Skip to content

Commit b7acc21

Browse files
heitorlessaleandrodamascena
heitorlessa
and
leandrodamascena
authored
chore(ci): enforce zero trust for third party workflows (#2215)
Co-authored-by: Leandro Damascena <[email protected]>
1 parent 0ab3b70 commit b7acc21

20 files changed

+58
-110
lines changed

‎.github/workflows/auto-merge.yml

-39
This file was deleted.

‎.github/workflows/codeql-analysis.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,11 @@ jobs:
2323

2424
steps:
2525
- name: Checkout repository
26-
uses: actions/checkout@v3
26+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
2727

2828
# Initializes the CodeQL tools for scanning.
2929
- name: Initialize CodeQL
30-
uses: github/codeql-action/init@v2
30+
uses: github/codeql-action/init@f31a31c052207cc13b328d6295c5b728bb49568c # v2.13.1
3131
with:
3232
languages: ${{ matrix.language }}
3333
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -36,4 +36,4 @@ jobs:
3636
# queries: ./path/to/local/query, your-org/your-repo/queries@main
3737

3838
- name: Perform CodeQL Analysis
39-
uses: github/codeql-action/analyze@v2
39+
uses: github/codeql-action/analyze@f31a31c052207cc13b328d6295c5b728bb49568c # v2.13.1

‎.github/workflows/dispatch_analytics.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
environment: analytics
3030
steps:
3131
- name: Configure AWS credentials
32-
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef
32+
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
3333
with:
3434
aws-region: eu-central-1
3535
role-to-assume: ${{ secrets.AWS_ANALYTICS_ROLE_ARN }}

‎.github/workflows/label_pr_on_title.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ jobs:
2222
runs-on: ubuntu-latest
2323
steps:
2424
- name: Checkout repository
25-
uses: actions/checkout@v3
25+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
2626
- name: "Label PR based on title"
27-
uses: actions/github-script@v6
27+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
2828
env:
2929
PR_NUMBER: ${{ needs.get_pr_details.outputs.prNumber }}
3030
PR_TITLE: ${{ needs.get_pr_details.outputs.prTitle }}

‎.github/workflows/on_closed_issues.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ jobs:
66
auto_comment:
77
runs-on: ubuntu-latest
88
steps:
9-
- uses: aws-actions/closed-issue-message@v1
9+
- uses: aws-actions/closed-issue-message@8b6324312193476beecf11f8e8539d73a3553bf4
1010
with:
1111
repo-token: "${{ secrets.GITHUB_TOKEN }}"
1212
message: |

‎.github/workflows/on_label_added.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,10 @@ jobs:
2323
issues: write
2424
pull-requests: write
2525
steps:
26-
- uses: actions/checkout@v3
26+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
2727
# Maintenance: Persist state per PR as an artifact to avoid spam on label add
2828
- name: "Suggest split large Pull Request"
29-
uses: actions/github-script@v6
29+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
3030
env:
3131
PR_NUMBER: ${{ needs.get_pr_details.outputs.prNumber }}
3232
PR_ACTION: ${{ needs.get_pr_details.outputs.prAction }}

‎.github/workflows/on_merged_pr.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ jobs:
2020
runs-on: ubuntu-latest
2121
if: needs.get_pr_details.outputs.prIsMerged == 'true'
2222
steps:
23-
- uses: actions/checkout@v3
23+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
2424
- name: "Label PR related issue for release"
25-
uses: actions/github-script@v6
25+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
2626
env:
2727
PR_NUMBER: ${{ needs.get_pr_details.outputs.prNumber }}
2828
PR_BODY: ${{ needs.get_pr_details.outputs.prBody }}

‎.github/workflows/on_opened_pr.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@ jobs:
1919
needs: get_pr_details
2020
runs-on: ubuntu-latest
2121
steps:
22-
- uses: actions/checkout@v3
22+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
2323
- name: "Ensure related issue is present"
24-
uses: actions/github-script@v6
24+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
2525
env:
2626
PR_BODY: ${{ needs.get_pr_details.outputs.prBody }}
2727
PR_NUMBER: ${{ needs.get_pr_details.outputs.prNumber }}
@@ -36,9 +36,9 @@ jobs:
3636
needs: get_pr_details
3737
runs-on: ubuntu-latest
3838
steps:
39-
- uses: actions/checkout@v3
39+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
4040
- name: "Ensure acknowledgement section is present"
41-
uses: actions/github-script@v6
41+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
4242
env:
4343
PR_BODY: ${{ needs.get_pr_details.outputs.prBody }}
4444
PR_NUMBER: ${{ needs.get_pr_details.outputs.prNumber }}

‎.github/workflows/publish_v2_layer.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -38,17 +38,17 @@ jobs:
3838
working-directory: ./layer
3939
steps:
4040
- name: checkout
41-
uses: actions/checkout@v3
41+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
4242
with:
4343
fetch-depth: 0
4444
- name: Install poetry
4545
run: pipx install poetry
4646
- name: Setup Node.js
47-
uses: actions/setup-node@v3
47+
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
4848
with:
4949
node-version: "16.12"
5050
- name: Setup python
51-
uses: actions/setup-python@v4
51+
uses: actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b # v4.6.0
5252
with:
5353
python-version: "3.10"
5454
cache: "pip"
@@ -80,7 +80,7 @@ jobs:
8080
- name: zip output
8181
run: zip -r cdk.out.zip cdk.out
8282
- name: Archive CDK artifacts
83-
uses: actions/upload-artifact@v3
83+
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
8484
with:
8585
name: cdk-layer-artefact
8686
path: layer/cdk.out.zip

‎.github/workflows/python_build.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,11 @@ jobs:
3232
env:
3333
PYTHON: "${{ matrix.python-version }}"
3434
steps:
35-
- uses: actions/checkout@v3
35+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
3636
- name: Install poetry
3737
run: pipx install poetry
3838
- name: Set up Python ${{ matrix.python-version }}
39-
uses: actions/setup-python@v4
39+
uses: actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b # v4.6.0
4040
with:
4141
python-version: ${{ matrix.python-version }}
4242
cache: "poetry"

‎.github/workflows/record_pr.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,14 @@ jobs:
99
runs-on: ubuntu-latest
1010

1111
steps:
12-
- uses: actions/checkout@v3
12+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
1313
- name: "Extract PR details"
14-
uses: actions/github-script@v6
14+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
1515
with:
1616
script: |
1717
const script = require('.github/scripts/save_pr_details.js')
1818
await script({github, context, core})
19-
- uses: actions/upload-artifact@v3
19+
- uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
2020
with:
2121
name: pr
2222
path: pr.txt

‎.github/workflows/release.yml

+5-5
Original file line numberDiff line numberDiff line change
@@ -57,13 +57,13 @@ jobs:
5757
env:
5858
RELEASE_TAG_VERSION: ${{ inputs.version_to_publish }}
5959
steps:
60-
- uses: actions/checkout@v3
60+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
6161
with:
6262
fetch-depth: 0
6363
- name: Install poetry
6464
run: pipx install poetry
6565
- name: Set up Python
66-
uses: actions/setup-python@v4
66+
uses: actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b # v4.6.0
6767
with:
6868
python-version: "3.10"
6969
cache: "poetry"
@@ -124,7 +124,7 @@ jobs:
124124
env:
125125
RELEASE_VERSION: ${{ needs.build.outputs.RELEASE_VERSION }}
126126
steps:
127-
- uses: actions/checkout@v3
127+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
128128
- name: Restore release artifact from cache
129129
id: restore-release-build
130130
uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
@@ -174,9 +174,9 @@ jobs:
174174
env:
175175
RELEASE_VERSION: ${{ needs.build.outputs.RELEASE_VERSION }}
176176
steps:
177-
- uses: actions/checkout@v3
177+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
178178
- name: Close issues related to this release
179-
uses: actions/github-script@v6
179+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
180180
with:
181181
github-token: ${{ secrets.GITHUB_TOKEN }}
182182
script: |

‎.github/workflows/reusable_deploy_v2_layer_stack.yml

+6-6
Original file line numberDiff line numberDiff line change
@@ -93,20 +93,20 @@ jobs:
9393
has_arm64_support: "true"
9494
steps:
9595
- name: checkout
96-
uses: actions/checkout@v3
96+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
9797
- name: Install poetry
9898
run: pipx install poetry
9999
- name: aws credentials
100-
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef
100+
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
101101
with:
102102
aws-region: ${{ matrix.region }}
103103
role-to-assume: ${{ secrets.AWS_LAYERS_ROLE_ARN }}
104104
- name: Setup Node.js
105-
uses: actions/setup-node@v3
105+
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
106106
with:
107107
node-version: "16.12"
108108
- name: Setup python
109-
uses: actions/setup-python@v4
109+
uses: actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b # v4.6.0
110110
with:
111111
python-version: "3.10"
112112
cache: "pip"
@@ -124,7 +124,7 @@ jobs:
124124
- name: install deps
125125
run: poetry install
126126
- name: Download artifact
127-
uses: actions/download-artifact@v3
127+
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
128128
with:
129129
name: ${{ inputs.artefact-name }}
130130
path: layer
@@ -141,7 +141,7 @@ jobs:
141141
cat cdk-layer-stack/${{ matrix.region }}-layer-version.txt
142142
- name: Save Layer ARN artifact
143143
if: ${{ inputs.stage == 'PROD' }}
144-
uses: actions/upload-artifact@v3
144+
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
145145
with:
146146
name: cdk-layer-stack
147147
path: ./layer/cdk-layer-stack/* # NOTE: upload-artifact does not inherit working-directory setting.

‎.github/workflows/reusable_deploy_v2_sar.yml

+5-5
Original file line numberDiff line numberDiff line change
@@ -48,14 +48,14 @@ jobs:
4848
architecture: ["x86_64", "arm64"]
4949
steps:
5050
- name: Checkout
51-
uses: actions/checkout@v3
51+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
5252
- name: AWS credentials
53-
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef
53+
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
5454
with:
5555
aws-region: ${{ env.AWS_REGION }}
5656
role-to-assume: ${{ secrets.AWS_LAYERS_ROLE_ARN }}
5757
- name: AWS credentials SAR role
58-
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef
58+
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
5959
id: aws-credentials-sar-role
6060
with:
6161
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
@@ -65,11 +65,11 @@ jobs:
6565
aws-region: ${{ env.AWS_REGION }}
6666
role-to-assume: ${{ secrets.AWS_SAR_V2_ROLE_ARN }}
6767
- name: Setup Node.js
68-
uses: actions/setup-node@v3
68+
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
6969
with:
7070
node-version: ${{ env.NODE_VERSION }}
7171
- name: Download artifact
72-
uses: actions/download-artifact@v3
72+
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
7373
with:
7474
name: ${{ inputs.artefact-name }}
7575
- name: Unzip artefact

‎.github/workflows/reusable_export_pr_details.yml

+8-8
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,9 @@ jobs:
5353
prIsMerged: ${{ steps.prIsMerged.outputs.prIsMerged }}
5454
steps:
5555
- name: Checkout repository # in case caller workflow doesn't checkout thus failing with file not found
56-
uses: actions/checkout@v3
56+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
5757
- name: "Download previously saved PR"
58-
uses: actions/github-script@v6
58+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
5959
env:
6060
WORKFLOW_ID: ${{ inputs.record_pr_workflow_id }}
6161
# For security, we only download artifacts tied to the successful PR recording workflow
@@ -71,19 +71,19 @@ jobs:
7171
# otherwise the parent caller won't see them regardless on how outputs are set.
7272
- name: "Export Pull Request Number"
7373
id: prNumber
74-
run: echo "prNumber=$(jq -c '.number' ${FILENAME})" >> $GITHUB_OUTPUT
74+
run: echo prNumber="$(jq -c '.number' "${FILENAME}")" >> "$GITHUB_OUTPUT"
7575
- name: "Export Pull Request Title"
7676
id: prTitle
77-
run: echo "prTitle=$(jq -c '.pull_request.title' ${FILENAME})" >> $GITHUB_OUTPUT
77+
run: echo prTitle="$(jq -c '.pull_request.title' "${FILENAME}")" >> "$GITHUB_OUTPUT"
7878
- name: "Export Pull Request Body"
7979
id: prBody
80-
run: echo "prBody=$(jq -c '.pull_request.body' ${FILENAME})" >> $GITHUB_OUTPUT
80+
run: echo prBody="$(jq -c '.pull_request.body' "${FILENAME}")" >> "$GITHUB_OUTPUT"
8181
- name: "Export Pull Request Author"
8282
id: prAuthor
83-
run: echo "prAuthor=$(jq -c '.pull_request.user.login' ${FILENAME})" >> $GITHUB_OUTPUT
83+
run: echo prAuthor="$(jq -c '.pull_request.user.login' "${FILENAME}")" >> "$GITHUB_OUTPUT"
8484
- name: "Export Pull Request Action"
8585
id: prAction
86-
run: echo "prAction=$(jq -c '.action' ${FILENAME})" >> $GITHUB_OUTPUT
86+
run: echo prAction="$(jq -c '.action' "${FILENAME}")" >> "$GITHUB_OUTPUT"
8787
- name: "Export Pull Request Merged status"
8888
id: prIsMerged
89-
run: echo "prIsMerged=$(jq -c '.pull_request.merged' ${FILENAME})" >> $GITHUB_OUTPUT
89+
run: echo prIsMerged="$(jq -c '.pull_request.merged' "${FILENAME}")" >> "$GITHUB_OUTPUT"

‎.github/workflows/reusable_publish_changelog.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
runs-on: ubuntu-latest
1919
steps:
2020
- name: Checkout repository # reusable workflows start clean, so we need to checkout again
21-
uses: actions/checkout@v3
21+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
2222
with:
2323
fetch-depth: 0
2424
- name: Git client setup and refresh tip

‎.github/workflows/reusable_publish_docs.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,13 @@ jobs:
3333
group: on-docs-rebuild
3434
runs-on: ubuntu-latest
3535
steps:
36-
- uses: actions/checkout@v3
36+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
3737
with:
3838
fetch-depth: 0
3939
- name: Install poetry
4040
run: pipx install poetry
4141
- name: Set up Python
42-
uses: actions/setup-python@v4
42+
uses: actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b # v4.6.0
4343
with:
4444
python-version: "3.10"
4545
cache: "poetry"

‎.github/workflows/reusable_update_v2_layer_arn_docs.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
runs-on: ubuntu-latest
2424
steps:
2525
- name: Checkout repository # reusable workflows start clean, so we need to checkout again
26-
uses: actions/checkout@v3
26+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
2727
with:
2828
fetch-depth: 0
2929
- name: Git client setup and refresh tip
@@ -34,7 +34,7 @@ jobs:
3434
git config remote.origin.url >&- || git remote add origin https://github.com/"${origin}" # Git Detached mode (release notes) doesn't have origin
3535
git pull origin "${BRANCH}"
3636
- name: Download CDK layer artifact
37-
uses: actions/download-artifact@v3
37+
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
3838
with:
3939
name: cdk-layer-stack
4040
path: cdk-layer-stack/

0 commit comments

Comments
 (0)