • no security risk detected
• third-party software
  • it's possible injection is done, at the moment, from:
    • actions/checkout
    • softprops/action-gh-release
    • Homebrew
    • kerl
    • check Vendor in third party actions #3
    • check Vendor in kerl and Homebrew #5
  • low security risk detected given the sources of risk
• GitHub actions creation and approval of pull requests
  • this is in effect in our repository, for automation purposes
  • in any case the pull request is created in main so whatever causes it was already there
    before
  • we check the repository regularly for updates (especially since automation is involved) but
    there's still the possibility some slips through the cracks (even though it should be noticeable
    starting from GitHub notifications)
  • low security risk detected
• compromised runner
  • while we can't control "the runner" everything else we can probably remove and mimic code
    in the action (individual Issues will be open for each of these)
  • we have no secrets stored, nor should we need these in the near future, since all we do is based
    on open source and publically available information
  • low security risk detected given the sources of risk