From 7d04bc2620477ebf7b4de0b3ab18967aea76903a Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Wed, 15 Jul 2026 18:02:21 +0000 Subject: [PATCH] Apply GitHub Actions security best practices Signed-off-by: StepSecurity Bot --- .github/dependabot.yml | 30 +++++++++++++++++++ .github/workflows/build.yml | 12 ++++++-- .github/workflows/e2e-tests.yml | 13 +++++--- .github/workflows/lint.yml | 17 +++++++++-- .github/workflows/ok-to-test.yml | 10 ++++++- .github/workflows/pr-check-signed-commits.yml | 8 +++++ .github/workflows/release.yml | 20 +++++++++---- .github/workflows/test-e2e.yml | 12 +++++++- .github/workflows/test.yml | 12 ++++++-- Dockerfile | 4 +-- 10 files changed, 117 insertions(+), 21 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..9ec691f8 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,30 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + cooldown: + default-days: 7 + + - package-ecosystem: gomod + directory: / + schedule: + interval: weekly + day: monday + cooldown: + default-days: 7 + semver-major-days: 30 + semver-minor-days: 14 + semver-patch-days: 5 + + - package-ecosystem: gomod + directory: /pkg/testhelper + schedule: + interval: weekly + day: monday + cooldown: + default-days: 7 + semver-major-days: 30 + semver-minor-days: 14 + semver-patch-days: 5 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index dd75e54e..81dfc0dd 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -5,16 +5,24 @@ on: branches: [main] pull_request: +permissions: + contents: read + jobs: build: name: Run on Ubuntu runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Clone the code - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Setup Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: go.mod diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml index 3bd408ca..a991df30 100644 --- a/.github/workflows/e2e-tests.yml +++ b/.github/workflows/e2e-tests.yml @@ -22,13 +22,18 @@ jobs: run: runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: ref: ${{ inputs.ref }} - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: go.mod @@ -36,13 +41,13 @@ jobs: run: go mod tidy - name: Create kind cluster - uses: helm/kind-action@v1 + uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0 with: cluster_name: onepassword-operator-test-e2e # install cli to interact with item in 1Password to update/read using `testhelper/op` package - name: Install 1Password CLI - uses: 1password/install-cli-action@v3 + uses: 1password/install-cli-action@8d006a0d0a4fd505af7f7ce589e7f768385ff5e4 # v3.0.0 with: version: 2.32.0 diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 14095e23..3fd899fc 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -5,20 +5,31 @@ on: branches: [main] pull_request: +permissions: + contents: read + jobs: lint: + permissions: + contents: read # for actions/checkout to fetch code + pull-requests: read # for golangci/golangci-lint-action to fetch pull requests name: Run on Ubuntu runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Clone the code - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Setup Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: go.mod - name: Run linter - uses: golangci/golangci-lint-action@v9 + uses: step-security/golangci-lint-action@ce3368d2f0a15c79206a120861e3f847c8beb466 # v9.2.1 with: version: v2.2 diff --git a/.github/workflows/ok-to-test.yml b/.github/workflows/ok-to-test.yml index cb1c5477..18f05ae6 100644 --- a/.github/workflows/ok-to-test.yml +++ b/.github/workflows/ok-to-test.yml @@ -5,6 +5,9 @@ on: issue_comment: types: [created] +permissions: + contents: read + jobs: ok-to-test: runs-on: ubuntu-latest @@ -14,8 +17,13 @@ jobs: # Only run for PRs, not issue comments if: ${{ github.event.issue.pull_request }} steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Slash Command Dispatch - uses: peter-evans/slash-command-dispatch@v5 + uses: step-security/slash-command-dispatch@d0336ef847d610a252f1f6a77630c3bb5712d0bf # v5.0.2 with: token: ${{ secrets.GITHUB_TOKEN }} reaction-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/pr-check-signed-commits.yml b/.github/workflows/pr-check-signed-commits.yml index 77a8b8ad..f25cca5e 100644 --- a/.github/workflows/pr-check-signed-commits.yml +++ b/.github/workflows/pr-check-signed-commits.yml @@ -1,6 +1,9 @@ name: Check signed commits in PR on: pull_request_target +permissions: + contents: read + jobs: build: name: Check signed commits in PR @@ -9,5 +12,10 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Check signed commits in PR uses: 1Password/check-signed-commits-action@v1 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index be0c71e1..8030ae44 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,20 +5,28 @@ on: tags: - 'v*' +permissions: + contents: read + jobs: release-docker: runs-on: ubuntu-latest env: DOCKER_CLI_EXPERIMENTAL: "enabled" steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: fetch-depth: 0 - name: Docker meta id: meta - uses: docker/metadata-action@v6 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: | 1password/onepassword-operator @@ -33,19 +41,19 @@ jobs: run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT" - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Docker Login - uses: docker/login-action@v4 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Build and push - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . file: Dockerfile diff --git a/.github/workflows/test-e2e.yml b/.github/workflows/test-e2e.yml index 04810361..cc49747c 100644 --- a/.github/workflows/test-e2e.yml +++ b/.github/workflows/test-e2e.yml @@ -35,6 +35,11 @@ jobs: condition: ${{ steps.check.outputs.condition }} ref: ${{ steps.check.outputs.ref }} steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Check if PR is from external contributor id: check run: | @@ -108,12 +113,17 @@ jobs: permissions: pull-requests: write steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Create URL to the run output id: vars run: echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> $GITHUB_OUTPUT - name: Create comment on PR - uses: peter-evans/create-or-update-comment@v5 + uses: step-security/create-or-update-comment@5497a4d6a6aece527d2f86e14b7a18e01fbd5d48 # v5.0.1 with: issue-number: ${{ github.event.client_payload.pull_request.number }} body: | diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e784e859..6c37b3cf 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -5,16 +5,24 @@ on: branches: [main] pull_request: +permissions: + contents: read + jobs: test: name: Run on Ubuntu runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Clone the code - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Setup Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: go.mod diff --git a/Dockerfile b/Dockerfile index 14d6fb75..5c55a593 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Build the manager binary -FROM golang:1.24 AS builder +FROM golang:1.24@sha256:d2d2bc1c84f7e60d7d2438a3836ae7d0c847f4888464e7ec9ba3a1339a1ee804 AS builder ARG TARGETOS ARG TARGETARCH @@ -36,7 +36,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \ # Use distroless as minimal base image to package the manager binary # Refer to https://github.com/GoogleContainerTools/distroless for more details -FROM gcr.io/distroless/static:nonroot +FROM gcr.io/distroless/static:nonroot@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6 WORKDIR / COPY --from=builder /workspace/manager . USER 65532:65532