Skip to content

Commit d7ed31a

Browse files
step-security-botstep-security-bot
committed
[StepSecurity] Apply security best practices
Signed-off-by: StepSecurity Bot <[email protected]>
1 parent 8f0f567 commit d7ed31a

30 files changed

+277
-0
lines changed

‎.github/dependabot.yml

+15
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,18 @@ updates:
8787
layer-balancer:
8888
patterns:
8989
- "*"
90+
91+
- package-ecosystem: pip
92+
directory: /tests/performance/data_masking/load_test_data_masking/pt-load-test-stack/function_1024
93+
schedule:
94+
interval: daily
95+
96+
- package-ecosystem: pip
97+
directory: /tests/performance/data_masking/load_test_data_masking/pt-load-test-stack/function_128
98+
schedule:
99+
interval: daily
100+
101+
- package-ecosystem: pip
102+
directory: /tests/performance/data_masking/load_test_data_masking/pt-load-test-stack/function_1769
103+
schedule:
104+
interval: daily

‎.github/workflows/codeql-analysis.yml

+5
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,11 @@ jobs:
2727
actions: read
2828

2929
steps:
30+
- name: Harden Runner
31+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
32+
with:
33+
egress-policy: audit
34+
3035
- name: Checkout repository
3136
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
3237

‎.github/workflows/dependency-review.yml

+5
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,11 @@ jobs:
1616
dependency-review:
1717
runs-on: ubuntu-latest
1818
steps:
19+
- name: Harden Runner
20+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
21+
with:
22+
egress-policy: audit
23+
1924
- name: 'Checkout Repository'
2025
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
2126
- name: 'Dependency Review'

‎.github/workflows/dispatch_analytics.yml

+5
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,11 @@ jobs:
4242
security-events: read
4343
statuses: read
4444
steps:
45+
- name: Harden Runner
46+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
47+
with:
48+
egress-policy: audit
49+
4550
- name: Configure AWS credentials
4651
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
4752
with:

‎.github/workflows/label_pr_on_title.yml

+5
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,11 @@ jobs:
4949
permissions:
5050
pull-requests: write # label respective PR
5151
steps:
52+
- name: Harden Runner
53+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
54+
with:
55+
egress-policy: audit
56+
5257
- name: Checkout repository
5358
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
5459
- name: "Label PR based on title"

‎.github/workflows/layer_rename.yml

+13
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@ on:
3737
name: Layer Rename
3838
run-name: Layer Rename - ${{ inputs.environment }}
3939

40+
permissions:
41+
contents: read
42+
4043
jobs:
4144
download:
4245
runs-on: ubuntu-latest
@@ -53,6 +56,11 @@ jobs:
5356
- AWSLambdaPowertoolsPythonV3-python312
5457
environment: layer-prod
5558
steps:
59+
- name: Harden Runner
60+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
61+
with:
62+
egress-policy: audit
63+
5664
- name: Configure AWS Credentials
5765
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
5866
with:
@@ -125,6 +133,11 @@ jobs:
125133
- "us-west-2"
126134
environment: layer-${{ inputs.environment }}
127135
steps:
136+
- name: Harden Runner
137+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
138+
with:
139+
egress-policy: audit
140+
128141
- name: Download Zip
129142
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
130143
with:

‎.github/workflows/on_closed_issues.yml

+5
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@ jobs:
2121
permissions:
2222
issues: write # comment on issues
2323
steps:
24+
- name: Harden Runner
25+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
26+
with:
27+
egress-policy: audit
28+
2429
- uses: aws-actions/closed-issue-message@80edfc24bdf1283400eb04d20a8a605ae8bf7d48
2530
with:
2631
repo-token: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/on_label_added.yml

+5
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,11 @@ jobs:
4747
permissions:
4848
pull-requests: write # comment on PR
4949
steps:
50+
- name: Harden Runner
51+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
52+
with:
53+
egress-policy: audit
54+
5055
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
5156
# Maintenance: Persist state per PR as an artifact to avoid spam on label add
5257
- name: "Suggest split large Pull Request"

‎.github/workflows/on_merged_pr.yml

+5
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,11 @@ jobs:
4949
issues: write # label issue with pending-release
5050
if: needs.get_pr_details.outputs.prIsMerged == 'true'
5151
steps:
52+
- name: Harden Runner
53+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
54+
with:
55+
egress-policy: audit
56+
5257
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
5358
- name: "Label PR related issue for release"
5459
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1

‎.github/workflows/on_opened_pr.yml

+10
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,11 @@ jobs:
4747
needs: get_pr_details
4848
runs-on: ubuntu-latest
4949
steps:
50+
- name: Harden Runner
51+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
52+
with:
53+
egress-policy: audit
54+
5055
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
5156
- name: "Ensure related issue is present"
5257
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
@@ -66,6 +71,11 @@ jobs:
6671
permissions:
6772
pull-requests: write # label and comment on PR if missing acknowledge section (requirement)
6873
steps:
74+
- name: Harden Runner
75+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
76+
with:
77+
egress-policy: audit
78+
6979
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
7080
- name: "Ensure acknowledgement section is present"
7181
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1

‎.github/workflows/on_pr_updates.yml

+5
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,11 @@ jobs:
2929
check-requirements:
3030
runs-on: ubuntu-latest
3131
steps:
32+
- name: Harden Runner
33+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
34+
with:
35+
egress-policy: audit
36+
3237
- name: Block if it doesn't minimum requirements
3338
if: contains(github.event.pull_request.labels.*.name, 'do-not-merge')
3439
run: |

‎.github/workflows/ossf_scorecard.yml

+5
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@ jobs:
2121
id-token: write # confirm org+repo identity before publish results
2222

2323
steps:
24+
- name: Harden Runner
25+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
26+
with:
27+
egress-policy: audit
28+
2429
- name: "Checkout code"
2530
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
2631
with:

‎.github/workflows/pre-release.yml

+25
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,11 @@ jobs:
6161
# NOTE: Different from prod release, we need both poetry and source code available in earlier steps to bump and verify.
6262

6363
# We use a pinned version of Poetry to be certain it won't modify source code before we create a hash
64+
- name: Harden Runner
65+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
66+
with:
67+
egress-policy: audit
68+
6469
- name: Install poetry
6570
run: |
6671
pipx install git+https://github.com/python-poetry/poetry@68b88e5390720a3dd84f02940ec5200bfce39ac6 # v1.5.0
@@ -110,6 +115,11 @@ jobs:
110115
contents: read
111116
steps:
112117
# NOTE: we need actions/checkout to configure git first (pre-commit hooks in make dev)
118+
- name: Harden Runner
119+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
120+
with:
121+
egress-policy: audit
122+
113123
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
114124
with:
115125
ref: ${{ env.RELEASE_COMMIT }}
@@ -151,6 +161,11 @@ jobs:
151161
attestation_hashes: ${{ steps.encoded_hash.outputs.attestation_hashes }}
152162
steps:
153163
# NOTE: we need actions/checkout to configure git first (pre-commit hooks in make dev)
164+
- name: Harden Runner
165+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
166+
with:
167+
egress-policy: audit
168+
154169
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
155170
with:
156171
ref: ${{ env.RELEASE_COMMIT }}
@@ -220,6 +235,11 @@ jobs:
220235
RELEASE_VERSION: ${{ needs.seal.outputs.RELEASE_VERSION }}
221236
steps:
222237
# NOTE: we need actions/checkout in order to use our local actions (e.g., ./.github/actions)
238+
- name: Harden Runner
239+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
240+
with:
241+
egress-policy: audit
242+
223243
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
224244
with:
225245
ref: ${{ env.RELEASE_COMMIT }}
@@ -244,6 +264,11 @@ jobs:
244264
runs-on: ubuntu-latest
245265
steps:
246266
# NOTE: we need actions/checkout to authenticate and configure git first
267+
- name: Harden Runner
268+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
269+
with:
270+
egress-policy: audit
271+
247272
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
248273
with:
249274
ref: ${{ env.RELEASE_COMMIT }}

‎.github/workflows/publish_v2_layer.yml

+15
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,11 @@ jobs:
8787
run:
8888
working-directory: ./layer
8989
steps:
90+
- name: Harden Runner
91+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
92+
with:
93+
egress-policy: audit
94+
9095
- name: checkout
9196
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
9297
with:
@@ -246,6 +251,11 @@ jobs:
246251
id-token: none
247252
pages: none
248253
steps:
254+
- name: Harden Runner
255+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
256+
with:
257+
egress-policy: audit
258+
249259
- name: Checkout repository # reusable workflows start clean, so we need to checkout again
250260
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
251261
with:
@@ -292,6 +302,11 @@ jobs:
292302
outputs:
293303
DOCS_ALIAS: ${{ steps.set-alias.outputs.DOCS_ALIAS }}
294304
steps:
305+
- name: Harden Runner
306+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
307+
with:
308+
egress-policy: audit
309+
295310
- name: Set docs alias
296311
id: set-alias
297312
run: |

‎.github/workflows/publish_v3_layer.yml

+15
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,11 @@ jobs:
9090
run:
9191
working-directory: ./layer_v3
9292
steps:
93+
- name: Harden Runner
94+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
95+
with:
96+
egress-policy: audit
97+
9398
- name: checkout
9499
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
95100
with:
@@ -244,6 +249,11 @@ jobs:
244249
id-token: none
245250
pages: none
246251
steps:
252+
- name: Harden Runner
253+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
254+
with:
255+
egress-policy: audit
256+
247257
- name: Checkout repository # reusable workflows start clean, so we need to checkout again
248258
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
249259
with:
@@ -290,6 +300,11 @@ jobs:
290300
outputs:
291301
DOCS_ALIAS: ${{ steps.set-alias.outputs.DOCS_ALIAS }}
292302
steps:
303+
- name: Harden Runner
304+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
305+
with:
306+
egress-policy: audit
307+
293308
- name: Set docs alias
294309
id: set-alias
295310
run: |

‎.github/workflows/quality_check.yml

+5
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,11 @@ jobs:
5252
permissions:
5353
contents: read # checkout code only
5454
steps:
55+
- name: Harden Runner
56+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
57+
with:
58+
egress-policy: audit
59+
5560
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
5661
- name: Install poetry
5762
run: pipx install poetry

‎.github/workflows/record_pr.yml

+5
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,11 @@ jobs:
4646
permissions:
4747
contents: read # NOTE: treat as untrusted location
4848
steps:
49+
- name: Harden Runner
50+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
51+
with:
52+
egress-policy: audit
53+
4954
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
5055
- name: "Extract PR details"
5156
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1

‎.github/workflows/release-drafter.yml

+5
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,11 @@ jobs:
2727
permissions:
2828
contents: write # create release in draft mode
2929
steps:
30+
- name: Harden Runner
31+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
32+
with:
33+
egress-policy: audit
34+
3035
- uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348 # v5.20.1
3136
env:
3237
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)