Skip to content

Commit a6b962e

Browse files
step-security-botsozercan
step-security-bot
and
sozercan
authored
ci: [StepSecurity] Apply security best practices (#222)
* [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> * Update dependabot.yml Signed-off-by: Sertaç Özercan <852750+sozercan@users.noreply.github.com> --------- Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Signed-off-by: Sertaç Özercan <852750+sozercan@users.noreply.github.com> Co-authored-by: Sertaç Özercan <852750+sozercan@users.noreply.github.com>
1 parent b1994cb commit a6b962e

File tree

6 files changed

+136
-2
lines changed

6 files changed

+136
-2
lines changed

‎.github/dependabot.yml

+21
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,24 @@ updates:
1111
update-types:
1212
- "version-update:semver-major"
1313
- "version-update:semver-minor"
14+
15+
- package-ecosystem: github-actions
16+
directory: /
17+
schedule:
18+
interval: daily
19+
commit-message:
20+
prefix: "chore"
21+
22+
- package-ecosystem: docker
23+
directory: /
24+
schedule:
25+
interval: daily
26+
commit-message:
27+
prefix: "chore"
28+
29+
- package-ecosystem: gomod
30+
directory: /tools
31+
schedule:
32+
interval: daily
33+
commit-message:
34+
prefix: "chore"

‎.github/workflows/codeql.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,11 @@ jobs:
2020
security-events: write
2121

2222
steps:
23+
- name: Harden Runner
24+
uses: step-security/harden-runner@6b3083af2869dc3314a0257a42f4af696cc79ba3 # v2.3.1
25+
with:
26+
egress-policy: audit
27+
2328
- name: Checkout repository
2429
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
2530

‎.github/workflows/create-release.yml

+5
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,11 @@ jobs:
1111
create-release:
1212
runs-on: ubuntu-20.04
1313
steps:
14+
- name: Harden Runner
15+
uses: step-security/harden-runner@6b3083af2869dc3314a0257a42f4af696cc79ba3 # v2.3.1
16+
with:
17+
egress-policy: audit
18+
1419
- name: Checkout
1520
# pinning to the sha ec3a7ce113134d7a93b817d10a8272cb61118579 from https://github.com/actions/checkout/releases/tag/v2.4.0
1621
uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579

‎.github/workflows/dependency-review.yml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Harden Runner
20+
uses: step-security/harden-runner@6b3083af2869dc3314a0257a42f4af696cc79ba3 # v2.3.1
21+
with:
22+
egress-policy: audit
23+
24+
- name: 'Checkout Repository'
25+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
26+
- name: 'Dependency Review'
27+
uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1

‎.github/workflows/scorecards.yml

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# This workflow uses actions that are not certified by GitHub. They are provided
2+
# by a third-party and are governed by separate terms of service, privacy
3+
# policy, and support documentation.
4+
5+
name: Scorecard supply-chain security
6+
on:
7+
# For Branch-Protection check. Only the default branch is supported. See
8+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
9+
branch_protection_rule:
10+
# To guarantee Maintained check is occasionally updated. See
11+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
12+
schedule:
13+
- cron: '20 7 * * 2'
14+
push:
15+
branches: ["master"]
16+
17+
# Declare default permissions as read only.
18+
permissions: read-all
19+
20+
jobs:
21+
analysis:
22+
name: Scorecard analysis
23+
runs-on: ubuntu-latest
24+
permissions:
25+
# Needed to upload the results to code-scanning dashboard.
26+
security-events: write
27+
# Needed to publish results and get a badge (see publish_results below).
28+
id-token: write
29+
contents: read
30+
actions: read
31+
32+
steps:
33+
- name: Harden Runner
34+
uses: step-security/harden-runner@6b3083af2869dc3314a0257a42f4af696cc79ba3 # v2.3.1
35+
with:
36+
egress-policy: audit
37+
38+
- name: "Checkout code"
39+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
40+
with:
41+
persist-credentials: false
42+
43+
- name: "Run analysis"
44+
uses: ossf/scorecard-action@99c53751e09b9529366343771cc321ec74e9bd3d # v2.0.6
45+
with:
46+
results_file: results.sarif
47+
results_format: sarif
48+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
49+
# - you want to enable the Branch-Protection check on a *public* repository, or
50+
# - you are installing Scorecards on a *private* repository
51+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
52+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
53+
54+
# Public repositories:
55+
# - Publish results to OpenSSF REST API for easy access by consumers
56+
# - Allows the repository to include the Scorecard badge.
57+
# - See https://github.com/ossf/scorecard-action#publishing-results.
58+
# For private repositories:
59+
# - `publish_results` will always be set to `false`, regardless
60+
# of the value entered here.
61+
publish_results: true
62+
63+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
64+
# format to the repository Actions tab.
65+
- name: "Upload artifact"
66+
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
67+
with:
68+
name: SARIF file
69+
path: results.sarif
70+
retention-days: 5
71+
72+
# Upload the results to GitHub's code scanning dashboard.
73+
- name: "Upload to code-scanning"
74+
uses: github/codeql-action/upload-sarif@8662eabe0e9f338a07350b7fd050732745f93848 # v2.3.1
75+
with:
76+
sarif_file: results.sarif

‎Dockerfile

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.19-bullseye as builder
1+
FROM golang:1.19-bullseye@sha256:1370f30629243bb65e3e0f780ae08a54e50fc5b7e96f0b79e62ee846788d1178 as builder
22

33
WORKDIR /workspace
44
# Copy the Go Modules manifests
@@ -19,7 +19,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -a -ld
1919

2020
# Use distroless as minimal base image to package the manager binary
2121
# Refer to https://github.com/GoogleContainerTools/distroless for more details
22-
FROM --platform=${TARGETPLATFORM:-linux/amd64} gcr.io/distroless/static:nonroot
22+
FROM --platform=${TARGETPLATFORM:-linux/amd64} gcr.io/distroless/static:nonroot@sha256:149531e38c7e4554d4a6725d7d70593ef9f9881358809463800669ac89f3b0ec
2323
WORKDIR /
2424
COPY --from=builder /workspace/_output/kubernetes-kms .
2525

0 commit comments

Comments
 (0)