From 4758ca46faaca5a6409a15f82b30e3e837bc43a2 Mon Sep 17 00:00:00 2001 From: Jannis Braun <151788261+TheZwiss@users.noreply.github.com> Date: Sun, 12 Jul 2026 23:32:48 +0200 Subject: [PATCH] ci(security): SHA-pin all actions and add harden-runner (audit) --- .github/workflows/ci.yml | 11 +++++++--- .github/workflows/cla.yml | 2 +- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/deploy-pages.yml | 8 ++++---- .github/workflows/docker-publish.yml | 12 +++++------ .github/workflows/release.yml | 12 ++++++++--- .github/workflows/scorecard.yml | 10 +++++----- .github/workflows/security.yml | 30 ++++++++++++++-------------- 8 files changed, 52 insertions(+), 41 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f6683dad..27f54f75 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,11 +26,16 @@ jobs: runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Setup pnpm - uses: pnpm/action-setup@v5 + uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 with: version: 10.34.3 @@ -39,7 +44,7 @@ jobs: # install below pulls better-sqlite3's prebuilt binary for the correct ABI, # which is what makes the server suite runnable in CI. - name: Setup Node.js - uses: actions/setup-node@v5 + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: node-version: 20 cache: pnpm diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index d17158e2..132e8b5b 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -29,7 +29,7 @@ jobs: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target' - uses: contributor-assistant/github-action@v2.6.1 + uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ccb1f0f6..4c941250 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,17 +32,17 @@ jobs: actions: read steps: - name: Harden the runner - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0 with: languages: javascript-typescript build-mode: none - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0 with: category: "/language:javascript-typescript" diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml index e68102dc..fba9cc0f 100644 --- a/.github/workflows/deploy-pages.yml +++ b/.github/workflows/deploy-pages.yml @@ -24,10 +24,10 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} steps: - - uses: actions/checkout@v5 - - uses: actions/configure-pages@v6 - - uses: actions/upload-pages-artifact@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 + - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: ./site - id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 4c85d13d..aff09f28 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -33,7 +33,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 # The runtime image bakes the git commit for the AGPL-3.0 § 13 source # offer (config.commit → GET /api/instance/info). The .git dir is not in @@ -44,13 +44,13 @@ jobs: run: echo "commit=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT" - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -58,7 +58,7 @@ jobs: - name: Derive image tags and labels id: docker_meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 with: # github.repository is "TheZwiss/backspace"; metadata-action lowercases # it → ghcr.io/thezwiss/backspace (GHCR requires lowercase). @@ -77,7 +77,7 @@ jobs: org.opencontainers.image.revision=${{ github.sha }} - name: Build and push (linux/amd64, linux/arm64) - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: . platforms: linux/amd64,linux/arm64 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b36e9d67..f0de0122 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -34,8 +34,14 @@ jobs: runs-on: ${{ matrix.os }} steps: + - name: Harden the runner + if: runner.os == 'Linux' + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Install Linux build dependencies if: runner.os == 'Linux' @@ -65,12 +71,12 @@ jobs: sudo gem install --no-document fpm - name: Setup pnpm - uses: pnpm/action-setup@v5 + uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 with: version: 10.34.3 - name: Setup Node.js - uses: actions/setup-node@v5 + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: node-version: 20 cache: pnpm diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index e0981ff1..bdda8659 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -23,26 +23,26 @@ jobs: id-token: write # publish_results OIDC attestation steps: - name: Harden the runner - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false - name: Run Scorecard - uses: ossf/scorecard-action@v2 + uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 with: results_file: results.sarif results_format: sarif publish_results: true - name: Upload artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: SARIF file path: results.sarif retention-days: 5 - name: Upload SARIF to code scanning - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0 with: sarif_file: results.sarif diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 1596d3a9..e2479078 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -24,15 +24,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden the runner - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout (full history) - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: fetch-depth: 0 # gitleaks scans the whole git history, not just the diff - name: Run gitleaks - uses: gitleaks/gitleaks-action@v2 + uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9 continue-on-error: true # report-only; enforcement flipped on in Plan E env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -45,13 +45,13 @@ jobs: security-events: write # upload SARIF to code scanning steps: - name: Harden the runner - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Run OSV-Scanner - uses: google/osv-scanner-action@v2 + uses: google/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 continue-on-error: true # report-only; enforcement flipped on in Plan E with: scan-args: |- @@ -60,7 +60,7 @@ jobs: --output=osv-results.sarif - name: Upload OSV SARIF if: always() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0 with: sarif_file: osv-results.sarif category: osv-scanner @@ -73,13 +73,13 @@ jobs: security-events: write steps: - name: Harden the runner - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Trivy config scan (Dockerfile + docker-compose) - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # v0.28.0 continue-on-error: true # report-only; enforcement flipped on in Plan E with: scan-type: config @@ -88,7 +88,7 @@ jobs: output: trivy-config.sarif - name: Upload Trivy config SARIF if: always() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0 with: sarif_file: trivy-config.sarif category: trivy-config @@ -101,13 +101,13 @@ jobs: security-events: write steps: - name: Harden the runner - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Trivy license scan - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # v0.28.0 continue-on-error: true # report-only; enforcement flipped on in Plan E with: scan-type: fs @@ -117,7 +117,7 @@ jobs: output: trivy-license.sarif - name: Upload Trivy license SARIF if: always() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0 with: sarif_file: trivy-license.sarif category: trivy-license