Skip to content

Commit 9f2015f

Browse files
stepsecurity-app[bot]stepsecurity-app[bot]
authored
[StepSecurity] Apply security best practices (#64)
Signed-off-by: StepSecurity Bot <[email protected]> Co-authored-by: stepsecurity-app[bot] <188008098+stepsecurity-app[bot]@users.noreply.github.com>
1 parent 287acd5 commit 9f2015f

File tree

5 files changed

+89
-86
lines changed

5 files changed

+89
-86
lines changed

‎.github/workflows/build-docker.yaml‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -43,27 +43,27 @@ jobs:
4343
amd64_labels: ${{ steps.amd64_meta.outputs.labels }}
4444
steps:
4545
- name: Harden the runner (Audit all outbound calls)
46-
uses: step-security/harden-runner@v2
46+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
4747
with:
4848
egress-policy: audit
4949

5050
- name: docker meta
5151
id: meta
52-
uses: docker/metadata-action@v5
52+
uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
5353
with:
5454
images: ${{ env.docker_images }}
5555
tags: ${{ env.docker_tags }}
5656
- name: docker arm64 meta
5757
id: arm64_meta
58-
uses: docker/metadata-action@v5
58+
uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
5959
with:
6060
images: ${{ env.docker_images }}
6161
tags: ${{ env.docker_tags }}
6262
flavor: |
6363
suffix=-${{ env.arch_arm64 }},onlatest=true
6464
- name: docker amd64 meta
6565
id: amd64_meta
66-
uses: docker/metadata-action@v5
66+
uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
6767
with:
6868
images: ${{ env.docker_images }}
6969
tags: ${{ env.docker_tags }}
@@ -74,19 +74,19 @@ jobs:
7474
runs-on: ubuntu-latest
7575
steps:
7676
- name: Harden the runner (Audit all outbound calls)
77-
uses: step-security/harden-runner@v2
77+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
7878
with:
7979
egress-policy: audit
8080

8181
- name: Download npm release package
82-
uses: actions/download-artifact@v4
82+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
8383
with:
8484
name: npm-release-package
8585
run-id: ${{ inputs.run_id }}
8686
github-token: ${{ secrets.PAT }}
8787

8888
- name: Download all release packages (optional)
89-
uses: actions/download-artifact@v4
89+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
9090
with:
9191
pattern: release-packages-*
9292
path: ./release-packages/
@@ -101,7 +101,7 @@ jobs:
101101
102102
- name: Upload artifacts for build job
103103
if: github.event_name == 'workflow_dispatch'
104-
uses: actions/upload-artifact@v4
104+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
105105
with:
106106
name: code-server-packages
107107
path: |
@@ -127,17 +127,17 @@ jobs:
127127
runs-on: ${{ matrix.build-config.os }}
128128
steps:
129129
- name: Harden the runner (Audit all outbound calls)
130-
uses: step-security/harden-runner@v2
130+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
131131
with:
132132
egress-policy: audit
133133

134134
- name: checkout
135-
uses: actions/checkout@v4
135+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
136136
with:
137137
lfs: true
138138

139139
- name: Download artifacts (if available)
140-
uses: actions/download-artifact@v4
140+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
141141
with:
142142
name: code-server-packages
143143
path: .
@@ -148,15 +148,15 @@ jobs:
148148
ls -la
149149
150150
- name: setup buildx
151-
uses: docker/setup-buildx-action@v3
151+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
152152
- name: docker login
153-
uses: docker/[email protected]
153+
uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
154154
with:
155155
username: ${{ secrets.DOCKERHUB_USERNAME }}
156156
password: ${{ secrets.DOCKERHUB_TOKEN }}
157157

158158
- name: docker build
159-
uses: rudderlabs/[email protected]
159+
uses: rudderlabs/build-scan-push-action@6da37ae441adc487f22920ca87bf52d6fd715fd3 # v1.5.3
160160
with:
161161
context: .
162162
platforms: ${{ matrix.build-config.platform }}
@@ -175,14 +175,14 @@ jobs:
175175
needs: [build, metadata]
176176
steps:
177177
- name: Harden the runner (Audit all outbound calls)
178-
uses: step-security/harden-runner@v2
178+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
179179
with:
180180
egress-policy: audit
181181

182182
- name: setup buildx
183-
uses: docker/setup-buildx-action@v3
183+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
184184
- name: docker login
185-
uses: docker/[email protected]
185+
uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
186186
with:
187187
username: ${{ secrets.DOCKERHUB_USERNAME }}
188188
password: ${{ secrets.DOCKERHUB_TOKEN }}

‎.github/workflows/build.yaml‎

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,12 @@ jobs:
3232
helm: ${{ steps.filter.outputs.helm }}
3333
steps:
3434
- name: Harden the runner (Audit all outbound calls)
35-
uses: step-security/harden-runner@v2
35+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
3636
with:
3737
egress-policy: audit
3838

3939
- name: Checkout repo
40-
uses: actions/checkout@v4
40+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
4141
- name: Check changed files
4242
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 #v3
4343
id: filter
@@ -70,12 +70,12 @@ jobs:
7070
timeout-minutes: 5
7171
steps:
7272
- name: Harden the runner (Audit all outbound calls)
73-
uses: step-security/harden-runner@v2
73+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
7474
with:
7575
egress-policy: audit
7676

77-
- uses: actions/checkout@v4
78-
- uses: actions/setup-node@v4
77+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
78+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
7979
with:
8080
node-version-file: .node-version
8181
cache: npm
@@ -93,12 +93,12 @@ jobs:
9393
if: needs.changes.outputs.docs == 'true'
9494
steps:
9595
- name: Harden the runner (Audit all outbound calls)
96-
uses: step-security/harden-runner@v2
96+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
9797
with:
9898
egress-policy: audit
9999

100-
- uses: actions/checkout@v4
101-
- uses: actions/setup-node@v4
100+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
101+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
102102
with:
103103
node-version-file: .node-version
104104
cache: npm
@@ -116,12 +116,12 @@ jobs:
116116
if: needs.changes.outputs.helm == 'true'
117117
steps:
118118
- name: Harden the runner (Audit all outbound calls)
119-
uses: step-security/harden-runner@v2
119+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
120120
with:
121121
egress-policy: audit
122122

123-
- uses: actions/checkout@v4
124-
- uses: azure/setup-helm@v4
123+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
124+
- uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
125125
with:
126126
token: ${{ secrets.PAT }}
127127
- run: helm plugin install https://github.com/instrumenta/helm-kubeval
@@ -135,12 +135,12 @@ jobs:
135135
if: needs.changes.outputs.code == 'true'
136136
steps:
137137
- name: Harden the runner (Audit all outbound calls)
138-
uses: step-security/harden-runner@v2
138+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
139139
with:
140140
egress-policy: audit
141141

142-
- uses: actions/checkout@v4
143-
- uses: actions/setup-node@v4
142+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
143+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
144144
with:
145145
node-version-file: .node-version
146146
cache: npm
@@ -157,12 +157,12 @@ jobs:
157157
if: needs.changes.outputs.ci == 'true'
158158
steps:
159159
- name: Harden the runner (Audit all outbound calls)
160-
uses: step-security/harden-runner@v2
160+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
161161
with:
162162
egress-policy: audit
163163

164164
- name: Checkout repo
165-
uses: actions/checkout@v4
165+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
166166
- name: Check workflow files
167167
run: |
168168
bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.7.1
@@ -177,12 +177,12 @@ jobs:
177177
if: needs.changes.outputs.code == 'true'
178178
steps:
179179
- name: Harden the runner (Audit all outbound calls)
180-
uses: step-security/harden-runner@v2
180+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
181181
with:
182182
egress-policy: audit
183183

184-
- uses: actions/checkout@v4
185-
- uses: actions/setup-node@v4
184+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
185+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
186186
with:
187187
node-version-file: .node-version
188188
cache: npm
@@ -191,7 +191,7 @@ jobs:
191191
test/package-lock.json
192192
- run: SKIP_SUBMODULE_DEPS=1 npm ci
193193
- run: npm run test:unit
194-
- uses: codecov/codecov-action@v5
194+
- uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
195195
if: success()
196196
with:
197197
token: ${{ secrets.CODECOV_TOKEN }}
@@ -205,11 +205,11 @@ jobs:
205205
DISABLE_V8_COMPILE_CACHE: 1
206206
steps:
207207
- name: Harden the runner (Audit all outbound calls)
208-
uses: step-security/harden-runner@v2
208+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
209209
with:
210210
egress-policy: audit
211211

212-
- uses: actions/checkout@v4
212+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
213213
with:
214214
submodules: true
215215
- run: sudo apt update && sudo apt install -y libkrb5-dev
@@ -218,7 +218,7 @@ jobs:
218218
packages: quilt
219219
version: 1.0
220220
- run: quilt push -a
221-
- uses: actions/setup-node@v4
221+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
222222
with:
223223
node-version-file: .node-version
224224
cache: npm
@@ -240,7 +240,7 @@ jobs:
240240
# force a rebuild.
241241
- name: Fetch prebuilt Code package from cache
242242
id: cache-vscode
243-
uses: actions/cache@v4
243+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
244244
with:
245245
path: lib/vscode-reh-web-*
246246
key: vscode-reh-package-${{ secrets.VSCODE_CACHE_VERSION }}-${{ steps.vscode-rev.outputs.rev }}-${{ hashFiles('patches/*.diff', 'ci/build/build-vscode.sh') }}
@@ -259,7 +259,7 @@ jobs:
259259
if: success()
260260
# https://github.com/actions/upload-artifact/issues/38
261261
- run: tar -czf package.tar.gz release
262-
- uses: actions/upload-artifact@v4
262+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
263263
with:
264264
name: npm-package
265265
path: ./package.tar.gz
@@ -272,21 +272,21 @@ jobs:
272272
if: needs.changes.outputs.code == 'true' || needs.changes.outputs.deps == 'true'
273273
steps:
274274
- name: Harden the runner (Audit all outbound calls)
275-
uses: step-security/harden-runner@v2
275+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
276276
with:
277277
egress-policy: audit
278278

279-
- uses: actions/checkout@v4
279+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
280280
- run: sudo apt update && sudo apt install -y libkrb5-dev
281-
- uses: actions/setup-node@v4
281+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
282282
with:
283283
node-version-file: .node-version
284284
cache: npm
285285
cache-dependency-path: |
286286
package-lock.json
287287
test/package-lock.json
288288
- run: SKIP_SUBMODULE_DEPS=1 npm ci
289-
- uses: actions/download-artifact@v4
289+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
290290
with:
291291
name: npm-package
292292
- run: tar -xzf package.tar.gz
@@ -296,7 +296,7 @@ jobs:
296296
./test/node_modules/.bin/playwright install-deps
297297
./test/node_modules/.bin/playwright install
298298
- run: CODE_SERVER_TEST_ENTRY=./release npm run test:e2e
299-
- uses: actions/upload-artifact@v4
299+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
300300
if: always()
301301
with:
302302
name: failed-test-videos
@@ -311,21 +311,21 @@ jobs:
311311
if: needs.changes.outputs.code == 'true' || needs.changes.outputs.deps == 'true'
312312
steps:
313313
- name: Harden the runner (Audit all outbound calls)
314-
uses: step-security/harden-runner@v2
314+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
315315
with:
316316
egress-policy: audit
317317

318-
- uses: actions/checkout@v4
318+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
319319
- run: sudo apt update && sudo apt install -y libkrb5-dev
320-
- uses: actions/setup-node@v4
320+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
321321
with:
322322
node-version-file: .node-version
323323
cache: npm
324324
cache-dependency-path: |
325325
package-lock.json
326326
test/package-lock.json
327327
- run: SKIP_SUBMODULE_DEPS=1 npm ci
328-
- uses: actions/download-artifact@v4
328+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
329329
with:
330330
name: npm-package
331331
- run: tar -xzf package.tar.gz
@@ -335,7 +335,7 @@ jobs:
335335
./test/node_modules/.bin/playwright install-deps
336336
./test/node_modules/.bin/playwright install
337337
- name: Cache Caddy
338-
uses: actions/cache@v4
338+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
339339
id: caddy-cache
340340
with:
341341
path: |
@@ -354,7 +354,7 @@ jobs:
354354
- run: ~/.cache/caddy/caddy stop --config ./ci/Caddyfile
355355
if: always()
356356

357-
- uses: actions/upload-artifact@v4
357+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
358358
if: always()
359359
with:
360360
name: failed-test-videos-proxy

0 commit comments

Comments
 (0)