chore(ci): Harden GitHub Actions#400
Conversation
Signed-off-by: StepSecurity Bot <[email protected]>
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughAdds security scanning workflows (CodeQL and dependency review), configures pre-commit hooks (gitleaks, eslint, whitespace fixers), updates Dependabot to manage example directory dependencies, and hardens GitHub Actions runners by auditing outbound network calls across multiple CI jobs. ChangesSecurity & CI Infrastructure
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/scorecard.yml (1)
36-39: 🏗️ Heavy liftAudit-only mode doesn't enforce egress blocking.
egress-policy: auditlogs outbound traffic without blocking; connections are still allowed to proceed. For exfiltration prevention on high-sensitivity jobs, consider moving toegress-policy: blockwith an allowlist after baselining to confirm which endpoints are required.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/scorecard.yml around lines 36 - 39, The workflow currently uses step-security/harden-runner with egress-policy: audit which only logs outbound calls and does not block them; change the configuration to use egress-policy: block (e.g., update the step-security/harden-runner invocation) and add an explicit allowlist of required endpoints (after running audit baseline) so only approved egress is permitted; ensure you update the step-security/harden-runner step and include the allowlist parameters supported by that action to avoid breaking required integrations.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/scorecard.yml:
- Around line 36-39: The workflow currently uses step-security/harden-runner
with egress-policy: audit which only logs outbound calls and does not block
them; change the configuration to use egress-policy: block (e.g., update the
step-security/harden-runner invocation) and add an explicit allowlist of
required endpoints (after running audit baseline) so only approved egress is
permitted; ensure you update the step-security/harden-runner step and include
the allowlist parameters supported by that action to avoid breaking required
integrations.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ded38a1f-c2b9-45a9-bce5-35901ac5457f
📒 Files selected for processing (7)
.github/dependabot.yaml.github/workflows/codeql.yml.github/workflows/dependency-review.yml.github/workflows/main.yaml.github/workflows/pr-title-conventional-commit.yml.github/workflows/scorecard.yml.pre-commit-config.yaml
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #400 +/- ##
=======================================
Coverage 85.59% 85.59%
=======================================
Files 26 26
Lines 1270 1270
Branches 250 250
=======================================
Hits 1087 1087
Misses 110 110
Partials 73 73 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
Pull request overview
This PR hardens the repository’s GitHub Actions setup by tightening default workflow token permissions, adding runner egress auditing, and introducing additional supply-chain/security automation (CodeQL, dependency review, Dependabot entries, and pre-commit hooks).
Changes:
- Added
step-security/harden-runner(egress audit mode) to multiple workflows and set least-privilegeGITHUB_TOKENpermissions where applicable. - Introduced new security workflows: CodeQL scanning and Dependency Review on PRs.
- Added Dependabot updates for example projects and introduced a baseline
.pre-commit-config.yaml.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
.pre-commit-config.yaml |
Adds gitleaks, ESLint, and whitespace hooks via pre-commit. |
.github/workflows/scorecard.yml |
Adds runner hardening before checkout for scorecard runs. |
.github/workflows/pr-title-conventional-commit.yml |
Adds top-level token permissions and runner hardening for PR-title validation workflow. |
.github/workflows/main.yaml |
Adds runner hardening to CI jobs. |
.github/workflows/dependency-review.yml |
New workflow to block/flag vulnerable dependency changes in PRs. |
.github/workflows/codeql.yml |
New CodeQL code scanning workflow for JS/TS. |
.github/dependabot.yaml |
Enables daily npm updates for multiple example directories. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…security-remediation
This pull request is created by StepSecurity at the request of @rhamzeh.
Summary
This pull request is created by StepSecurity at the request of @rhamzeh. Please merge the Pull Request to incorporate the requested changes. Please tag @rhamzeh on your message if you have any questions related to the PR.
Summary
This pull request is created by StepSecurity at the request of @rhamzeh. Please merge the Pull Request to incorporate the requested changes. Please tag @rhamzeh on your message if you have any questions related to the PR.
Security Fixes
Least Privileged GitHub Actions Token Permissions
The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API. GitHub recommends setting minimum token permissions for the GITHUB_TOKEN.
Harden Runner
Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without
sudoaccess. See how popular open-source projects use Harden-Runner here.Harden runner usage
You can find link to view insights and policy recommendation in the build log
Please refer to documentation to find more details.
Keeping your actions up to date with Dependabot
With Dependabot version updates, when Dependabot identifies an outdated dependency, it raises a pull request to update the manifest to the latest version of the dependency. This is recommended by GitHub as well as The Open Source Security Foundation (OpenSSF).
Detect Vulnerabilities with SAST Workflow
Static Code Analysis (also known as Source Code Analysis) is usually performed as part of a Code Review (also known as clear-box testing) and is carried out at the Implementation phase of a Security Development Lifecycle (SDL). Static Code Analysis commonly refers to the running of Static Code Analysis tools that attempt to highlight possible vulnerabilities within ‘static’ (non-running) source code by using techniques such as Taint Analysis and Data Flow Analysis.
Add Dependency Review Workflow
The Dependency Review Workflow enforces dependency reviews on your pull requests. The action scans for vulnerable versions of dependencies introduced by package version changes in pull requests, and warns you about the associated security vulnerabilities. This gives you better visibility of what's changing in a pull request, and helps prevent vulnerabilities being added to your repository.
Maintain Code Quality with Pre-Commit
Pre-commit is a framework for managing and maintaining multi-language pre-commit hooks. Hooks can be any scripts, code, or binaries that run at any stage of the git workflow. Pre-commit hooks are useful for enforcing code quality, code formatting, and detecting security vulnerabilities.
Feedback
For bug reports, feature requests, and general feedback; please create an issue in step-security/secure-repo or contact us via our website.
Signed-off-by: StepSecurity Bot [email protected]
Summary by CodeRabbit