From 1dc1ad3c8a981586893de64af13ddf4dcd1ca5de Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Wed, 11 Jun 2025 23:50:02 +0000 Subject: [PATCH] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/workflows/codeql-analysis.yml | 16 ++++++++++++---- .github/workflows/main.yml | 27 +++++++++++++++++++++------ .github/workflows/notification.yml | 15 ++++++++++++++- .github/workflows/playground.yml | 20 +++++++++++++++----- .github/workflows/release-canary.yml | 10 +++++++++- .github/workflows/release.yml | 10 +++++++++- 6 files changed, 80 insertions(+), 18 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index a9b7386ab2..7cb4ec5748 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -23,6 +23,9 @@ on: # paths-ignore: # - packages/wallet-native-sdk +permissions: + contents: read + jobs: analyze: name: Analyze @@ -40,12 +43,17 @@ jobs: # Learn more about CodeQL language support at https://git.io/codeql-language-support steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 + with: + egress-policy: audit + - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -56,7 +64,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -70,4 +78,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index fe730e629c..bff8e99f1a 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -14,11 +14,16 @@ jobs: working-directory: ./ steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Checkout node action - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version-file: '.nvmrc' cache-dependency-path: 'yarn.lock' @@ -37,11 +42,16 @@ jobs: working-directory: ./ steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Checkout node action - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version-file: '.nvmrc' cache-dependency-path: '**/yarn.lock' @@ -67,11 +77,16 @@ jobs: node-version: [20.x, 22.x] steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node-version }} cache-dependency-path: '**/yarn.lock' diff --git a/.github/workflows/notification.yml b/.github/workflows/notification.yml index 1326f0f265..23e4384ea4 100644 --- a/.github/workflows/notification.yml +++ b/.github/workflows/notification.yml @@ -10,12 +10,20 @@ env: ON_CALL_WALLET: ${{ vars.ON_CALL_WALLET }} ON_CALL_BUILD_SQUAD: ${{ vars.ON_CALL_BUILD_SQUAD }} +permissions: + contents: read + jobs: checks: runs-on: ubuntu-latest outputs: skip: ${{ env.skip }} steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 + with: + egress-policy: audit + - name: Check spam labels if: ${{ contains(github.event.*.labels.*.name, 'spam') }} run: | @@ -27,6 +35,11 @@ jobs: needs: checks if: ${{ vars.SLACK_ENABLED == 'true' && needs.checks.outputs.skip != 'true' }} steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 + with: + egress-policy: audit + - name: Set channel and mention run: | if ${{ contains(join(github.event.issue.labels.*.name), 'type:') }}; then @@ -54,7 +67,7 @@ jobs: url: ${{ github.event.issue.html_url }} - name: Notify Slack - uses: slackapi/slack-github-action@v1.23.0 + uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844 # v1.23.0 with: payload: | { diff --git a/.github/workflows/playground.yml b/.github/workflows/playground.yml index 7f6949ee89..ee200c07e9 100644 --- a/.github/workflows/playground.yml +++ b/.github/workflows/playground.yml @@ -18,15 +18,20 @@ jobs: build: runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: "20" cache: yarn - name: Setup Pages - uses: actions/configure-pages@v4 + uses: actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d # v4.0.0 with: static_site_generator: next - name: Install dependencies @@ -34,7 +39,7 @@ jobs: - name: Build and export with Next.js run: yarn deploy - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: ./examples/testapp/out @@ -45,6 +50,11 @@ jobs: runs-on: ubuntu-latest needs: build steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 + with: + egress-policy: audit + - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/release-canary.yml b/.github/workflows/release-canary.yml index e596721cde..e7a54eb533 100644 --- a/.github/workflows/release-canary.yml +++ b/.github/workflows/release-canary.yml @@ -7,6 +7,9 @@ on: required: true default: "" +permissions: + contents: read + jobs: canary: name: Release canary @@ -20,8 +23,13 @@ jobs: env: PACKAGE_VERSION: ${{ github.event.inputs.packageVersion }} steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: recursive diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d9298b0aa8..f5627158f9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -8,6 +8,9 @@ on: required: true default: "" +permissions: + contents: read + jobs: release: env: @@ -20,8 +23,13 @@ jobs: pull-requests: write id-token: write steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: recursive