devsyncwrld/backspace
1
0
Fork 0
Code Issues Pull Requests Actions 23 Packages Projects Releases Wiki Activity

ci(security): SHA-pin all actions and add harden-runner (audit)

Browse Source
This commit is contained in:
Jannis Braun
2026-07-12 23:51:00 +02:00
parent 21d783e257
commit 4758ca46fa
8 changed files with 52 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+8 -3
View File
@@ -26,11 +26,16 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Harden the runner
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit
- name: Checkout - name: Checkout
uses: actions/checkout@v5 uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
- name: Setup pnpm - name: Setup pnpm
uses: pnpm/action-setup@v5 uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
with: with:
version: 10.34.3 version: 10.34.3
@@ -39,7 +44,7 @@ jobs:
# install below pulls better-sqlite3's prebuilt binary for the correct ABI, # install below pulls better-sqlite3's prebuilt binary for the correct ABI,
# which is what makes the server suite runnable in CI. # which is what makes the server suite runnable in CI.
- name: Setup Node.js - name: Setup Node.js
uses: actions/setup-node@v5 uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with: with:
node-version: 20 node-version: 20
cache: pnpm cache: pnpm
.github/workflows/cla.yml
+1 -1
View File
@@ -29,7 +29,7 @@ jobs:
(github.event.comment.body == 'recheck' || (github.event.comment.body == 'recheck' ||
github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') ||
github.event_name == 'pull_request_target' github.event_name == 'pull_request_target'
uses: contributor-assistant/github-action@v2.6.1 uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
env: env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with: with:
.github/workflows/codeql.yml
+4 -4
View File
@@ -32,17 +32,17 @@ jobs:
actions: read actions: read
steps: steps:
- name: Harden the runner - name: Harden the runner
uses: step-security/harden-runner@v2 uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with: with:
egress-policy: audit egress-policy: audit
- name: Checkout - name: Checkout
uses: actions/checkout@v5 uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
- name: Initialize CodeQL - name: Initialize CodeQL
uses: github/codeql-action/init@v3 uses: github/codeql-action/init@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0
with: with:
languages: javascript-typescript languages: javascript-typescript
build-mode: none build-mode: none
- name: Perform CodeQL analysis - name: Perform CodeQL analysis
uses: github/codeql-action/analyze@v3 uses: github/codeql-action/analyze@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0
with: with:
category: "/language:javascript-typescript" category: "/language:javascript-typescript"
.github/workflows/deploy-pages.yml
+4 -4
View File
@@ -24,10 +24,10 @@ jobs:
name: github-pages name: github-pages
url: ${{ steps.deployment.outputs.page_url }} url: ${{ steps.deployment.outputs.page_url }}
steps: steps:
- uses: actions/checkout@v5 - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
- uses: actions/configure-pages@v6 - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
- uses: actions/upload-pages-artifact@v5 - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
with: with:
path: ./site path: ./site
- id: deployment - id: deployment
uses: actions/deploy-pages@v5 uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
.github/workflows/docker-publish.yml
+6 -6
View File
@@ -33,7 +33,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v5 uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
# The runtime image bakes the git commit for the AGPL-3.0 § 13 source # The runtime image bakes the git commit for the AGPL-3.0 § 13 source
# offer (config.commit → GET /api/instance/info). The .git dir is not in # offer (config.commit → GET /api/instance/info). The .git dir is not in
@@ -44,13 +44,13 @@ jobs:
run: echo "commit=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT" run: echo "commit=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
- name: Set up QEMU - name: Set up QEMU
uses: docker/setup-qemu-action@v3 uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
- name: Set up Docker Buildx - name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3 uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
- name: Log in to GitHub Container Registry - name: Log in to GitHub Container Registry
uses: docker/login-action@v3 uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with: with:
registry: ghcr.io registry: ghcr.io
username: ${{ github.actor }} username: ${{ github.actor }}
@@ -58,7 +58,7 @@ jobs:
- name: Derive image tags and labels - name: Derive image tags and labels
id: docker_meta id: docker_meta
uses: docker/metadata-action@v5 uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
with: with:
# github.repository is "TheZwiss/backspace"; metadata-action lowercases # github.repository is "TheZwiss/backspace"; metadata-action lowercases
# it → ghcr.io/thezwiss/backspace (GHCR requires lowercase). # it → ghcr.io/thezwiss/backspace (GHCR requires lowercase).
@@ -77,7 +77,7 @@ jobs:
org.opencontainers.image.revision=${{ github.sha }} org.opencontainers.image.revision=${{ github.sha }}
- name: Build and push (linux/amd64, linux/arm64) - name: Build and push (linux/amd64, linux/arm64)
uses: docker/build-push-action@v6 uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
with: with:
context: . context: .
platforms: linux/amd64,linux/arm64 platforms: linux/amd64,linux/arm64
.github/workflows/release.yml
+9 -3
View File
@@ -34,8 +34,14 @@ jobs:
runs-on: ${{ matrix.os }} runs-on: ${{ matrix.os }}
steps: steps:
- name: Harden the runner
if: runner.os == 'Linux'
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit
- name: Checkout - name: Checkout
uses: actions/checkout@v5 uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
- name: Install Linux build dependencies - name: Install Linux build dependencies
if: runner.os == 'Linux' if: runner.os == 'Linux'
@@ -65,12 +71,12 @@ jobs:
sudo gem install --no-document fpm sudo gem install --no-document fpm
- name: Setup pnpm - name: Setup pnpm
uses: pnpm/action-setup@v5 uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
with: with:
version: 10.34.3 version: 10.34.3
- name: Setup Node.js - name: Setup Node.js
uses: actions/setup-node@v5 uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with: with:
node-version: 20 node-version: 20
cache: pnpm cache: pnpm
.github/workflows/scorecard.yml
+5 -5
View File
@@ -23,26 +23,26 @@ jobs:
id-token: write # publish_results OIDC attestation id-token: write # publish_results OIDC attestation
steps: steps:
- name: Harden the runner - name: Harden the runner
uses: step-security/harden-runner@v2 uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with: with:
egress-policy: audit egress-policy: audit
- name: Checkout - name: Checkout
uses: actions/checkout@v5 uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
with: with:
persist-credentials: false persist-credentials: false
- name: Run Scorecard - name: Run Scorecard
uses: ossf/scorecard-action@v2 uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
with: with:
results_file: results.sarif results_file: results.sarif
results_format: sarif results_format: sarif
publish_results: true publish_results: true
- name: Upload artifact - name: Upload artifact
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with: with:
name: SARIF file name: SARIF file
path: results.sarif path: results.sarif
retention-days: 5 retention-days: 5
- name: Upload SARIF to code scanning - name: Upload SARIF to code scanning
uses: github/codeql-action/upload-sarif@v3 uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0
with: with:
sarif_file: results.sarif sarif_file: results.sarif
.github/workflows/security.yml
+15 -15
View File
@@ -24,15 +24,15 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Harden the runner - name: Harden the runner
uses: step-security/harden-runner@v2 uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with: with:
egress-policy: audit egress-policy: audit
- name: Checkout (full history) - name: Checkout (full history)
uses: actions/checkout@v5 uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
with: with:
fetch-depth: 0 # gitleaks scans the whole git history, not just the diff fetch-depth: 0 # gitleaks scans the whole git history, not just the diff
- name: Run gitleaks - name: Run gitleaks
uses: gitleaks/gitleaks-action@v2 uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
continue-on-error: true # report-only; enforcement flipped on in Plan E continue-on-error: true # report-only; enforcement flipped on in Plan E
env: env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -45,13 +45,13 @@ jobs:
security-events: write # upload SARIF to code scanning security-events: write # upload SARIF to code scanning
steps: steps:
- name: Harden the runner - name: Harden the runner
uses: step-security/harden-runner@v2 uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with: with:
egress-policy: audit egress-policy: audit
- name: Checkout - name: Checkout
uses: actions/checkout@v5 uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
- name: Run OSV-Scanner - name: Run OSV-Scanner
uses: google/osv-scanner-action@v2 uses: google/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
continue-on-error: true # report-only; enforcement flipped on in Plan E continue-on-error: true # report-only; enforcement flipped on in Plan E
with: with:
scan-args: |- scan-args: |-
@@ -60,7 +60,7 @@ jobs:
--output=osv-results.sarif --output=osv-results.sarif
- name: Upload OSV SARIF - name: Upload OSV SARIF
if: always() if: always()
uses: github/codeql-action/upload-sarif@v3 uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0
with: with:
sarif_file: osv-results.sarif sarif_file: osv-results.sarif
category: osv-scanner category: osv-scanner
@@ -73,13 +73,13 @@ jobs:
security-events: write security-events: write
steps: steps:
- name: Harden the runner - name: Harden the runner
uses: step-security/harden-runner@v2 uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with: with:
egress-policy: audit egress-policy: audit
- name: Checkout - name: Checkout
uses: actions/checkout@v5 uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
- name: Trivy config scan (Dockerfile + docker-compose) - name: Trivy config scan (Dockerfile + docker-compose)
uses: aquasecurity/trivy-action@0.28.0 uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # v0.28.0
continue-on-error: true # report-only; enforcement flipped on in Plan E continue-on-error: true # report-only; enforcement flipped on in Plan E
with: with:
scan-type: config scan-type: config
@@ -88,7 +88,7 @@ jobs:
output: trivy-config.sarif output: trivy-config.sarif
- name: Upload Trivy config SARIF - name: Upload Trivy config SARIF
if: always() if: always()
uses: github/codeql-action/upload-sarif@v3 uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0
with: with:
sarif_file: trivy-config.sarif sarif_file: trivy-config.sarif
category: trivy-config category: trivy-config
@@ -101,13 +101,13 @@ jobs:
security-events: write security-events: write
steps: steps:
- name: Harden the runner - name: Harden the runner
uses: step-security/harden-runner@v2 uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with: with:
egress-policy: audit egress-policy: audit
- name: Checkout - name: Checkout
uses: actions/checkout@v5 uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
- name: Trivy license scan - name: Trivy license scan
uses: aquasecurity/trivy-action@0.28.0 uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # v0.28.0
continue-on-error: true # report-only; enforcement flipped on in Plan E continue-on-error: true # report-only; enforcement flipped on in Plan E
with: with:
scan-type: fs scan-type: fs
@@ -117,7 +117,7 @@ jobs:
output: trivy-license.sarif output: trivy-license.sarif
- name: Upload Trivy license SARIF - name: Upload Trivy license SARIF
if: always() if: always()
uses: github/codeql-action/upload-sarif@v3 uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0
with: with:
sarif_file: trivy-license.sarif sarif_file: trivy-license.sarif
category: trivy-license category: trivy-license