From ecb30e76ec46992bb40e8b3038635ef51ed2edc8 Mon Sep 17 00:00:00 2001 From: StepSecurity Bot Date: Tue, 27 Feb 2024 07:40:04 +0000 Subject: [PATCH] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/workflows/dependency-review.yml | 27 +++++++++++++++++++++++ .github/workflows/nuget_update.yaml | 5 +++++ .github/workflows/ossar-scan.yml | 5 +++++ .github/workflows/release-scheduler.yml | 5 +++++ .github/workflows/reusable-build.yml | 5 +++++ .github/workflows/reusable-test.yml | 5 +++++ .github/workflows/upload-perf-results.yml | 5 +++++ .pre-commit-config.yaml | 18 +++++++++++++++ 8 files changed, 75 insertions(+) create mode 100644 .github/workflows/dependency-review.yml create mode 100644 .pre-commit-config.yaml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000000..3f3456223b --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,27 @@ +# Dependency Review Action +# +# This Action will scan dependency manifest files that change as part of a Pull Request, +# surfacing known-vulnerable versions of the packages declared or updated in the PR. +# Once installed, if the workflow run is marked as required, +# PRs introducing known-vulnerable packages will be blocked from merging. +# +# Source repository: https://github.com/actions/dependency-review-action +name: 'Dependency Review' +on: [pull_request] + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Harden Runner + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 + with: + egress-policy: audit + + - name: 'Checkout Repository' + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - name: 'Dependency Review' + uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1 diff --git a/.github/workflows/nuget_update.yaml b/.github/workflows/nuget_update.yaml index f18a0bde47..c0d9d49249 100644 --- a/.github/workflows/nuget_update.yaml +++ b/.github/workflows/nuget_update.yaml @@ -32,6 +32,11 @@ jobs: steps: # Check out the main repo. + - name: Harden Runner + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 + with: + egress-policy: audit + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 with: # Only check out main repo, not submodules. diff --git a/.github/workflows/ossar-scan.yml b/.github/workflows/ossar-scan.yml index 2903ed4b38..caa4599c2f 100644 --- a/.github/workflows/ossar-scan.yml +++ b/.github/workflows/ossar-scan.yml @@ -35,6 +35,11 @@ jobs: BUILD_PLATFORM: x64 steps: + - name: Harden Runner + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 + with: + egress-policy: audit + - id: skip_check uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1 with: diff --git a/.github/workflows/release-scheduler.yml b/.github/workflows/release-scheduler.yml index 5cb0debde5..292a80140d 100644 --- a/.github/workflows/release-scheduler.yml +++ b/.github/workflows/release-scheduler.yml @@ -18,6 +18,11 @@ jobs: permissions: issues: write steps: + - name: Harden Runner + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 + with: + egress-policy: audit + - name: Create release task uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea env: diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 776e3cab90..c7d14ac029 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -65,6 +65,11 @@ jobs: LD_FLAGS: ${{inputs.ld_flags}} steps: + - name: Harden Runner + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 + with: + egress-policy: audit + - id: skip_check uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1 with: diff --git a/.github/workflows/reusable-test.yml b/.github/workflows/reusable-test.yml index e4f9b29785..340f217c67 100644 --- a/.github/workflows/reusable-test.yml +++ b/.github/workflows/reusable-test.yml @@ -84,6 +84,11 @@ jobs: TEST_TIMEOUT: 3600 # 1 hour timeout for tests. steps: + - name: Harden Runner + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 + with: + egress-policy: audit + - id: skip_check uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1 with: diff --git a/.github/workflows/upload-perf-results.yml b/.github/workflows/upload-perf-results.yml index c4818524be..889e22c4b4 100644 --- a/.github/workflows/upload-perf-results.yml +++ b/.github/workflows/upload-perf-results.yml @@ -29,6 +29,11 @@ jobs: upload_results: runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 + with: + egress-policy: audit + - name: Download performance result artifacts uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe with: diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000000..ed03062335 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,18 @@ +repos: +- repo: https://github.com/gitleaks/gitleaks + rev: v8.16.3 + hooks: + - id: gitleaks +- repo: https://github.com/jumanjihouse/pre-commit-hooks + rev: 3.0.0 + hooks: + - id: shellcheck +- repo: https://github.com/pocc/pre-commit-hooks + rev: v1.3.5 + hooks: + - id: cpplint +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.4.0 + hooks: + - id: end-of-file-fixer + - id: trailing-whitespace