[StepSecurity] ci: Harden GitHub Actions #1735
Conversation
Signed-off-by: StepSecurity Bot <[email protected]>
|
| Name | Link |
|---|---|
| 🔨 Latest commit | 6e754ab |
|
| Name | Link |
|---|---|
| 🔨 Latest commit | 6e754ab |
|
| Name | Link |
|---|---|
| 🔨 Latest commit | 6e754ab |
👷 Deploy request for kleros-v2-neo accepted.
|
WalkthroughThe pull request introduces modifications to two GitHub Actions workflow files: Changes
Sequence Diagram(s)sequenceDiagram
participant D as Dependabot
participant W as Workflow
participant A as GitHub API
D->>W: Trigger PR
W->>A: Check permissions
A-->>W: Permissions granted
W->>A: Execute actions
A-->>W: Actions completed
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
Code Climate has analyzed commit 6e754ab and detected 0 issues on this pull request. View more on Code Climate. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (2)
.github/workflows/sonarcloud.yml (2)
21-24: Consider strengthening the egress policy.While the Harden Runner implementation is good, the
auditegress-policy only monitors network calls without blocking any suspicious activity. Consider switching toblockmode after reviewing the audit logs to actively prevent potential security threats.with: - egress-policy: audit + egress-policy: block
26-26: Fix misleading comment in SonarCloud action version.The version pinning to specific commits is excellent for security. However, the comment
# masteris misleading since we're using a specific commit hash.- uses: SonarSource/sonarcloud-github-action@9f9bba2c7aaf7a55eac26abbac906c3021d211b2 # master + uses: SonarSource/sonarcloud-github-action@9f9bba2c7aaf7a55eac26abbac906c3021d211b2 # v2.0.2Also applies to: 31-31
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (2)
.github/workflows/dependabot-automerge.yml(1 hunks).github/workflows/sonarcloud.yml(1 hunks)
🔇 Additional comments (6)
.github/workflows/sonarcloud.yml (3)
10-12: LGTM! Good security practice with least privilege permissions.
Setting explicit read-only permissions at the workflow level follows the principle of least privilege, which is a security best practice.
15-17: LGTM! Well-documented permissions with clear purpose.
Excellent job documenting the reason for each permission. The read-only access for both contents and pull-requests is appropriate for SonarCloud's scanning purposes.
31-34: Verify secure handling of tokens.
The workflow appropriately uses GitHub secrets for sensitive tokens. Let's verify there are no token exposures in the repository.
✅ Verification successful
Secure token handling confirmed with additional security measures in place
The workflow demonstrates secure practices for handling sensitive data:
- All sensitive tokens (GITHUB_TOKEN and SONAR_TOKEN) are properly stored as GitHub secrets
- Appropriate permission scoping is implemented with
permissionsblock - Security hardening is applied via
step-security/harden-runner - No hardcoded credentials or tokens found in the workflow files
- Uses pinned action versions for security
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Check for potential token exposures in workflow files
rg -g '*.yml' -g '*.yaml' -i '(token|secret|key|password).*[A-Za-z0-9/+]{40,}' .github/workflows/
Length of output: 99
Script:
#!/bin/bash
# Check for proper secret usage in workflow files
rg -g '*.yml' -g '*.yaml' '\${{.*secrets.*}}' .github/workflows/
# Check for any hardcoded tokens or credentials
rg -g '*.yml' -g '*.yaml' -i '(token|api[_-]?key|secret|password|credential)' .github/workflows/
# Examine the overall workflow configuration
cat .github/workflows/sonarcloud.yml
Length of output: 3688
.github/workflows/dependabot-automerge.yml (3)
Line range hint 12-14: LGTM! Job permissions are properly scoped.
The elevated write permissions are:
- Well-documented with a reference link
- Necessary for the auto-merge functionality
- Properly restricted to Dependabot-only execution
Line range hint 17-23: LGTM! Harden Runner is well configured with strict security controls.
The configuration follows security best practices:
- Action is pinned to a specific commit hash
- Sudo access is disabled
- Network egress is blocked by default
- Only essential GitHub API endpoint is allowed
Let's verify if we're using the latest stable version of harden-runner:
#!/bin/bash
# Description: Check if the harden-runner version is up to date
# Expected: Version 2.5.0 should be the latest stable release
# Get the latest release version from GitHub API
gh api repos/step-security/harden-runner/releases/latest --jq .tag_name6-8: LGTM! Default permissions properly restricted.
The addition of explicit top-level permissions following the principle of least privilege is a good security practice.
Let's verify that read-only access is sufficient for the workflow triggers:
✅ Verification successful
Top-level read permission is appropriate and secure
The workflow correctly implements a layered permissions approach:
- Top-level
contents: readsets a secure default - Job-level permissions are explicitly elevated only for the dependabot job where needed
- The workflow only performs write operations in the dependabot job (auto-merge) which has its own elevated permissions
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Verify if the workflow requires additional permissions for its triggers
# Expected: No direct API calls or write operations in the workflow steps outside the dependabot job
# Search for any potential GitHub API calls or write operations in the workflow
rg -l 'github|gh' .github/workflows/dependabot-automerge.yml
Length of output: 282
Script:
#!/bin/bash
# Let's examine the full content of the workflow file to understand all operations
cat .github/workflows/dependabot-automerge.yml
Length of output: 1291
Summary
This pull request is created by StepSecurity at the request of @jaybuidl. Please merge the Pull Request to incorporate the requested changes. Please tag @jaybuidl on your message if you have any questions related to the PR.
Security Fixes
Least Privileged GitHub Actions Token Permissions
The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API. GitHub recommends setting minimum token permissions for the GITHUB_TOKEN.
Pinned Dependencies
GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.
Harden Runner
Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without
sudoaccess.Harden runner usage
You can find link to view insights and policy recommendation in the build log
Please refer to documentation to find more details.
Feedback
For bug reports, feature requests, and general feedback; please email [email protected]. To create such PRs, please visit https://app.stepsecurity.io/securerepo.
Signed-off-by: StepSecurity Bot [email protected]
PR-Codex overview
This PR focuses on enhancing the GitHub Actions workflows for Dependabot and SonarCloud by adding permission settings and updating the action versions.
Detailed summary
permissionssection withcontents: readfor both.github/workflows/dependabot-automerge.ymland.github/workflows/sonarcloud.yml.usesforstep-security/harden-runnerto version91182cccc01eb5e619899d80e4e971d6181294a7.usesforSonarSource/sonarcloud-github-actionto version9f9bba2c7aaf7a55eac26abbac906c3021d211b2.egress-policy: auditin theHarden Runnerstep.Summary by CodeRabbit