Skip to content

Addressing Security Concerns Raised by OpenSSF Scorecard#20090

Merged
freben merged 6 commits intobackstage:masterfrom
NishkarshRaj:feature/openssf-security-enhancements
Oct 17, 2023
Merged

Addressing Security Concerns Raised by OpenSSF Scorecard#20090
freben merged 6 commits intobackstage:masterfrom
NishkarshRaj:feature/openssf-security-enhancements

Conversation

@NishkarshRaj
Copy link
Contributor

Hey, I just made a Pull Request!

Added:

  • Pinned Dependency to SHA level
  • Permissions defined for GitHub Actions following PoLP

Note: This PR is modified version of #19249

✔️ Checklist

  • A changeset describing the change and affected packages. (more info)
  • Added or updated documentation
  • Tests for new functionality and regression tests for bug fixes
  • Screenshots attached (for UI changes)
  • All your commits have a Signed-off-by line in the message. (more info)

@NishkarshRaj NishkarshRaj requested review from a team as code owners September 21, 2023 17:19
@NishkarshRaj NishkarshRaj changed the title Feature/openssf security enhancements Addressing Security Concerns Raised by OpenSSF Scorecard Sep 21, 2023
@github-actions
Copy link
Contributor

github-actions bot commented Sep 21, 2023

Uffizzi Preview deployment-36570 was deleted.

@NishkarshRaj
Copy link
Contributor Author

cc/ @adamdmharvey @Rugvip

@adamdmharvey
Copy link
Member

Nice one!

As you can probably see, numerous E2E failures for the pipeline. I'm not familiar with the exact steps that the harden runner performs, but perhaps it's removing something the tests depend on? I wonder if you want to try maybe removing the harden step (like commenting it out) for the E2E action maybe causes it to run clean? if so then you can at least identify the root cause of the failure to focus more on what it does. (and then potentially split the PR into one that just does the version pin/permissions and another for harden? not sure!)

@NishkarshRaj
Copy link
Contributor Author

Cheers for the inputs @adamdmharvey - was stuck in travelling hell past few days!

I'll rebase with master and let's see how it looks.

Post that will comment out harden runners changes.

@NishkarshRaj
Copy link
Contributor Author

NishkarshRaj commented Sep 28, 2023

Wow! @adamdmharvey As soon as I tried commenting out the Harden runners, the docker registries are seemingly facing downtime!? 😭

Logs:

This is def not due to restricted permissions else we would have got 401/403 but getting 5xx

I'll recheck in a while!

@adamdmharvey
Copy link
Member

Triggered a re-run of the failed actions; definitely passed the Docker step...

@NishkarshRaj
Copy link
Contributor Author

Triggered a re-run of the failed actions; definitely passed the Docker step...

Cheers, 5xx must have been resolved - I'll re-trigger all pipelines and take it from there.

@NishkarshRaj
Copy link
Contributor Author

@adamdmharvey Both E2E Testing failing due to this application level issue. This is outside scope of this PR as I've only updated the workflow files.

Any nudges on how to proceed?

@github-actions
Copy link
Contributor

github-actions bot commented Oct 6, 2023

This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution!

@github-actions github-actions bot added the stale label Oct 6, 2023
@freben freben removed the stale label Oct 8, 2023
step-security-bot and others added 4 commits October 8, 2023 18:55
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Signed-off-by: NishkarshRaj <nishkarshraj000@gmail.com>
Signed-off-by: NishkarshRaj <nishkarshraj000@gmail.com>
…kflows

Signed-off-by: NishkarshRaj <nishkarshraj000@gmail.com>
@freben freben force-pushed the feature/openssf-security-enhancements branch from 5bbf1c7 to b4d24e9 Compare October 8, 2023 16:56
@freben
Copy link
Member

freben commented Oct 8, 2023

took the liberty of rebasing to see if builds are happier

@NishkarshRaj
Copy link
Contributor Author

took the liberty of rebasing to see if builds are happier

Thanks @freben - only 2 failures remain but I can't make sense of these logs. Can you nudge what shall I change to proceed?

@freben freben added the needs:direction Bring up for discussion during next sync label Oct 9, 2023
@freben
Copy link
Member

freben commented Oct 9, 2023

We still have some remaining windows build issues, don't worry about those.

Why is the harden runner commented out everywhere?

@NishkarshRaj
Copy link
Contributor Author

We still have some remaining windows build issues, don't worry about those.

Why is the harden runner commented out everywhere?

Was just checking if the failed pipelines are caused by Harden Runner - not really so I will be uncommenting them now.

Will commit and leave it to you guys for best next steps :)

@NishkarshRaj NishkarshRaj requested review from a team and backstage-service as code owners October 9, 2023 08:52
@NishkarshRaj NishkarshRaj requested a review from hntrdglss October 9, 2023 08:52
@github-actions github-actions bot added area:documentation Improvements or additions to documentation area:catalog Related to the Catalog Project Area area:techdocs Related to the TechDocs Project Area area:microsite Changes to backstage.io labels Oct 9, 2023
@benjdlambert
Copy link
Member

Looks like something has gone awry here with the rebase, could you rebase again to just have your commits in here @NishkarshRaj? 🙏

@NishkarshRaj
Copy link
Contributor Author

Looks like something has gone awry here with the rebase, could you rebase again to just have your commits in here @NishkarshRaj? 🙏

Oh snap! I am on it :)

@NishkarshRaj NishkarshRaj force-pushed the feature/openssf-security-enhancements branch from 1e3f14b to 595ed3b Compare October 9, 2023 10:18
@github-actions github-actions bot removed area:documentation Improvements or additions to documentation area:catalog Related to the Catalog Project Area area:techdocs Related to the TechDocs Project Area area:microsite Changes to backstage.io labels Oct 9, 2023
@NishkarshRaj
Copy link
Contributor Author

NishkarshRaj commented Oct 9, 2023

@freben @benjdlambert : Fixed the rebase mistake, hope this works now.

@camilaibs camilaibs added workflow:after-release This is a bit too scary to merge until after the next release and removed needs:direction Bring up for discussion during next sync labels Oct 12, 2023
@freben
Copy link
Member

freben commented Oct 12, 2023

we've put a "merge after release" label on this so we can revisit merging it after the mainline release out of an abundance of caution against getting into release problems.

@freben freben merged commit 1c5bbae into backstage:master Oct 17, 2023
@NishkarshRaj NishkarshRaj deleted the feature/openssf-security-enhancements branch October 17, 2023 12:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

workflow:after-release This is a bit too scary to merge until after the next release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants