Skip to content

[StepSecurity] ci: Harden GitHub Actions #3134

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 11, 2022
Merged

[StepSecurity] ci: Harden GitHub Actions #3134

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
[StepSecurity] ci: Harden GitHub Actions 
Signed-off-by: StepSecurity Bot <[email protected]>
  • Loading branch information
@step-security-bot
step-security-bot committed Oct 7, 2022
commit 6b2b12afa6e1b68e660f376685fd39bbce9b9b4a
7 changes: 7 additions & 0 deletions .github/workflows/codeql-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,15 @@ concurrency:
group: ${{ github.ref_name }}-codeql
cancel-in-progress: true

permissions: # added using https://github.com/step-security/secure-workflows
contents: read

jobs:
analyze:
permissions:
actions: read # for github/codeql-action/init to get workflow details
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/autobuild to send a status report
name: Analyze
runs-on: ubuntu-latest

Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/fossa.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,9 @@ concurrency:
group: ${{ github.ref_name }}-fossa
cancel-in-progress: true

permissions: # added using https://github.com/step-security/secure-workflows
contents: read

jobs:

scan:
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/labeler.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@ name: "Pull Request Labeler"
on:
- pull_request_target

permissions: # added using https://github.com/step-security/secure-workflows
contents: read

jobs:
triage:
permissions:
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/stale.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,14 @@ on:
schedule:
- cron: '30 1 * * *'

permissions: # added using https://github.com/step-security/secure-workflows
contents: read

jobs:
stale:
permissions:
issues: write # for actions/stale to close stale issues
pull-requests: write # for actions/stale to close stale PRs
runs-on: ubuntu-20.04
steps:
- uses: actions/stale@v6
Expand Down