Skip to content

Commit 2b24bfd

Browse files
stepsecurity-app[bot]stepsecurity-app[bot]
authored
[StepSecurity] Apply security best practices
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
1 parent f5221f4 commit 2b24bfd

6 files changed

Lines changed: 143 additions & 51 deletions

File tree

‎.github/workflows/close-stale.yml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,22 @@ on:
33
schedule:
44
- cron: '30 1 * * *'
55

6+
permissions:
7+
contents: read
8+
69
jobs:
710
stale:
11+
permissions:
12+
issues: write # for actions/stale to close stale issues
13+
pull-requests: write # for actions/stale to close stale PRs
814
runs-on: ubuntu-latest
915
steps:
10-
- uses: actions/stale@v9
16+
- name: Harden the runner (Audit all outbound calls)
17+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
18+
with:
19+
egress-policy: audit
20+
21+
- uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
1122
with:
1223
stale-pr-message: 'This PR is stale because it has been open 14 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
1324
stale-issue-label: 'S-stale'

‎.github/workflows/release-docker-canary.yml‎

Lines changed: 54 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ on:
99
required: false
1010
default: '0.0.0-rc-0'
1111

12+
permissions:
13+
contents: read
14+
1215
jobs:
1316
canary-publish:
1417
name: Publish Packages (canary)
@@ -23,8 +26,13 @@ jobs:
2326
canary-docker-tag: ${{ steps.docker-image-name.outputs.canary-docker-tag }}
2427

2528
steps:
29+
- name: Harden the runner (Audit all outbound calls)
30+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
31+
with:
32+
egress-policy: audit
33+
2634
- name: Check out source code
27-
uses: actions/checkout@v4
35+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
2836
with:
2937
# This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
3038
fetch-depth: 0
@@ -48,19 +56,24 @@ jobs:
4856
runs-on: ubuntu-latest
4957

5058
steps:
59+
- name: Harden the runner (Audit all outbound calls)
60+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
61+
with:
62+
egress-policy: audit
63+
5164
- name: Checkout
52-
uses: actions/checkout@v4
65+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
5366
- name: Set up Docker Buildx
54-
uses: docker/setup-buildx-action@v3
67+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
5568

5669
- name: Login to Docker Hub
57-
uses: docker/login-action@v3
70+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
5871
with:
5972
username: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_USERNAME }}
6073
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_SECRET }}
6174

6275
- name: Build and push
63-
uses: docker/build-push-action@v6
76+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
6477
with:
6578
context: .
6679
file: ./ops/docker/Dockerfile.packages
@@ -75,19 +88,24 @@ jobs:
7588
runs-on: ubuntu-latest
7689

7790
steps:
91+
- name: Harden the runner (Audit all outbound calls)
92+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
93+
with:
94+
egress-policy: audit
95+
7896
- name: Checkout
79-
uses: actions/checkout@v4
97+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
8098
- name: Set up Docker Buildx
81-
uses: docker/setup-buildx-action@v3
99+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
82100

83101
- name: Login to Docker Hub
84-
uses: docker/login-action@v3
102+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
85103
with:
86104
username: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_USERNAME }}
87105
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_SECRET }}
88106

89107
- name: Build and push
90-
uses: docker/build-push-action@v6
108+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
91109
with:
92110
context: .
93111
file: ./ops/docker/Dockerfile.packages
@@ -102,19 +120,24 @@ jobs:
102120
runs-on: ubuntu-latest
103121

104122
steps:
123+
- name: Harden the runner (Audit all outbound calls)
124+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
125+
with:
126+
egress-policy: audit
127+
105128
- name: Checkout
106-
uses: actions/checkout@v4
129+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
107130
- name: Set up Docker Buildx
108-
uses: docker/setup-buildx-action@v3
131+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
109132

110133
- name: Login to Docker Hub
111-
uses: docker/login-action@v3
134+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
112135
with:
113136
username: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_USERNAME }}
114137
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_SECRET }}
115138

116139
- name: Build and push
117-
uses: docker/build-push-action@v6
140+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
118141
with:
119142
context: .
120143
file: ./ops/docker/Dockerfile.packages
@@ -129,19 +152,24 @@ jobs:
129152
runs-on: ubuntu-latest
130153

131154
steps:
155+
- name: Harden the runner (Audit all outbound calls)
156+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
157+
with:
158+
egress-policy: audit
159+
132160
- name: Checkout
133-
uses: actions/checkout@v4
161+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
134162
- name: Set up Docker Buildx
135-
uses: docker/setup-buildx-action@v3
163+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
136164

137165
- name: Login to Docker Hub
138-
uses: docker/login-action@v3
166+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
139167
with:
140168
username: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_USERNAME }}
141169
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_SECRET }}
142170

143171
- name: Build and push
144-
uses: docker/build-push-action@v6
172+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
145173
with:
146174
context: .
147175
file: ./ops/docker/Dockerfile.packages
@@ -156,19 +184,24 @@ jobs:
156184
runs-on: ubuntu-latest
157185

158186
steps:
187+
- name: Harden the runner (Audit all outbound calls)
188+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
189+
with:
190+
egress-policy: audit
191+
159192
- name: Checkout
160-
uses: actions/checkout@v4
193+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
161194
- name: Set up Docker Buildx
162-
uses: docker/setup-buildx-action@v3
195+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
163196

164197
- name: Login to Docker Hub
165-
uses: docker/login-action@v3
198+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
166199
with:
167200
username: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_USERNAME }}
168201
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_SECRET }}
169202

170203
- name: Build and push
171-
uses: docker/build-push-action@v6
204+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
172205
with:
173206
context: .
174207
file: ./ops/docker/Dockerfile.packages

‎.github/workflows/release-snapshot.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,13 @@ jobs:
1515
if: github.repository == 'ethereum-optimism/optimism'
1616
runs-on: ubuntu-latest
1717
steps:
18+
- name: Harden the runner (Audit all outbound calls)
19+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
20+
with:
21+
egress-policy: audit
22+
1823
- name: Checkout
19-
uses: actions/checkout@v4
24+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
2025
with:
2126
submodules: recursive
2227
fetch-depth: 0
@@ -35,7 +40,7 @@ jobs:
3540
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
3641

3742
- name: Publish snapshots
38-
uses: seek-oss/changesets-snapshot@v0
43+
uses: seek-oss/changesets-snapshot@8e728b976e50f2586f1006f4014fb97147888515 # v0.1.1
3944
with:
4045
pre-publish: pnpm nx run-many --target=build --skip-nx-cache
4146
env:

‎.github/workflows/release.yml‎

Lines changed: 55 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ on:
99
# Always wait for previous release to finish before releasing again
1010
concurrency: ${{ github.workflow }}-${{ github.ref }}
1111

12+
permissions:
13+
contents: read
14+
1215
jobs:
1316
release:
1417
name: Release
@@ -29,8 +32,13 @@ jobs:
2932
pull-requests: write
3033
id-token: write
3134
steps:
35+
- name: Harden the runner (Audit all outbound calls)
36+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
37+
with:
38+
egress-policy: audit
39+
3240
- name: Checkout Repo
33-
uses: actions/checkout@v4
41+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
3442
with:
3543
# This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
3644
fetch-depth: 0
@@ -60,7 +68,7 @@ jobs:
6068
# merged will publish to npm
6169
# see https://github.com/changesets/action
6270
- name: Publish To NPM or Create Release Pull Request
63-
uses: changesets/action@v1
71+
uses: changesets/action@e0145edc7d9d8679003495b11f87bd8ef63c0cba # v1.5.3
6472
id: changesets
6573
with:
6674
createGithubReleases: false
@@ -85,19 +93,24 @@ jobs:
8593
runs-on: ubuntu-latest
8694

8795
steps:
96+
- name: Harden the runner (Audit all outbound calls)
97+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
98+
with:
99+
egress-policy: audit
100+
88101
- name: Checkout
89-
uses: actions/checkout@v4
102+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
90103
- name: Set up Docker Buildx
91-
uses: docker/setup-buildx-action@v3
104+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
92105

93106
- name: Login to Docker Hub
94-
uses: docker/login-action@v3
107+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
95108
with:
96109
username: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_USERNAME }}
97110
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_SECRET }}
98111

99112
- name: Build and push
100-
uses: docker/build-push-action@v6
113+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
101114
with:
102115
context: .
103116
file: ./ops/docker/Dockerfile.packages
@@ -112,19 +125,24 @@ jobs:
112125
runs-on: ubuntu-latest
113126

114127
steps:
128+
- name: Harden the runner (Audit all outbound calls)
129+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
130+
with:
131+
egress-policy: audit
132+
115133
- name: Checkout
116-
uses: actions/checkout@v4
134+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
117135
- name: Set up Docker Buildx
118-
uses: docker/setup-buildx-action@v3
136+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
119137

120138
- name: Login to Docker Hub
121-
uses: docker/login-action@v3
139+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
122140
with:
123141
username: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_USERNAME }}
124142
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_SECRET }}
125143

126144
- name: Build and push
127-
uses: docker/build-push-action@v6
145+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
128146
with:
129147
context: .
130148
file: ./ops/docker/Dockerfile.packages
@@ -139,19 +157,24 @@ jobs:
139157
runs-on: ubuntu-latest
140158

141159
steps:
160+
- name: Harden the runner (Audit all outbound calls)
161+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
162+
with:
163+
egress-policy: audit
164+
142165
- name: Checkout
143-
uses: actions/checkout@v4
166+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
144167
- name: Set up Docker Buildx
145-
uses: docker/setup-buildx-action@v3
168+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
146169

147170
- name: Login to Docker Hub
148-
uses: docker/login-action@v3
171+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
149172
with:
150173
username: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_USERNAME }}
151174
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_SECRET }}
152175

153176
- name: Build and push
154-
uses: docker/build-push-action@v6
177+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
155178
with:
156179
context: .
157180
file: ./ops/docker/Dockerfile.packages
@@ -166,19 +189,24 @@ jobs:
166189
runs-on: ubuntu-latest
167190

168191
steps:
192+
- name: Harden the runner (Audit all outbound calls)
193+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
194+
with:
195+
egress-policy: audit
196+
169197
- name: Checkout
170-
uses: actions/checkout@v4
198+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
171199
- name: Set up Docker Buildx
172-
uses: docker/setup-buildx-action@v3
200+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
173201

174202
- name: Login to Docker Hub
175-
uses: docker/login-action@v3
203+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
176204
with:
177205
username: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_USERNAME }}
178206
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_SECRET }}
179207

180208
- name: Build and push
181-
uses: docker/build-push-action@v6
209+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
182210
with:
183211
context: .
184212
file: ./ops/docker/Dockerfile.packages
@@ -193,19 +221,24 @@ jobs:
193221
runs-on: ubuntu-latest
194222

195223
steps:
224+
- name: Harden the runner (Audit all outbound calls)
225+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
226+
with:
227+
egress-policy: audit
228+
196229
- name: Checkout
197-
uses: actions/checkout@v4
230+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
198231
- name: Set up Docker Buildx
199-
uses: docker/setup-buildx-action@v3
232+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
200233

201234
- name: Login to Docker Hub
202-
uses: docker/login-action@v3
235+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
203236
with:
204237
username: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_USERNAME }}
205238
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_SECRET }}
206239

207240
- name: Build and push
208-
uses: docker/build-push-action@v6
241+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
209242
with:
210243
context: .
211244
file: ./ops/docker/Dockerfile.packages

0 commit comments

Comments
 (0)