[StepSecurity] Apply security best practices #91
Conversation
Signed-off-by: StepSecurity Bot <[email protected]>
WalkthroughThis update enhances the automation and security of the development workflow through the introduction of multiple GitHub Actions workflows and a pre-commit configuration. Key changes include automated dependency updates via Dependabot, security analysis using CodeQL and Scorecard, and improved permission settings. Additionally, the incorporation of pre-commit hooks for code quality checks ensures that best practices are maintained throughout the development process. Changes
Sequence Diagram(s)sequenceDiagram
participant Developer
participant GitHub
participant Dependabot
participant CodeQL
participant Scorecard
Developer->>GitHub: Push code
GitHub->>Dependabot: Check for dependency updates
Dependabot->>GitHub: Create PR for updates
GitHub->>CodeQL: Trigger security analysis
CodeQL->>GitHub: Report vulnerabilities
GitHub->>Scorecard: Run supply-chain security checks
Scorecard->>GitHub: Provide security metrics
Developer->>GitHub: Review PR and merge
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (8)
- .github/dependabot.yml (1 hunks)
- .github/workflows/codeql.yml (1 hunks)
- .github/workflows/dependency-review.yml (1 hunks)
- .github/workflows/format.yml (1 hunks)
- .github/workflows/generate.yml (1 hunks)
- .github/workflows/scorecards.yml (1 hunks)
- .github/workflows/test.yml (1 hunks)
- .pre-commit-config.yaml (1 hunks)
Files skipped from review due to trivial changes (1)
- .github/dependabot.yml
Additional comments not posted (29)
.pre-commit-config.yaml (4)
2-5: Approved: Gitleaks pre-commit hook configuration.The gitleaks repository URL, version pinning, and hook configuration are correct.
6-9: Approved: Golangci-lint pre-commit hook configuration.The golangci-lint repository URL, version pinning, and hook configuration are correct.
10-13: Approved: Shellcheck pre-commit hook configuration.The shellcheck repository URL, version pinning, and hook configuration are correct.
14-18: Approved: Pre-commit hooks configuration.The pre-commit-hooks repository URL, version pinning, and hooks configuration are correct.
.github/workflows/test.yml (4)
11-13: Approved: Permissions configuration.The permissions section correctly specifies read access to repository contents, adhering to the principle of least privilege.
18-22: Approved: Harden Runner configuration.The Harden Runner step is correctly configured with the
step-security/harden-runneraction and anegress-policyset toaudit, enhancing security monitoring.
23-23: Approved: Actions checkout version update.The
actions/checkoutstep is correctly updated to a specific commit version, enhancing security and stability.
24-26: Approved: Actions setup-go version update.The
actions/setup-gostep is correctly updated to a specific commit version, enhancing security and stability..github/workflows/format.yml (4)
11-13: Approved: Permissions configuration.The permissions section correctly specifies read access to repository contents, adhering to the principle of least privilege.
18-22: Approved: Harden Runner configuration.The Harden Runner step is correctly configured with the
step-security/harden-runneraction and anegress-policyset toaudit, enhancing security monitoring.
23-23: Approved: Actions checkout version update.The
actions/checkoutstep is correctly updated to a specific commit version, enhancing security and stability.
24-26: Approved: Actions setup-go version update.The
actions/setup-gostep is correctly updated to a specific commit version, enhancing security and stability..github/workflows/generate.yml (4)
11-13: Least Privileged Permissions AppliedThe addition of the
permissionssection withcontents: readaligns with the principle of least privilege, enhancing security.
18-22: Harden Runner Step AddedThe "Harden Runner" step enhances security by monitoring outbound traffic, which helps prevent supply chain attacks.
23-23: Pinned actions/checkout VersionPinning the
actions/checkoutaction to a specific commit hash ensures stability and security by using a known version.
24-24: Pinned actions/setup-go VersionPinning the
actions/setup-goaction to a specific commit hash ensures stability and security by using a known version..github/workflows/dependency-review.yml (3)
1-9: Clear Header CommentsThe header comments provide a clear overview of the workflow's purpose and source, aiding in understanding and maintenance.
12-14: Least Privileged Permissions AppliedThe
permissionssection withcontents: readaligns with the principle of least privilege, enhancing security.
15-27: Secure Job StepsThe job steps, including hardening the runner, checking out the repository, and performing a dependency review, align with security best practices.
.github/workflows/codeql.yml (5)
1-12: Clear Header CommentsThe header comments provide a clear overview of the workflow's purpose and instructions for customization, aiding in understanding and maintenance.
14-22: Appropriate Trigger EventsThe workflow is triggered on push and pull request events to the master branch and on a schedule, ensuring regular and event-driven analysis.
23-25: Least Privileged Permissions AppliedThe
permissionssection withcontents: readandsecurity-events: writealigns with the principle of least privilege, enhancing security.
35-41: Appropriate Job Strategy and MatrixThe job strategy includes a fail-fast setting and a matrix for the Go language, ensuring efficient and comprehensive analysis.
42-78: Secure Job StepsThe job steps, including hardening the runner, checking out the repository, initializing CodeQL, autobuilding, and performing CodeQL analysis, align with security best practices.
.github/workflows/scorecards.yml (5)
1-5: LGTM! Informative header and correctly defined workflow name.The header provides necessary information about third-party actions, and the workflow name is appropriately set.
6-15: LGTM! Well-defined triggers for the workflow.The triggers include branch protection rules, a schedule for regular updates, and push events, which align with the security objectives.
17-31: LGTM! Appropriate permissions set for the workflow.Default permissions are set to read-only, with necessary write permissions for security events and id-token, adhering to security best practices.
20-76: LGTM! Well-structured job for security analysis.The
jobssection includes steps for hardening the runner, checking out the code, running the analysis, and uploading results. Pinned dependencies are used, enhancing security.
63-76: LGTM! Final steps ensure visibility and traceability of security analysis.Uploading the SARIF results as artifacts and to the code scanning dashboard is a best practice for maintaining security visibility.
Signed-off-by: James Elliott <[email protected]>
Signed-off-by: James Elliott <[email protected]>
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
Summary
This pull request is created by StepSecurity at the request of @james-d-elliott. Please merge the Pull Request to incorporate the requested changes. Please tag @james-d-elliott on your message if you have any questions related to the PR.
Security Fixes
Least Privileged GitHub Actions Token Permissions
The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API. GitHub recommends setting minimum token permissions for the GITHUB_TOKEN.
Pinned Dependencies
GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.
Harden Runner
Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without
sudoaccess.Harden runner usage
You can find link to view insights and policy recommendation in the build log
Please refer to documentation to find more details.
Keeping your actions up to date with Dependabot
With Dependabot version updates, when Dependabot identifies an outdated dependency, it raises a pull request to update the manifest to the latest version of the dependency. This is recommended by GitHub as well as The Open Source Security Foundation (OpenSSF).
Detect Vulnerabilities with SAST Workflow
Static Code Analysis (also known as Source Code Analysis) is usually performed as part of a Code Review (also known as clear-box testing) and is carried out at the Implementation phase of a Security Development Lifecycle (SDL). Static Code Analysis commonly refers to the running of Static Code Analysis tools that attempt to highlight possible vulnerabilities within ‘static’ (non-running) source code by using techniques such as Taint Analysis and Data Flow Analysis.
Add Dependency Review Workflow
The Dependency Review Workflow enforces dependency reviews on your pull requests. The action scans for vulnerable versions of dependencies introduced by package version changes in pull requests, and warns you about the associated security vulnerabilities. This gives you better visibility of what's changing in a pull request, and helps prevent vulnerabilities being added to your repository.
Add OpenSSF Scorecard Workflow
OpenSSF Scorecard is an automated tool that assesses a number of important heuristics ("checks") associated with software security and assigns each check a score of 0-10. You can use these scores to understand specific areas to improve in order to strengthen the security posture of your project.
Scorecard workflow also allows maintainers to display a Scorecard badge on their repository to show off their hard work.
Maintain Code Quality with Pre-Commit
Pre-commit is a framework for managing and maintaining multi-language pre-commit hooks. Hooks can be any scripts, code, or binaries that run at any stage of the git workflow. Pre-commit hooks are useful for enforcing code quality, code formatting, and detecting security vulnerabilities.
Feedback
For bug reports, feature requests, and general feedback; please email [email protected]. To create such PRs, please visit https://app.stepsecurity.io/securerepo.
Signed-off-by: StepSecurity Bot [email protected]