From b0d78765775ff67e70d8a4604ec1651f40336d02 Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Wed, 15 Jul 2026 17:59:49 +0000 Subject: [PATCH] Apply GitHub Actions security best practices Signed-off-by: StepSecurity Bot --- .github/dependabot.yml | 18 +++++++++ .github/workflows/audit.yml | 16 +++++++- .github/workflows/ci.yml | 49 +++++++++++++++++++------ .github/workflows/docdeploy.yml | 11 ++++-- .github/workflows/release.yml | 21 +++++++++-- .github/workflows/update_flake_lock.yml | 11 ++++-- 6 files changed, 103 insertions(+), 23 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..4d9fd89e --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,18 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + cooldown: + default-days: 7 + + - package-ecosystem: cargo + directory: / + schedule: + interval: weekly + cooldown: + default-days: 7 + semver-major-days: 30 + semver-minor-days: 14 + semver-patch-days: 5 diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index c80a4847..7290c41c 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -8,11 +8,23 @@ on: - '**/Cargo.lock' pull_request: +permissions: + contents: read + jobs: audit: + permissions: + checks: write # for actions-rs/audit-check to create check + contents: read # for actions/checkout to fetch code + issues: write # for actions-rs/audit-check to create issues runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions-rs/audit-check@v1 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 + - uses: actions-rs/audit-check@35b7b53b1e25b55642157ac01b4adceb5b9ebef3 # v1.2.0 with: token: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3e9bceb8..8f197afe 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,8 +17,13 @@ jobs: rust: - stable steps: - - uses: actions/checkout@v2 - - uses: actions-rs/toolchain@v1 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 + - uses: step-security/actions-rs-toolchain@40a2f87e50bed6faa2d050e99810b226b75d8c8a # v1.0.7 with: profile: minimal toolchain: ${{ matrix.rust }} @@ -33,8 +38,13 @@ jobs: rust: - stable steps: - - uses: actions/checkout@v2 - - uses: actions-rs/toolchain@v1 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 + - uses: step-security/actions-rs-toolchain@40a2f87e50bed6faa2d050e99810b226b75d8c8a # v1.0.7 with: profile: minimal toolchain: ${{ matrix.rust }} @@ -49,12 +59,17 @@ jobs: rust: - stable steps: - - uses: actions/checkout@v2 - - uses: extractions/setup-just@v1 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 + - uses: extractions/setup-just@69d82fb0233557aec017ef13706851d0694e0f1d # v1.6.0 with: just-version: 1 - - uses: kenji-miyake/setup-sd@v2 - - uses: actions-rs/toolchain@v1 + - uses: kenji-miyake/setup-sd@f4181660873fa5814708e1c0a640d8e9975a4ae5 # v2.0.0 + - uses: step-security/actions-rs-toolchain@40a2f87e50bed6faa2d050e99810b226b75d8c8a # v1.0.7 with: profile: minimal toolchain: ${{ matrix.rust }} @@ -70,8 +85,13 @@ jobs: rust: - stable steps: - - uses: actions/checkout@v2 - - uses: actions-rs/toolchain@v1 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 + - uses: step-security/actions-rs-toolchain@40a2f87e50bed6faa2d050e99810b226b75d8c8a # v1.0.7 with: profile: minimal toolchain: ${{ matrix.rust }} @@ -87,8 +107,13 @@ jobs: rust: - stable steps: - - uses: actions/checkout@v2 - - uses: actions-rs/toolchain@v1 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 + - uses: step-security/actions-rs-toolchain@40a2f87e50bed6faa2d050e99810b226b75d8c8a # v1.0.7 with: profile: minimal toolchain: ${{ matrix.rust }} diff --git a/.github/workflows/docdeploy.yml b/.github/workflows/docdeploy.yml index f8e466ac..6d8068e1 100644 --- a/.github/workflows/docdeploy.yml +++ b/.github/workflows/docdeploy.yml @@ -10,13 +10,18 @@ jobs: name: Deploy Documentation runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions-rust-lang/setup-rust-toolchain@v1 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 + - uses: step-security/setup-rust-toolchain@a8823c6cdb5668ac7528d7756acfee772bf71809 # v1.16.1 with: toolchain: stable - run: (test -x $HOME/.cargo/bin/mdbook || cargo install mdbook) - run: mdbook build docs - - uses: JamesIves/github-pages-deploy-action@4.1.7 + - uses: JamesIves/github-pages-deploy-action@6ce741f5d4e01e15f9ea5ec96df1a43f522c330f # 4.1.7 with: branch: gh-pages # The branch the action should deploy to. folder: docs/book # The folder the action should deploy. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3fb612bc..753aae75 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,7 +50,12 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v3 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Install Rust run: rustup update stable --no-self-update && rustup default stable - name: Install cargo-dist @@ -102,7 +107,12 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v3 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Install Rust run: rustup update stable --no-self-update && rustup default stable - name: Install cargo-dist @@ -134,7 +144,12 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v3 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: mark release as non-draft run: | gh release edit ${{ github.ref_name }} --draft=false diff --git a/.github/workflows/update_flake_lock.yml b/.github/workflows/update_flake_lock.yml index 3ff81489..677c234b 100644 --- a/.github/workflows/update_flake_lock.yml +++ b/.github/workflows/update_flake_lock.yml @@ -9,9 +9,14 @@ jobs: nix-flake-update: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: DeterminateSystems/determinate-nix-action@v3 - - uses: DeterminateSystems/update-flake-lock@main + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: DeterminateSystems/determinate-nix-action@c70cb8ae92d68c66953db28a26a63db1665bc837 # v3.21.5 + - uses: DeterminateSystems/update-flake-lock@ec13d37c32ca75bc750ecc133e944e5a18164688 # main with: pr-title: "Update flake.lock file with latest versions" pr-labels: |