Skip to content

Commit 36928ec

Browse files
assignUserassignUser
authored
ARROW-17621: [CI] Audit workflows (#14155)
In this PR I: - reduced the scope of the automatically generated `GITHUB_TOKEN` as much as possible (technically `contents:none` would be the minimum but it is a bit unintuitive as it does not prevent checkout of public repos, I set `contents:read` in those cases) - update all actions used to the newest version (checking for breaking changes, only case is actions/github-script which remains on v3 for that reason -> follow up) - move the creation of envvars containing secrets as close to their usage as possible (-> the step they are used in), this duplicates them in workflows with multiple jobs but is safer. I have opted **NOT** to pin the different actions by SHA as recommended in some places as the con outweigh the possible protection in my opinion. The main danger with pinning tags or branches is that a malicious actor changes the commit the tag points to and exfiltrates secrets (either repository secrets or in case of private repos code/ip) or takes some other damaging action like deleting branches, rewriting history etc.. We only ever pass actions the `GITHUB_TOKEN` which is ephemeral (deleted after workflow is finished) and scope limited so exfiltration of that token would worst case allow an attacker to create/delete labels and pr comments as well as modify PR branches (if the submitter activated the checkbox for maintainer access). Actions can not access secrets without the workflow author explicitly passing them as input (envvars might reveal them though) The Apache Org limits the actions that can be used in repos, so we only use well known allow-listed actions, while this does of course not prevent malicious actions it reduces the risk substantially. Pinning SHAs would mitigate these risks (provided the action at that sha was audited...) but would also necessitate regularly checking + re-auditing the actions as to not miss security patches in these actions (e.g. [here](https://github.com/matlab-actions/setup-matlab/releases/tag/v1.1.1)). IMHO that would be a considerable effort (+ needing real expertise in typescript/node to spot any malicious additions outside of blatant secret exfiltration or nuking) resulting in a small gain. Lead-authored-by: Jacob Wujciak-Jens <[email protected]> Co-authored-by: assignUser <[email protected]> Signed-off-by: Sutou Kouhei <[email protected]>
1 parent 44ae852 commit 36928ec

19 files changed

Lines changed: 193 additions & 82 deletions

‎.github/workflows/archery.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@ concurrency:
3535
group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
3636
cancel-in-progress: true
3737

38+
permissions:
39+
contents: read
40+
3841
jobs:
3942

4043
test:

‎.github/workflows/comment_bot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ on:
2424
- created
2525
- edited
2626

27+
permissions:
28+
contents: read
29+
pull-requests: write
30+
2731
jobs:
2832
crossbow:
2933
name: Listen!

‎.github/workflows/cpp.yml‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,12 @@ concurrency:
4545
group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
4646
cancel-in-progress: true
4747

48+
permissions:
49+
contents: read
50+
4851
env:
4952
ARROW_ENABLE_TIMING_TESTS: OFF
5053
DOCKER_VOLUME_PREFIX: ".docker/"
51-
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
52-
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
5354

5455
jobs:
5556
docker:
@@ -75,7 +76,7 @@ jobs:
7576
fetch-depth: 0
7677
submodules: recursive
7778
- name: Cache Docker Volumes
78-
uses: actions/cache@v2
79+
uses: actions/cache@v3
7980
with:
8081
path: .docker
8182
key: ${{ matrix.image }}-${{ hashFiles('cpp/**') }}
@@ -87,12 +88,18 @@ jobs:
8788
- name: Setup Archery
8889
run: pip install -e dev/archery[docker]
8990
- name: Execute Docker Build
91+
env:
92+
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
93+
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
9094
run: |
9195
sudo sysctl -w kernel.core_pattern="core.%e.%p"
9296
ulimit -c unlimited
9397
archery docker run ${{ matrix.image }}
9498
- name: Docker Push
9599
if: success() && github.event_name == 'push' && github.repository == 'apache/arrow'
100+
env:
101+
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
102+
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
96103
continue-on-error: true
97104
run: archery docker push ${{ matrix.image }}
98105

@@ -101,8 +108,6 @@ jobs:
101108
runs-on: ubuntu-latest
102109
if: ${{ !contains(github.event.pull_request.title, 'WIP') }}
103110
timeout-minutes: 45
104-
strategy:
105-
fail-fast: false
106111
steps:
107112
- name: Checkout Arrow
108113
uses: actions/checkout@v3
@@ -123,8 +128,6 @@ jobs:
123128
runs-on: macos-latest
124129
if: ${{ !contains(github.event.pull_request.title, 'WIP') }}
125130
timeout-minutes: 75
126-
strategy:
127-
fail-fast: false
128131
env:
129132
ARROW_BUILD_TESTS: ON
130133
ARROW_DATASET: ON
@@ -173,7 +176,7 @@ jobs:
173176
run: |
174177
echo "::set-output name=cache-dir::$(ccache --get-config cache_dir)"
175178
- name: Cache ccache
176-
uses: actions/cache@v2
179+
uses: actions/cache@v3
177180
with:
178181
path: ${{ steps.ccache-info.outputs.cache-dir }}
179182
key: cpp-ccache-macos-${{ hashFiles('cpp/**') }}
@@ -271,7 +274,7 @@ jobs:
271274
run: |
272275
echo "::set-output name=cache-dir::$(ccache --get-config cache_dir)"
273276
- name: Cache ccache
274-
uses: actions/cache@v2
277+
uses: actions/cache@v3
275278
with:
276279
path: ${{ steps.ccache-info.outputs.cache-dir }}
277280
key: cpp-ccache-windows-${{ env.CACHE_VERSION }}-${{ hashFiles('cpp/**') }}
@@ -357,7 +360,7 @@ jobs:
357360
shell: msys2 {0}
358361
run: ci/scripts/msys2_setup.sh cpp
359362
- name: Cache ccache
360-
uses: actions/cache@v2
363+
uses: actions/cache@v3
361364
with:
362365
path: ccache
363366
key: cpp-ccache-mingw${{ matrix.mingw-n-bits }}-${{ hashFiles('cpp/**') }}
@@ -379,7 +382,7 @@ jobs:
379382
https://dl.min.io/server/minio/release/windows-amd64/archive/minio.RELEASE.2022-05-26T05-48-41Z
380383
chmod +x /usr/local/bin/minio.exe
381384
- name: Cache Python wheels
382-
uses: actions/cache@v2
385+
uses: actions/cache@v3
383386
with:
384387
path: "${{ env.PIP_CACHE_DIR }}"
385388
key: cpp-wheels-mingw${{ matrix.mingw-n-bits }}-${{ hashFiles('ci/scripts/install_gcs_testbench.sh') }}

‎.github/workflows/csharp.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,9 @@ concurrency:
3333
group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
3434
cancel-in-progress: true
3535

36+
permissions:
37+
contents: read
38+
3639
jobs:
3740

3841
ubuntu:
@@ -46,7 +49,7 @@ jobs:
4649
dotnet: ['6.0.x']
4750
steps:
4851
- name: Install C#
49-
uses: actions/setup-dotnet@v1
52+
uses: actions/setup-dotnet@v2
5053
with:
5154
dotnet-version: ${{ matrix.dotnet }}
5255
- name: Checkout Arrow
@@ -74,7 +77,7 @@ jobs:
7477
dotnet: ['6.0.x']
7578
steps:
7679
- name: Install C#
77-
uses: actions/setup-dotnet@v1
80+
uses: actions/setup-dotnet@v2
7881
with:
7982
dotnet-version: ${{ matrix.dotnet }}
8083
- name: Checkout Arrow
@@ -101,7 +104,7 @@ jobs:
101104
dotnet: ['6.0.x']
102105
steps:
103106
- name: Install C#
104-
uses: actions/setup-dotnet@v1
107+
uses: actions/setup-dotnet@v2
105108
with:
106109
dotnet-version: ${{ matrix.dotnet }}
107110
- name: Checkout Arrow

‎.github/workflows/dev.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,8 @@ concurrency:
2626
group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
2727
cancel-in-progress: true
2828

29-
env:
30-
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
31-
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
29+
permissions:
30+
contents: read
3231

3332
jobs:
3433

@@ -48,12 +47,18 @@ jobs:
4847
- name: Setup Archery
4948
run: pip install -e dev/archery[docker]
5049
- name: Execute Docker Build
50+
env:
51+
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
52+
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
5153
run: |
5254
sudo sysctl -w kernel.core_pattern="core.%e.%p"
5355
ulimit -c unlimited
5456
archery docker run -e GITHUB_ACTIONS=true ubuntu-lint
5557
- name: Docker Push
5658
if: success() && github.event_name == 'push' && github.repository == 'apache/arrow'
59+
env:
60+
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
61+
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
5762
continue-on-error: true
5863
run: archery docker push ubuntu-lint
5964

‎.github/workflows/dev_pr.yml‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,14 @@ on:
2929
- edited
3030
- synchronize
3131

32-
# NOTE: not using the "cancel-in-progress" feature here as the group key
33-
# does not have enough information for linking it to a particular PR
32+
concurrency:
33+
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.number }}
34+
cancel-in-progress: true
3435

36+
permissions:
37+
contents: read
38+
pull-requests: write
39+
3540
jobs:
3641
process:
3742
name: Process
@@ -41,9 +46,8 @@ jobs:
4146

4247
- name: Comment JIRA link
4348
if: |
44-
github.event_name == 'pull_request_target' &&
45-
(github.event.action == 'opened' ||
46-
github.event.action == 'edited')
49+
(github.event.action == 'opened' ||
50+
github.event.action == 'edited')
4751
uses: actions/github-script@v3
4852
with:
4953
github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -53,9 +57,8 @@ jobs:
5357
5458
- name: Check title
5559
if: |
56-
github.event_name == 'pull_request_target' &&
57-
(github.event.action == 'opened' ||
58-
github.event.action == 'edited')
60+
(github.event.action == 'opened' ||
61+
github.event.action == 'edited')
5962
uses: actions/github-script@v3
6063
with:
6164
github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -65,9 +68,8 @@ jobs:
6568
6669
- name: Check Jira Issue
6770
if: |
68-
github.event_name == 'pull_request_target' &&
69-
(github.event.action == 'opened' ||
70-
github.event.action == 'edited')
71+
(github.event.action == 'opened' ||
72+
github.event.action == 'edited')
7173
uses: actions/github-script@v3
7274
with:
7375
debug: true
@@ -78,10 +80,9 @@ jobs:
7880
7981
- name: Assign GitHub labels
8082
if: |
81-
github.event_name == 'pull_request_target' &&
82-
(github.event.action == 'opened' ||
83-
github.event.action == 'synchronize')
84-
uses: actions/[email protected]
83+
(github.event.action == 'opened' ||
84+
github.event.action == 'synchronize')
85+
uses: actions/labeler@4
8586
with:
8687
repo-token: ${{ secrets.GITHUB_TOKEN }}
8788
configuration-path: .github/workflows/dev_pr/labeler.yml

‎.github/workflows/docs.yml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,12 @@ name: Docs
2020
on:
2121
push:
2222

23+
permissions:
24+
contents: read
25+
2326
env:
2427
ARROW_ENABLE_TIMING_TESTS: OFF
2528
DOCKER_VOLUME_PREFIX: ".docker/"
26-
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
27-
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
2829

2930
jobs:
3031

@@ -41,7 +42,7 @@ jobs:
4142
with:
4243
fetch-depth: 0
4344
- name: Cache Docker Volumes
44-
uses: actions/cache@v2
45+
uses: actions/cache@v3
4546
with:
4647
path: .docker
4748
key: ubuntu-docs-${{ hashFiles('cpp/**') }}
@@ -53,8 +54,14 @@ jobs:
5354
- name: Setup Archery
5455
run: pip install -e dev/archery[docker]
5556
- name: Execute Docker Build
57+
env:
58+
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
59+
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
5660
run: archery docker run ubuntu-docs
5761
- name: Docker Push
5862
if: success() && github.event_name == 'push' && github.repository == 'apache/arrow'
63+
env:
64+
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
65+
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
5966
continue-on-error: true
6067
run: archery docker push ubuntu-docs

‎.github/workflows/docs_light.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,12 @@ on:
2828
- 'ci/scripts/cpp_build.sh'
2929
- 'ci/scripts/python_build.sh'
3030

31+
permissions:
32+
contents: read
33+
3134
env:
3235
ARROW_ENABLE_TIMING_TESTS: OFF
3336
DOCKER_VOLUME_PREFIX: ".docker/"
34-
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
35-
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
3637

3738
jobs:
3839

@@ -49,7 +50,7 @@ jobs:
4950
with:
5051
fetch-depth: 0
5152
- name: Cache Docker Volumes
52-
uses: actions/cache@v2
53+
uses: actions/cache@v3
5354
with:
5455
path: .docker
5556
key: conda-docs-${{ hashFiles('cpp/**') }}
@@ -61,4 +62,7 @@ jobs:
6162
- name: Setup Archery
6263
run: pip install -e dev/archery[docker]
6364
- name: Execute Docker Build
65+
env:
66+
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
67+
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
6468
run: archery docker run conda-python-docs

‎.github/workflows/go.yml‎

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,9 +36,8 @@ concurrency:
3636
group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
3737
cancel-in-progress: true
3838

39-
env:
40-
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
41-
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
39+
permissions:
40+
contents: read
4241

4342
jobs:
4443

@@ -72,9 +71,15 @@ jobs:
7271
- name: Setup Archery
7372
run: pip install -e dev/archery[docker]
7473
- name: Execute Docker Build
74+
env:
75+
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
76+
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
7577
run: archery docker run debian-go
7678
- name: Docker Push
7779
if: success() && github.event_name == 'push' && github.repository == 'apache/arrow'
80+
env:
81+
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
82+
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
7883
continue-on-error: true
7984
run: archery docker push debian-go
8085

@@ -108,9 +113,15 @@ jobs:
108113
- name: Setup Archery
109114
run: pip install -e dev/archery[docker]
110115
- name: Execute Docker Build
116+
env:
117+
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
118+
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
111119
run: archery docker run debian-go-cgo
112120
- name: Docker Push
113121
if: success() && github.event_name == 'push' && github.repository == 'apache/arrow'
122+
env:
123+
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
124+
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
114125
continue-on-error: true
115126
run: archery docker push debian-go-cgo
116127

@@ -144,9 +155,15 @@ jobs:
144155
- name: Setup Archery
145156
run: pip install -e dev/archery[docker]
146157
- name: Execute Docker Build
158+
env:
159+
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
160+
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
147161
run: archery docker run debian-go-cgo-python
148162
- name: Docker Push
149163
if: success() && github.event_name == 'push' && github.repository == 'apache/arrow'
164+
env:
165+
ARCHERY_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
166+
ARCHERY_DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
150167
continue-on-error: true
151168
run: archery docker push debian-go-cgo-python
152169

0 commit comments

Comments
 (0)