Skip to content

Commit 1bdb1c7

Browse files
jeromevdljeromevdl
committed
secure github actions using hash instead of versions
1 parent 3dc8405 commit 1bdb1c7

11 files changed

+63
-30
lines changed

‎.github/workflows/auto-merge.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ jobs:
1717
runs-on: ubuntu-latest
1818
if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success' && github.actor == 'dependabot[bot]'
1919
steps:
20-
- uses: actions/checkout@v3
21-
- uses: ahmadnassri/action-workflow-run-wait@v1
20+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
21+
- uses: ahmadnassri/action-workflow-run-wait@2aa3d9e1a12ecaaa9908e368eaf2123bb084323e # v1.4.4
2222
with:
2323
timeout: 300000
2424
- name: 'Download artifact'
25-
uses: actions/[email protected]
25+
uses: actions/github-script@47f7cf65b5ced0830a325f705cad64f2f58dddf7 # v3.1.0
2626
with:
2727
script: |
2828
var artifacts = await github.actions.listWorkflowRunArtifacts({
@@ -43,7 +43,7 @@ jobs:
4343
fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(download.data));
4444
- run: unzip pr.zip
4545
- name: Create review
46-
uses: actions/github-script@v3
46+
uses: actions/github-script@47f7cf65b5ced0830a325f705cad64f2f58dddf7 # v3.1.0
4747
with:
4848
script: |
4949
var fs = require('fs');

‎.github/workflows/build-docs.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ jobs:
2121
docs:
2222
runs-on: ubuntu-latest
2323
steps:
24-
- uses: actions/checkout@v3
24+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
2525
- name: Set up Python
26-
uses: actions/setup-python@v4
26+
uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0 # v4.6.1
2727
with:
2828
python-version: "3.8"
2929
- name: Capture branch and tag

‎.github/workflows/build.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -53,17 +53,17 @@ jobs:
5353
JAVA: ${{ matrix.java }}
5454
AWS_REGION: eu-west-1
5555
steps:
56-
- uses: actions/checkout@v3
56+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
5757
- name: Setup java
58-
uses: actions/setup-java@v3
58+
uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3.11.0
5959
with:
6060
distribution: 'corretto'
6161
java-version: ${{ matrix.java }}
6262
cache: 'maven'
6363
- name: Build with Maven
6464
run: mvn -B install --file pom.xml
6565
- name: Upload coverage to Codecov
66-
uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # 3.1.1
66+
uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
6767
if: ${{ matrix.java == '11' }} # publish results once
6868
with:
6969
files: ./powertools-cloudformation/target/site/jacoco/jacoco.xml,./powertools-core/target/site/jacoco/jacoco.xml,./powertools-idempotency/target/site/jacoco/jacoco.xml,./powertools-logging/target/site/jacoco/jacoco.xml,./powertools-metrics/target/site/jacoco/jacoco.xml,./powertools-parameters/target/site/jacoco/jacoco.xml,./powertools-serialization/target/site/jacoco/jacoco.xml,./powertools-sqs/target/site/jacoco/jacoco.xml,./powertools-tracing/target/site/jacoco/jacoco.xml,./powertools-validation/target/site/jacoco/jacoco.xml
@@ -77,7 +77,7 @@ jobs:
7777
mkdir -p ./pr
7878
echo ${{ github.event.number }}
7979
echo ${{ github.event.number }} > ./pr/NR
80-
- uses: actions/upload-artifact@v2
80+
- uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
8181
name: Upload artifact
8282
with:
8383
name: pr

‎.github/workflows/dispatch_analytics.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
environment: analytics
3030
steps:
3131
- name: Configure AWS credentials
32-
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef
32+
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
3333
with:
3434
aws-region: eu-central-1
3535
role-to-assume: ${{ secrets.AWS_ANALYTICS_ROLE_ARN }}

‎.github/workflows/docs.yml

Whitespace-only changes.

‎.github/workflows/publish.yml

+5-4
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,16 @@ jobs:
88
publish:
99
runs-on: ubuntu-latest
1010
steps:
11-
- uses: actions/checkout@v3
11+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
1212
- name: Set up Maven Central Repository
13-
uses: actions/setup-java@v2
13+
uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3.11.0
1414
with:
15-
distribution: 'zulu'
15+
distribution: 'corretto'
1616
java-version: 8
1717
server-id: ossrh
1818
server-username: MAVEN_USERNAME
1919
server-password: MAVEN_PASSWORD
20+
# TODO: use environments https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment
2021
gpg-private-key: ${{ secrets.GPG_SIGNING_KEY }} # Value of the GPG private key to import
2122
gpg-passphrase: GPG_PASSPHRASE # env variable for GPG private key passphrase
2223
- name: Set release notes tag
@@ -30,7 +31,7 @@ jobs:
3031
MAVEN_PASSWORD: ${{ secrets.OSSRH_JIRA_PASSWORD }}
3132
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
3233
- name: Close issues related to this release
33-
uses: actions/github-script@v5
34+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
3435
with:
3536
script: |
3637
const post_release = require('.github/workflows/post_release.js')

‎.github/workflows/release-drafter.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,6 @@ jobs:
1010
update_release_draft:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: release-drafter/release-drafter@v5
13+
- uses: release-drafter/release-drafter@569eb7ee3a85817ab916c8f8ff03a5bd96c9c83e # v5.23.0
1414
env:
1515
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-prep.yml

+8-8
Original file line numberDiff line numberDiff line change
@@ -10,50 +10,50 @@ jobs:
1010
build:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/checkout@v3
13+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
1414
- name: Get current date
1515
id: date
1616
run: echo "::set-output name=date::$(date +'%Y-%m-%d')"
1717
- name: Set current release version env variable
1818
run: |
1919
echo "CURRENT_VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)" >> $GITHUB_ENV
2020
- name: Find and Replace ${{ env.CURRENT_VERSION }} with ${{ github.event.inputs.targetRelease }} in mkdocs.yml
21-
uses: jacobtomlinson/gha-find-replace@v2
21+
uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2.0.0
2222
with:
2323
find: 'version: ${{ env.CURRENT_VERSION }}'
2424
replace: 'version: ${{ github.event.inputs.targetRelease }}'
2525
regex: false
2626
include: "mkdocs.yml"
2727
- name: Find and Replace ${{ env.CURRENT_VERSION }} with ${{ github.event.inputs.targetRelease }} in main pom.xml
28-
uses: jacobtomlinson/gha-find-replace@v2
28+
uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2.0.0
2929
with:
3030
find: ${{ env.CURRENT_VERSION }}
3131
replace: ${{ github.event.inputs.targetRelease }}
3232
regex: false
3333
include: "pom.xml"
3434
- name: Find and Replace ${{ env.CURRENT_VERSION }} with ${{ github.event.inputs.targetRelease }} in modules pom.xml
35-
uses: jacobtomlinson/gha-find-replace@v2
35+
uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2.0.0
3636
with:
3737
find: ${{ env.CURRENT_VERSION }}
3838
replace: ${{ github.event.inputs.targetRelease }}
3939
regex: false
4040
include: "**/*pom.xml"
4141
- name: Find and Replace ${{ env.CURRENT_VERSION }} with ${{ github.event.inputs.targetRelease }} in build.gradle
42-
uses: jacobtomlinson/gha-find-replace@v2
42+
uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2.0.0
4343
with:
4444
find: ${{ env.CURRENT_VERSION }}
4545
replace: ${{ github.event.inputs.targetRelease }}
4646
regex: false
4747
include: "**/*build.gradle"
4848
- name: Find and Replace ${{ env.CURRENT_VERSION }} with ${{ github.event.inputs.targetRelease }} in README.md
49-
uses: jacobtomlinson/gha-find-replace@v2
49+
uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2.0.0
5050
with:
5151
find: ${{ env.CURRENT_VERSION }}
5252
replace: ${{ github.event.inputs.targetRelease }}
5353
regex: false
5454
include: "README.md"
5555
- name: Create changelog placeholder for ${{ github.event.inputs.targetRelease }}
56-
uses: jacobtomlinson/gha-find-replace@v2
56+
uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2.0.0
5757
with:
5858
find: '## [Unreleased]'
5959
replace: |
@@ -66,7 +66,7 @@ jobs:
6666
regex: false
6767
include: CHANGELOG.md
6868
- name: Create Release Pull Request
69-
uses: peter-evans/create-pull-request@v3
69+
uses: peter-evans/create-pull-request@18f7dc018cc2cd597073088f7c7591b9d1c02672 # v3.14.0
7070
with:
7171
commit-message: chore:prep release ${{ github.event.inputs.targetRelease }}
7272
token: ${{ secrets.RELEASE }}

‎.github/workflows/run-e2e-tests.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -32,15 +32,15 @@ jobs:
3232
id-token: write # needed to interact with GitHub's OIDC Token endpoint.
3333
contents: read
3434
steps:
35-
- uses: actions/checkout@v3
35+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
3636
- name: Setup java
37-
uses: actions/setup-java@v3
37+
uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3.11.0
3838
with:
3939
distribution: 'corretto'
4040
java-version: ${{ matrix.java }}
4141
cache: maven
4242
- name: Setup AWS credentials
43-
uses: aws-actions/configure-aws-credentials@v1.6.1
43+
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
4444
with:
4545
role-to-assume: ${{ secrets.AWS_ROLE_ARN_TO_ASSUME }}
4646
aws-region: ${{ env.AWS_DEFAULT_REGION }}

‎.github/workflows/secure_workflows.yml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Lockdown untrusted workflows
2+
3+
# PROCESS
4+
#
5+
# 1. Scans for any external GitHub Action being used without version pinning (@<commit-sha> vs @v3)
6+
# 2. Scans for insecure practices for inline bash scripts (shellcheck)
7+
# 3. Fail CI and prevent PRs to be merged if any malpractice is found
8+
9+
# USAGE
10+
#
11+
# Always triggered on new PR, PR changes and PR merge.
12+
13+
14+
on:
15+
push:
16+
paths:
17+
- ".github/workflows/**"
18+
pull_request:
19+
paths:
20+
- ".github/workflows/**"
21+
22+
jobs:
23+
enforce_pinned_workflows:
24+
name: Harden Security
25+
runs-on: ubuntu-latest
26+
permissions:
27+
contents: read # checkout code and subsequently GitHub action workflows
28+
steps:
29+
- name: Checkout code
30+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
31+
- name: Ensure 3rd party workflows have SHA pinned
32+
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@555a30da2656b4a7cf47b107800bef097723363e # v2.1.3

‎.github/workflows/spotbugs.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,11 @@ jobs:
2222
codecheck:
2323
runs-on: ubuntu-latest
2424
steps:
25-
- uses: actions/checkout@v3
25+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
2626
- name: Setup java JDK 1.8
27-
uses: actions/setup-java@v2
27+
uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3.11.0
2828
with:
29-
distribution: 'zulu'
29+
distribution: 'corretto'
3030
java-version: 8
3131
# https://github.com/jwgmeligmeyling/spotbugs-github-action/issues/6
3232
# https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/

0 commit comments

Comments
 (0)