diff options
| author | Naveen <172697+naveensrinivasan@users.noreply.github.com> | 2022-03-29 07:08:01 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-03-29 21:08:01 +0900 |
| commit | 19af8fc7d8f5b4dcf8730ea0b5826bad9fac2dc4 (patch) | |
| tree | be1e06f0d1f83c7de0299396aee83e6750994f5f /.github | |
| parent | a06671b47f0284733c7edf7dae8f22f9758c8393 (diff) | |
Pin actions to a full length commit SHA (#2765)
- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
>Pin actions to a full length commit SHA
>Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
Also, dependabot supports upgrade based on SHA.
Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>s
Diffstat (limited to '.github')
| -rw-r--r-- | .github/workflows/codeql-analysis.yml | 15 | ||||
| -rw-r--r-- | .github/workflows/linux.yml | 9 | ||||
| -rw-r--r-- | .github/workflows/macos.yml | 9 |
3 files changed, 23 insertions, 10 deletions
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 28569609..59f54602 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -8,8 +8,15 @@ on: branches: [ master ] workflow_dispatch: +permissions: + contents: read + jobs: analyze: + permissions: + actions: read # for github/codeql-action/init to get workflow details + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/autobuild to send a status report name: Analyze runs-on: ubuntu-latest @@ -20,18 +27,18 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 with: fetch-depth: 0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v1 + uses: github/codeql-action/init@883476649888a9e8e219d5b2e6b789dc024f690c # v1 with: languages: ${{ matrix.language }} - name: Autobuild - uses: github/codeql-action/autobuild@v1 + uses: github/codeql-action/autobuild@883476649888a9e8e219d5b2e6b789dc024f690c # v1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v1 + uses: github/codeql-action/analyze@883476649888a9e8e219d5b2e6b789dc024f690c # v1 diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 3558a83a..68bb0ed5 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -8,6 +8,9 @@ on: branches: [ master ] workflow_dispatch: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest @@ -15,17 +18,17 @@ jobs: matrix: go: [1.14, 1.16] steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2 with: go-version: ${{ matrix.go }} - name: Setup Ruby - uses: ruby/setup-ruby@v1.62.0 + uses: ruby/setup-ruby@5aaa89ff0d7bb9c02d18c0008a98d24f38acbbbb # v1.62.0 with: ruby-version: 3.0.0 diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index 08b0fe27..15059aa7 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -8,6 +8,9 @@ on: branches: [ master ] workflow_dispatch: +permissions: + contents: read + jobs: build: runs-on: macos-latest @@ -15,17 +18,17 @@ jobs: matrix: go: [1.14, 1.16] steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2 with: go-version: ${{ matrix.go }} - name: Setup Ruby - uses: ruby/setup-ruby@v1.62.0 + uses: ruby/setup-ruby@5aaa89ff0d7bb9c02d18c0008a98d24f38acbbbb # v1.62.0 with: ruby-version: 3.0.0 |