Skip to content

Commit 80b1992

Browse files
step-security-botstep-security-bot
authored
[StepSecurity] Apply security best practices (#3503)
Signed-off-by: StepSecurity Bot <[email protected]>
1 parent 6530e78 commit 80b1992

File tree

17 files changed

+315
-28
lines changed

17 files changed

+315
-28
lines changed

‎.container/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM python:3.10-bookworm
1+
FROM python:3.10-bookworm@sha256:7dd2fbef5caa5ad7be66474411cff3a6a2dcf7f9f9cb16fd962e819f4f57b85f
22

33
RUN pip install uv
44
RUN groupadd -r appuser && useradd -r -g appuser appuser

‎.container/minimal_build/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM python:3.10-bookworm
1+
FROM python:3.10-bookworm@sha256:7dd2fbef5caa5ad7be66474411cff3a6a2dcf7f9f9cb16fd962e819f4f57b85f
22

33
RUN pip install uv
44
RUN groupadd -r appuser && useradd -r -g appuser appuser

‎.github/dependabot.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: docker
4+
directory: /.container
5+
schedule:
6+
interval: daily
7+
8+
- package-ecosystem: docker
9+
directory: /.container/minimal_build
10+
schedule:
11+
interval: daily
12+
13+
- package-ecosystem: github-actions
14+
directory: /
15+
schedule:
16+
interval: daily
17+
18+
- package-ecosystem: pip
19+
directory: /apps/dilemma
20+
schedule:
21+
interval: daily
22+
23+
- package-ecosystem: pip
24+
directory: /camel/benchmarks/mock_website
25+
schedule:
26+
interval: daily
27+
28+
- package-ecosystem: docker
29+
directory: /camel/interpreters/docker
30+
schedule:
31+
interval: daily
32+
33+
- package-ecosystem: npm
34+
directory: /camel/toolkits/hybrid_browser_toolkit/ts
35+
schedule:
36+
interval: daily
37+
38+
- package-ecosystem: docker
39+
directory: /examples/runtimes/ubuntu_docker_runtime
40+
schedule:
41+
interval: daily
42+
43+
- package-ecosystem: pip
44+
directory: /examples/usecases/airbnb_mcp
45+
schedule:
46+
interval: daily
47+
48+
- package-ecosystem: pip
49+
directory: /examples/usecases/chat_with_github
50+
schedule:
51+
interval: daily
52+
53+
- package-ecosystem: pip
54+
directory: /examples/usecases/chat_with_youtube
55+
schedule:
56+
interval: daily
57+
58+
- package-ecosystem: pip
59+
directory: /examples/usecases/cloudfare_mcp_camel
60+
schedule:
61+
interval: daily
62+
63+
- package-ecosystem: pip
64+
directory: /examples/usecases/codeforces_question_solver
65+
schedule:
66+
interval: daily
67+
68+
- package-ecosystem: pip
69+
directory: /examples/usecases/mistral_OCR
70+
schedule:
71+
interval: daily
72+
73+
- package-ecosystem: pip
74+
directory: /examples/usecases/multi_agent_research_assistant
75+
schedule:
76+
interval: daily
77+
78+
- package-ecosystem: pip
79+
directory: /examples/usecases/pptx_toolkit_usecase
80+
schedule:
81+
interval: daily
82+
83+
- package-ecosystem: pip
84+
directory: /examples/usecases/youtube_ocr
85+
schedule:
86+
interval: daily

‎.github/workflows/build_package.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,19 @@ on:
88
- "**/*.md"
99
- "LICENSE"
1010

11+
permissions:
12+
contents: read
13+
1114
jobs:
1215
build:
1316
runs-on: ubuntu-latest
1417
steps:
15-
- uses: actions/checkout@v3
18+
- name: Harden the runner (Audit all outbound calls)
19+
uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
20+
with:
21+
egress-policy: audit
22+
23+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
1624

1725
- name: Free disk space
1826
run: |
@@ -28,7 +36,7 @@ jobs:
2836
df -h
2937
3038
- name: Set up Python environment
31-
uses: actions/setup-python@v3
39+
uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3.1.4
3240
with:
3341
python-version: "3.10"
3442

‎.github/workflows/codeql.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: ["master"]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: ["master"]
20+
schedule:
21+
- cron: "0 0 * * 1"
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
analyze:
28+
name: Analyze
29+
runs-on: ubuntu-latest
30+
permissions:
31+
actions: read
32+
contents: read
33+
security-events: write
34+
35+
strategy:
36+
fail-fast: false
37+
matrix:
38+
language: ["javascript", "python", "typescript"]
39+
# CodeQL supports [ $supported-codeql-languages ]
40+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
41+
42+
steps:
43+
- name: Harden the runner (Audit all outbound calls)
44+
uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
45+
with:
46+
egress-policy: audit
47+
48+
- name: Checkout repository
49+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
50+
51+
# Initializes the CodeQL tools for scanning.
52+
- name: Initialize CodeQL
53+
uses: github/codeql-action/init@497990dfed22177a82ba1bbab381bc8f6d27058f # v3.31.6
54+
with:
55+
languages: ${{ matrix.language }}
56+
# If you wish to specify custom queries, you can do so here or in a config file.
57+
# By default, queries listed here will override any specified in a config file.
58+
# Prefix the list here with "+" to use these queries and those in the config file.
59+
60+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
61+
# If this step fails, then you should remove it and run the build manually (see below)
62+
- name: Autobuild
63+
uses: github/codeql-action/autobuild@497990dfed22177a82ba1bbab381bc8f6d27058f # v3.31.6
64+
65+
# ℹ️ Command-line programs to run using the OS shell.
66+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
67+
68+
# If the Autobuild fails above, remove it and uncomment the following three lines.
69+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
70+
71+
# - run: |
72+
# echo "Run, Build Application using script"
73+
# ./location_of_script_within_repo/buildscript.sh
74+
75+
- name: Perform CodeQL Analysis
76+
uses: github/codeql-action/analyze@497990dfed22177a82ba1bbab381bc8f6d27058f # v3.31.6
77+
with:
78+
category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-review.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Harden the runner (Audit all outbound calls)
20+
uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
21+
with:
22+
egress-policy: audit
23+
24+
- name: 'Checkout Repository'
25+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
26+
- name: 'Dependency Review'
27+
uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

‎.github/workflows/documentation.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,13 @@ jobs:
1313
runs-on: ubuntu-latest
1414

1515
steps:
16+
- name: Harden the runner (Audit all outbound calls)
17+
uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
18+
with:
19+
egress-policy: audit
20+
1621
- name: Checkout code
17-
uses: actions/checkout@v4
22+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
1823
with:
1924
fetch-depth: 0
2025
persist-credentials: false

‎.github/workflows/pr-label-automation.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,13 @@ jobs:
1111
add-labels:
1212
runs-on: ubuntu-latest
1313
steps:
14+
- name: Harden the runner (Audit all outbound calls)
15+
uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
16+
with:
17+
egress-policy: audit
18+
1419
- name: Add Review Required label
15-
uses: actions/github-script@v7
20+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
1621
with:
1722
github-token: ${{ secrets.GITHUB_TOKEN }}
1823
script: |

‎.github/workflows/pre_commit.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,12 @@ jobs:
1818
pre-commit:
1919
runs-on: ubuntu-latest
2020
steps:
21-
- uses: actions/checkout@v3
21+
- name: Harden the runner (Audit all outbound calls)
22+
uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
23+
with:
24+
egress-policy: audit
25+
26+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
2227
- name: Set up Python environment and install dependencies
2328
uses: ./.github/actions/camel_install
2429
with:

‎.github/workflows/publish_release.yml‎

Lines changed: 28 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77

88
workflow_dispatch:
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
build-and-publish-pypi:
1215
name: Build and publish to PyPI
@@ -15,11 +18,16 @@ jobs:
1518
contents: write
1619

1720
steps:
21+
- name: Harden the runner (Audit all outbound calls)
22+
uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
23+
with:
24+
egress-policy: audit
25+
1826
- name: Checkout code
19-
uses: actions/checkout@v4
27+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2028

2129
- name: Set up Python
22-
uses: actions/setup-python@v4
30+
uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
2331
with:
2432
python-version: '3.10'
2533

@@ -46,7 +54,7 @@ jobs:
4654
twine upload dist/*
4755
4856
- name: Upload built artifacts
49-
uses: actions/upload-artifact@v4
57+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
5058
with:
5159
name: dist
5260
path: dist
@@ -59,11 +67,16 @@ jobs:
5967
contents: write
6068

6169
steps:
70+
- name: Harden the runner (Audit all outbound calls)
71+
uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
72+
with:
73+
egress-policy: audit
74+
6275
- name: Checkout code
63-
uses: actions/checkout@v4
76+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
6477

6578
- name: Download built artifacts
66-
uses: actions/download-artifact@v4
79+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
6780
with:
6881
name: dist
6982
path: dist
@@ -78,7 +91,7 @@ jobs:
7891
fi
7992
8093
- name: Release to GitHub
81-
uses: softprops/action-gh-release@v2
94+
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
8295
with:
8396
generate_release_notes: true
8497
draft: false
@@ -92,21 +105,26 @@ jobs:
92105
packages: write
93106

94107
steps:
108+
- name: Harden the runner (Audit all outbound calls)
109+
uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
110+
with:
111+
egress-policy: audit
112+
95113
- name: Checkout code
96-
uses: actions/checkout@v4
114+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
97115

98116
- name: Log in to GitHub Container Registry
99-
uses: docker/login-action@v3
117+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
100118
with:
101119
registry: ghcr.io
102120
username: ${{ github.actor }}
103121
password: ${{ secrets.GITHUB_TOKEN }}
104122

105123
- name: Set up Docker Buildx
106-
uses: docker/setup-buildx-action@v3
124+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
107125

108126
- name: Build and Push Docker image
109-
uses: docker/build-push-action@v5
127+
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
110128
with:
111129
context: .
112130
file: .container/minimal_build/Dockerfile

0 commit comments

Comments
 (0)