[StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <[email protected]>
microsoft · Nov 14, 2023 · 02a94ba · 02a94ba
1 parent a0f254c
commit 02a94ba
Show file tree

Hide file tree

Showing 5 changed files with 110 additions and 10 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -193,3 +193,103 @@ updates:
       update-types: ["version-update:semver-major"]
     - dependency-name: "@types/node"
       update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/Common/v3
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/Common/v4
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/ExtensionVersion/v3
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/ExtensionVersion/v4
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/InstallExtension/v3
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/InstallExtension/v4
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/IsValidExtensionAgent/v3
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/IsValidExtensionAgent/v4
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/PackageExtension/v3
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/PackageExtension/v4
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/PublishExtension/v3
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/PublishExtension/v4
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/PublishVSExtension/v3
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/PublishVSExtension/v4
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/ShareExtension/v3
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/ShareExtension/v4
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/TfxInstaller/v3
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/TfxInstaller/v4
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/UnpublishExtension/v3
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /BuildTasks/UnpublishExtension/v4
+    schedule:
+      interval: daily
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -33,11 +33,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@689fdc5193eeb735ecb2e52e819e3382876f93f4 # v2.22.6
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -48,7 +48,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@689fdc5193eeb735ecb2e52e819e3382876f93f4 # v2.22.6
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -62,4 +62,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@689fdc5193eeb735ecb2e52e819e3382876f93f4 # v2.22.6
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
+        uses: actions/dependency-review-action@7bbfa034e752445ea40215fff1c3bf9597993d3f # v3.1.3
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
@@ -37,7 +37,7 @@ jobs:
     steps:
 
     - name: Setup Node.js environment
-      uses: actions/[email protected]
+      uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
       with:
         node-version: "18.x"
 
@@ -52,12 +52,12 @@ jobs:
         "$weeknumber-$($date.Year)" >> renovate-cache-lock.txt
         npm show renovate version >> renovate-lock.txt
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
       with:
         path: ${{ steps.npm-cache-dir.outputs.dir }}
         key: npm-cache-${{ hashFiles('renovate-lock.txt') }}
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
       with:
         path: "./.renovateCache"
         key: renovate-cache-${{ hashFiles('renovate-cache-lock.txt') }}

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v4 # v3.6.0
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           persist-credentials: false