From 1167d8397541de67b0149056c18f44e064d3b901 Mon Sep 17 00:00:00 2001 From: StepSecurity Bot Date: Tue, 30 Jul 2024 11:41:16 -0700 Subject: [PATCH] [StepSecurity] ci: Harden GitHub Actions (#390) Signed-off-by: StepSecurity Bot --- .github/workflows/go-tests.yaml | 5 ++++- .github/workflows/style.yaml | 24 ++++++++++++++++++++++-- 2 files changed, 26 insertions(+), 3 deletions(-) diff --git a/.github/workflows/go-tests.yaml b/.github/workflows/go-tests.yaml index b4261a06d..dc373f10c 100644 --- a/.github/workflows/go-tests.yaml +++ b/.github/workflows/go-tests.yaml @@ -11,6 +11,9 @@ on: branches: - "main" +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest @@ -31,7 +34,7 @@ jobs: go-version-file: go.mod check-latest: true - - uses: chainguard-dev/actions/goimports@main + - uses: chainguard-dev/actions/goimports@9d943fc9889a0c0795e3c2bd4b949a9b610ac02e # main - name: install libyara-dev run: | diff --git a/.github/workflows/style.yaml b/.github/workflows/style.yaml index ed7edf0bb..c7867464a 100644 --- a/.github/workflows/style.yaml +++ b/.github/workflows/style.yaml @@ -17,6 +17,11 @@ jobs: name: check gofmt runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0 + with: + egress-policy: audit + - name: Check out code uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 @@ -26,7 +31,7 @@ jobs: go-version-file: go.mod check-latest: true - - uses: chainguard-dev/actions/gofmt@main + - uses: chainguard-dev/actions/gofmt@9d943fc9889a0c0795e3c2bd4b949a9b610ac02e # main with: args: -s @@ -34,6 +39,11 @@ jobs: name: check goimports runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0 + with: + egress-policy: audit + - name: Check out code uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 @@ -43,13 +53,18 @@ jobs: go-version-file: go.mod check-latest: true - - uses: chainguard-dev/actions/goimports@main + - uses: chainguard-dev/actions/goimports@9d943fc9889a0c0795e3c2bd4b949a9b610ac02e # main golangci-lint: name: golangci-lint runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0 + with: + egress-policy: audit + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 - name: Set up Go @@ -78,6 +93,11 @@ jobs: runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0 + with: + egress-policy: audit + - name: Check out code uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7