Skip to content

Commit 544ee3e

Browse files
step-security-botstep-security-bot
committed
- Apply security best practices
1 parent 9c733d1 commit 544ee3e

File tree

22 files changed

+401
-73
lines changed

22 files changed

+401
-73
lines changed

‎.github/dependabot.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: daily
7+
8+
- package-ecosystem: cargo
9+
directory: /
10+
schedule:
11+
interval: daily
12+
13+
- package-ecosystem: pip
14+
directory: /src/catalyst-toolbox/catalyst-toolbox/scripts/python
15+
schedule:
16+
interval: daily
17+
18+
- package-ecosystem: npm
19+
directory: /src/chain-wallet-libs/bindings/wallet-cordova
20+
schedule:
21+
interval: daily
22+
23+
- package-ecosystem: npm
24+
directory: /src/chain-wallet-libs/bindings/wallet-cordova/tests
25+
schedule:
26+
interval: daily
27+
28+
- package-ecosystem: npm
29+
directory: /src/chain-wallet-libs/bindings/wallet-wasm-js/js-test
30+
schedule:
31+
interval: daily
32+
33+
- package-ecosystem: npm
34+
directory: /src/chain-wallet-libs/bindings/wallet-wasm-js/js
35+
schedule:
36+
interval: daily
37+
38+
- package-ecosystem: docker
39+
directory: /src/jormungandr/ci/docker
40+
schedule:
41+
interval: daily
42+
43+
- package-ecosystem: docker
44+
directory: /src/jormungandr/docker
45+
schedule:
46+
interval: daily
47+
48+
- package-ecosystem: docker
49+
directory: /src/jormungandr/docker/alpine
50+
schedule:
51+
interval: daily
52+
53+
- package-ecosystem: docker
54+
directory: /src/vit-servicing-station/docker/master
55+
schedule:
56+
interval: daily
57+
58+
- package-ecosystem: docker
59+
directory: /src/vit-servicing-station/docker/soak_tests
60+
schedule:
61+
interval: daily
62+
63+
- package-ecosystem: docker
64+
directory: /src/vit-testing/docker/snapshot-service-wormhole
65+
schedule:
66+
interval: daily
67+
68+
- package-ecosystem: docker
69+
directory: /src/vit-testing/docker/snapshot-service
70+
schedule:
71+
interval: daily
72+
73+
- package-ecosystem: docker
74+
directory: /src/vit-testing/docker/vitup/demo
75+
schedule:
76+
interval: daily
77+
78+
- package-ecosystem: docker
79+
directory: /src/vit-testing/docker/vitup/mock
80+
schedule:
81+
interval: daily
82+
83+
- package-ecosystem: pip
84+
directory: /utilities/ideascale-importer
85+
schedule:
86+
interval: daily

‎.github/workflows/branch-delete-cleanup.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,22 @@
11
name: Branch Deleted
22
on: delete
3+
permissions:
4+
contents: read
5+
36
jobs:
47
delete:
8+
permissions:
9+
contents: write # for stefanzweifel/git-auto-commit-action to push code in repo
510
name: On branch deleted
611
if: github.event.ref_type == 'branch'
712

813
runs-on: ubuntu-latest
914
steps:
15+
- name: Harden Runner
16+
uses: step-security/harden-runner@c8454efe5d0bdefd25384362fe217428ca277d57 # v2.2.0
17+
with:
18+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
19+
1020
- name: Set env
1121
run: |
1222
GIT_BRANCH=$(echo ${{ github.event.ref }} | sed -e "s#refs/heads/##g")
@@ -18,7 +28,7 @@ jobs:
1828
echo "Clean up for branch ${{ env.GIT_BRANCH }}"
1929
2030
- name: Get current published documentation
21-
uses: actions/checkout@v3
31+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
2232
with:
2333
ref: gh-pages
2434

@@ -27,6 +37,6 @@ jobs:
2737
rm -rf ${{ env.GIT_BRANCH }}
2838
2939
- name: Save updated docs
30-
uses: stefanzweifel/git-auto-commit-action@v4
40+
uses: stefanzweifel/git-auto-commit-action@3ea6ae190baf489ba007f7c92608f33ce20ef04a # v4.16.0
3141
with:
3242
commit_message: Removed Draft Docs for ${{ env.GIT_BRANCH }}

‎.github/workflows/build.yml‎

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,32 +31,47 @@ env:
3131
SEGMENT_DOWNLOAD_TIMEOUT_MINS: 15
3232

3333

34+
permissions:
35+
contents: read
36+
3437
jobs:
3538
cancel:
39+
permissions:
40+
actions: write # for styfle/cancel-workflow-action to cancel/stop running workflows
3641
name: 'Cancel Previous Runs'
3742
runs-on: ubuntu-latest
3843
timeout-minutes: 3
3944
steps:
40-
- uses: styfle/[email protected]
45+
- name: Harden Runner
46+
uses: step-security/harden-runner@c8454efe5d0bdefd25384362fe217428ca277d57 # v2.2.0
47+
with:
48+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
49+
50+
- uses: styfle/cancel-workflow-action@b173b6ec0100793626c2d9e6b90435061f4fc3e5 # 0.11.0
4151
with:
4252
access_token: ${{ github.token }}
4353

4454
build_on_linux:
4555
name: Build Catalyst Core on Linux
4656
runs-on: ubuntu-latest
4757
steps:
58+
- name: Harden Runner
59+
uses: step-security/harden-runner@c8454efe5d0bdefd25384362fe217428ca277d57 # v2.2.0
60+
with:
61+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
62+
4863
- name: Checkout code
49-
uses: actions/checkout@v3
64+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
5065
with:
5166
ref: ${{ github.event.pull_request.head.sha }}
5267

5368
- name: Install rust
54-
uses: actions-rs/toolchain@v1
69+
uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
5570
with:
5671
toolchain: ${{env.RUST_LATEST_STABLE_VERSION}}
5772

5873
- name: Cache rust
59-
uses: Swatinem/rust-cache@v2
74+
uses: Swatinem/rust-cache@6fd3edff6979b79f87531400ad694fb7f2c84b1f # v2.2.1
6075
with:
6176
shared-key: "build_cache"
6277
save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -74,6 +89,11 @@ jobs:
7489
env:
7590
CARGO_FLAGS: --verbose --locked
7691
steps:
92+
- name: Harden Runner
93+
uses: step-security/harden-runner@c8454efe5d0bdefd25384362fe217428ca277d57 # v2.2.0
94+
with:
95+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
96+
7797
- name: Checkout code on PR
7898
# Workaround for the running out of disk space issue. See https://github.com/actions/runner-images/issues/1341
7999
run: |
@@ -98,7 +118,7 @@ jobs:
98118
git config --system core.longpaths true
99119
100120
- name: Cache rust
101-
uses: Swatinem/rust-cache@v2
121+
uses: Swatinem/rust-cache@6fd3edff6979b79f87531400ad694fb7f2c84b1f # v2.2.1
102122
with:
103123
workspaces: "C:\\${{ github.event.repository.name }}"
104124
save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -119,7 +139,7 @@ jobs:
119139
"PQ_LIB_DIR=${env:PROGRAMFILES}\PostgreSQL\14\lib" >> $env:GITHUB_ENV
120140
121141
- name: Install rust
122-
uses: actions-rs/toolchain@v1
142+
uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
123143
with:
124144
toolchain: ${{env.RUST_LATEST_STABLE_VERSION}}
125145

‎.github/workflows/ci-tests-n-coverage.yml‎

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,14 @@ concurrency:
1919
group: ${{ github.sha }}
2020
cancel-in-progress: true
2121

22+
permissions:
23+
contents: read
24+
2225
jobs:
2326
unit-tests:
27+
permissions:
28+
checks: write # for coverallsapp/github-action to create new checks
29+
contents: read # for actions/checkout to fetch code
2430
name: Unit Tests
2531
runs-on: ubuntu-latest
2632
needs: [integration-tests]
@@ -38,26 +44,31 @@ jobs:
3844
ports:
3945
- 5432:5432
4046
steps:
47+
- name: Harden Runner
48+
uses: step-security/harden-runner@c8454efe5d0bdefd25384362fe217428ca277d57 # v2.2.0
49+
with:
50+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
51+
4152
- name: Checkout code
42-
uses: actions/checkout@v3
53+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
4354

4455
- name: Install Rust toolchain
45-
uses: actions-rs/toolchain@v1
56+
uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
4657
with:
4758
toolchain: ${{env.RUST_LATEST_STABLE_VERSION}} # it says it can read the rust-toolchain file, but it fails if we omit this
4859
components: llvm-tools-preview
4960

5061
- name: Cache rust
51-
uses: Swatinem/rust-cache@v2
62+
uses: Swatinem/rust-cache@6fd3edff6979b79f87531400ad694fb7f2c84b1f # v2.2.1
5263
with:
5364
shared-key: "build_cache"
5465
save-if: "false"
5566

5667
- name: Install nextest
57-
uses: taiki-e/install-action@nextest
68+
uses: taiki-e/install-action@ddfbd2cab72fd94842c80ade93f28fe7ee9c71f8 # nextest
5869

5970
- name: Install cargo-llvm-cov
60-
uses: taiki-e/install-action@cargo-llvm-cov
71+
uses: taiki-e/install-action@cdc3afe6ed5a5d5870c227c04be4eeb43e48fc81 # cargo-llvm-cov
6172

6273
- name: Install system deps
6374
run:
@@ -102,7 +113,7 @@ jobs:
102113
cargo llvm-cov report --lcov --output-path ./lcov.info
103114
104115
- name: Upload code coverage to coveralls.io
105-
uses: coverallsapp/github-action@master
116+
uses: coverallsapp/github-action@50c33ad324a9902697adbf2f92c22cf5023eacf1 # master
106117
with:
107118
github-token: ${{ secrets.GITHUB_TOKEN }}
108119
path-to-lcov: "./lcov.info"
@@ -124,26 +135,31 @@ jobs:
124135
ports:
125136
- 5432:5432
126137
steps:
138+
- name: Harden Runner
139+
uses: step-security/harden-runner@c8454efe5d0bdefd25384362fe217428ca277d57 # v2.2.0
140+
with:
141+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
142+
127143
- name: Checkout code
128-
uses: actions/checkout@v3
144+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
129145

130146
- name: Install Rust toolchain
131-
uses: actions-rs/toolchain@v1
147+
uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
132148
with:
133149
toolchain: ${{env.RUST_LATEST_STABLE_VERSION}} # it says it can read the rust-toolchain file, but it fails if we omit this
134150
components: llvm-tools-preview
135151

136152
- name: Cache rust
137-
uses: Swatinem/rust-cache@v2
153+
uses: Swatinem/rust-cache@6fd3edff6979b79f87531400ad694fb7f2c84b1f # v2.2.1
138154
with:
139155
shared-key: "build_cache"
140156
save-if: "false"
141157

142158
- name: Install nextest
143-
uses: taiki-e/install-action@nextest
159+
uses: taiki-e/install-action@ddfbd2cab72fd94842c80ade93f28fe7ee9c71f8 # nextest
144160

145161
- name: Install cargo-llvm-cov
146-
uses: taiki-e/install-action@cargo-llvm-cov
162+
uses: taiki-e/install-action@cdc3afe6ed5a5d5870c227c04be4eeb43e48fc81 # cargo-llvm-cov
147163

148164
- name: Install system deps
149165
run:

‎.github/workflows/codeql.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: ["main"]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: ["main"]
20+
schedule:
21+
- cron: "0 0 * * 1"
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
analyze:
28+
name: Analyze
29+
runs-on: ubuntu-latest
30+
permissions:
31+
actions: read
32+
contents: read
33+
security-events: write
34+
35+
strategy:
36+
fail-fast: false
37+
matrix:
38+
language: ["javascript", "python"]
39+
# CodeQL supports [ $supported-codeql-languages ]
40+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
41+
42+
steps:
43+
- name: Harden Runner
44+
uses: step-security/harden-runner@c8454efe5d0bdefd25384362fe217428ca277d57 # v2.2.0
45+
with:
46+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
47+
48+
- name: Checkout repository
49+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
50+
51+
# Initializes the CodeQL tools for scanning.
52+
- name: Initialize CodeQL
53+
uses: github/codeql-action/init@32dc499307d133bb5085bae78498c0ac2cf762d5 # v2.2.5
54+
with:
55+
languages: ${{ matrix.language }}
56+
# If you wish to specify custom queries, you can do so here or in a config file.
57+
# By default, queries listed here will override any specified in a config file.
58+
# Prefix the list here with "+" to use these queries and those in the config file.
59+
60+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
61+
# If this step fails, then you should remove it and run the build manually (see below)
62+
- name: Autobuild
63+
uses: github/codeql-action/autobuild@32dc499307d133bb5085bae78498c0ac2cf762d5 # v2.2.5
64+
65+
# ℹ️ Command-line programs to run using the OS shell.
66+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
67+
68+
# If the Autobuild fails above, remove it and uncomment the following three lines.
69+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
70+
71+
# - run: |
72+
# echo "Run, Build Application using script"
73+
# ./location_of_script_within_repo/buildscript.sh
74+
75+
- name: Perform CodeQL Analysis
76+
uses: github/codeql-action/analyze@32dc499307d133bb5085bae78498c0ac2cf762d5 # v2.2.5
77+
with:
78+
category: "/language:${{matrix.language}}"

0 commit comments

Comments
 (0)