ci: harden GitHub Actions #1658
Conversation
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
WalkthroughThe pull request introduces updates to the Changes
Possibly related PRs
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (2)
.github/workflows/check-for-typos.yml (2)
14-17: Great addition of the Harden Runner step!The inclusion of the
step-security/harden-runneraction significantly enhances the workflow's security. Pinning the action to a specific commit (91182cccc01eb5e619899d80e4e971d6181294a7) is an excellent practice that prevents potential supply chain attacks.The
egress-policy: auditsetting is a good start, as it allows monitoring of network traffic. However, consider if a stricter policy might be appropriate for this workflow.If the typo check doesn't require network access, you might want to consider changing the egress policy to
egress-policy: blockfor even stronger security. This would prevent any unexpected network calls.
23-23: Great job pinning the typos action!Updating the
crate-ci/typosaction to use a specific commit (14f49f455cf3b6a38841665e82c3b9135b91c929) instead of themasterbranch is a crucial security improvement. This change ensures consistency and protects against potential supply chain attacks.Consider updating the comment to remove the reference to "master":
- uses: crate-ci/typos@14f49f455cf3b6a38841665e82c3b9135b91c929 # master + uses: crate-ci/typos@14f49f455cf3b6a38841665e82c3b9135b91c929 # pinned to specific commitThis will make the intention clearer and avoid any confusion with the previous configuration.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (1)
- .github/workflows/check-for-typos.yml (1 hunks)
🔇 Additional comments (3)
.github/workflows/check-for-typos.yml (3)
6-7: Excellent addition of least privileged permissions!Setting
contents: readpermission is a crucial security improvement. It ensures that the workflow only has read access to the repository contents, which is sufficient for a typo checking task. This change aligns perfectly with the principle of least privilege and reduces the potential impact of a compromised workflow.
20-20: Excellent pinning of the checkout action!Updating the
actions/checkoutaction to use a specific commit (692973e3d937129bcbf40652eb9f2f61becf3332) instead of thev4tag is a significant security improvement. This practice ensures consistency across runs and protects against potential supply chain attacks by preventing the use of a potentially compromised or maliciously updated action.
Line range hint
1-23: Overall, excellent security improvements to the workflow!This PR successfully achieves its objectives of enhancing GitHub Actions security:
- Least privileged permissions are set appropriately.
- The Harden Runner step is added to protect against supply chain attacks.
- All action versions are pinned to specific commits, preventing potential vulnerabilities from mutable tags.
These changes significantly improve the security posture of the typo-checking workflow. The only suggestions for further improvement are minor:
- Consider using a stricter egress policy if network access isn't required.
- Update the comment on the typos action to reflect the pinned commit.
Great work on implementing these security best practices!
Summary
This pull request is created by StepSecurity at the request of @tolgaozen. Please merge the Pull Request to incorporate the requested changes. Please tag @tolgaozen on your message if you have any questions related to the PR.
Security Fixes
Least Privileged GitHub Actions Token Permissions
The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API. GitHub recommends setting minimum token permissions for the GITHUB_TOKEN.
Pinned Dependencies
GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.
Harden Runner
Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without
sudoaccess.Harden runner usage
You can find link to view insights and policy recommendation in the build log
Please refer to documentation to find more details.
Feedback
For bug reports, feature requests, and general feedback; please email support@stepsecurity.io. To create such PRs, please visit https://app.stepsecurity.io/securerepo.
Signed-off-by: StepSecurity Bot bot@stepsecurity.io
Summary by CodeRabbit