Skip to content

Commit 294297a

Browse files
zgosalvezzgosalvez
committed
Initial commit
0 parents  commit 294297a

14 files changed

+14557
-0
lines changed

‎.eslintignore

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
dist/

‎.eslintrc.json

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"env": {
3+
"commonjs": true,
4+
"es6": true,
5+
"node": true
6+
},
7+
"extends": "eslint:recommended",
8+
"globals": {
9+
"Atomics": "readonly",
10+
"SharedArrayBuffer": "readonly"
11+
},
12+
"parserOptions": {
13+
"ecmaVersion": 2018
14+
},
15+
"rules": {
16+
}
17+
}

‎.gitattributes

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
dist/** -diff linguist-generated=true

‎.gitignore

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
node_modules/
2+
3+
# Editors
4+
.vscode/
5+
.idea/
6+
*.iml
7+
8+
# Logs
9+
logs
10+
*.log
11+
npm-debug.log*
12+
yarn-debug.log*
13+
yarn-error.log*
14+
15+
# Runtime data
16+
pids
17+
*.pid
18+
*.seed
19+
*.pid.lock
20+
21+
# Directory for instrumented libs generated by jscoverage/JSCover
22+
lib-cov
23+
24+
# Coverage directory used by tools like istanbul
25+
coverage
26+
27+
# nyc test coverage
28+
.nyc_output
29+
30+
# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
31+
.grunt
32+
33+
# Bower dependency directory (https://bower.io/)
34+
bower_components
35+
36+
# node-waf configuration
37+
.lock-wscript
38+
39+
# Compiled binary addons (https://nodejs.org/api/addons.html)
40+
build/Release
41+
42+
# Other Dependency directories
43+
jspm_packages/
44+
45+
# TypeScript v1 declaration files
46+
typings/
47+
48+
# Optional npm cache directory
49+
.npm
50+
51+
# Optional eslint cache
52+
.eslintcache
53+
54+
# Optional REPL history
55+
.node_repl_history
56+
57+
# Output of 'npm pack'
58+
*.tgz
59+
60+
# Yarn Integrity file
61+
.yarn-integrity
62+
63+
# dotenv environment variables file
64+
.env
65+
66+
# next.js build output
67+
.next

‎LICENSE.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2020 Zennon Gosalvez
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# GitHub Action — Ensure SHA Pinned Actions
2+
3+
This GitHub Action (written in JavaScript) allows you to leverage GitHub Actions to ensure that GitHub Actions are pinned to full length commit SHAs. For more information, see "[using third-party actions](https://docs.github.com/en/free-pro-team@latest/actions/learn-github-actions/security-hardening-for-github-actions#using-third-party-actions)."
4+
5+
## Usage
6+
### Pre-requisites
7+
Create a workflow `.yml` file in your `.github/workflows` directory. An [example workflow](#example-workflow---create-a-release) is available below. For more information, reference the GitHub Help Documentation for [Creating a workflow file](https://help.github.com/en/articles/configuring-a-workflow#creating-a-workflow-file).
8+
9+
### Inputs
10+
None. This action will automatically scan for workflows in the `.github/wokrflows` directory.
11+
12+
### Outputs
13+
None. This action will throw an error if it finds GitHub Actions that are not pinned to full length commit SHAs.
14+
15+
### Common workflow
16+
17+
Ideally, set this up as an initial job for your workflows. For example:
18+
```yaml
19+
on: push
20+
21+
name: Continuous Integration
22+
23+
jobs:
24+
harden_security:
25+
name: Harden Security
26+
runs-on: ubuntu-latest
27+
steps:
28+
- name: Checkout code
29+
uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
30+
- name: Ensure SHA pinned actions
31+
uses: zgosalvez/[email protected] # Replace this
32+
```
33+
34+
## License
35+
The scripts and documentation in this project are released under the [MIT License](LICENSE)

‎action.yml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# https://github.com/actions/javascript-action
2+
3+
name: 'Ensure SHA Pinned Actions'
4+
description: 'Ensure that GitHub Actions are pinned to full length commit SHAs'
5+
author: 'Zennon Gosalvez'
6+
runs:
7+
using: 'node12'
8+
main: 'dist/index.js'
9+
branding:
10+
icon: shield
11+
color: gray-dark

0 commit comments

Comments
 (0)