Skip to content

Commit 881a82d

Browse files
pglombardoCopilot
pglombardo
and
Copilot
authored
Security: Trash unnecessary workflows; Harden Others (#4556)
* Security: Delete unnecessary workflows * Security: Harden remaining GitHub Actions workflows Add least-privilege permissions, pin third-party actions to commit SHAs, clarify Docker fork PR job conditions, and pass chart-testing target branch via env instead of inline shell interpolation. * fix: Skip Campfire workflows when secret is unset Gate Campfire notify jobs on CAMPFIRE_MESSAGES_URL so forks and repos without the secret configured do not run notification steps. * Hatchbox Conditional * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Peter Giacomo Lombardo <pglombardo@hey.com> * Remove old fix * Remove old fix * Lower PR limit * fix: Skip Docker workflow when DOCKER_USERNAME is unset Gate all Docker container build jobs on the DOCKER_USERNAME secret so forks and repos without Docker Hub credentials do not run scheduled, tag, or labeled PR builds. * Update commit hashes --------- Signed-off-by: Peter Giacomo Lombardo <pglombardo@hey.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
1 parent 09ed2c2 commit 881a82d

10 files changed

Lines changed: 58 additions & 312 deletions

‎.github/dependabot.yml‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,7 @@ updates:
1212
- dependency-type: "all"
1313
commit-message:
1414
prefix: ":arrow_up:"
15-
open-pull-requests-limit: 50
16-
ignore:
17-
- dependency-name: "rack-throttle"
18-
versions: [">=0.7.1"]
19-
# FIXME: Bootstrap Bug
20-
# https://github.com/pglombardo/PasswordPusher/issues/1377
21-
- dependency-name: "bootstrap"
22-
versions: [">5.2.3"]
15+
open-pull-requests-limit: 20
2316

2417
- package-ecosystem: "github-actions"
2518
directory: "/"
@@ -29,7 +22,7 @@ updates:
2922
- dependency-type: "all"
3023
commit-message:
3124
prefix: ":arrow_up:"
32-
open-pull-requests-limit: 50
25+
open-pull-requests-limit: 20
3326

3427
- package-ecosystem: "docker"
3528
directory: "/containers/docker"
@@ -39,4 +32,4 @@ updates:
3932
- dependency-type: "all"
4033
commit-message:
4134
prefix: ":arrow_up:"
42-
open-pull-requests-limit: 50
35+
open-pull-requests-limit: 20

‎.github/workflows/brakeman.yml‎

Lines changed: 0 additions & 67 deletions
This file was deleted.

‎.github/workflows/campfire-notify.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,17 @@ on:
44
push:
55
branches: [ master ]
66

7+
permissions:
8+
contents: read
9+
710
jobs:
811
post-commit-info:
12+
if: secrets.CAMPFIRE_MESSAGES_URL != ''
913
runs-on: ubuntu-latest
1014
steps:
1115
- name: Post commit info to Campfire
1216
continue-on-error: true
13-
uses: shane-lamb/campfire-notify-action@v1.1.6
17+
uses: shane-lamb/campfire-notify-action@df63cf73810147306276e281bedccf71c1519caf # v1.1.6
1418
with:
1519
messages_url: ${{ secrets.CAMPFIRE_MESSAGES_URL }}
1620
template: commit_pushed

‎.github/workflows/dependabot-automerge.yml‎

Lines changed: 0 additions & 76 deletions
This file was deleted.

‎.github/workflows/docker-containers.yml‎

Lines changed: 29 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
---
2+
# Fork PR builds run only when a maintainer adds the "docker" label. Login and push
3+
# are disabled for fork PRs; labeled fork PRs still execute untrusted Dockerfiles.
4+
# Skipped entirely when DOCKER_USERNAME is not configured (e.g. forks).
25
name: Docker Container Builds
36

47
on:
@@ -22,26 +25,29 @@ on:
2225
types:
2326
- labeled
2427

28+
permissions:
29+
contents: read
30+
2531
env:
2632
DOCKER_PUSH: true
2733
jobs:
2834
pwpush-container:
29-
if: github.event.label && github.event.label.name == 'docker' || github.event_name != 'pull_request'
35+
if: secrets.DOCKER_USERNAME != '' && ((github.event.label && github.event.label.name == 'docker') || github.event_name != 'pull_request')
3036
runs-on: ubuntu-latest
3137
steps:
3238
- name: Checkout
33-
uses: actions/checkout@v6
39+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
3440
with:
3541
repository: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || github.repository }}
3642
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
3743
fetch-depth: 1
3844

3945
- name: Set up Docker Buildx
40-
uses: docker/setup-buildx-action@v4
46+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
4147

4248
- name: Populate Docker metadata
4349
id: meta
44-
uses: docker/metadata-action@v6
50+
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
4551
with:
4652
images: ${{ secrets.DOCKER_USERNAME }}/pwpush
4753
tags: |
@@ -55,13 +61,13 @@ jobs:
5561
5662
- name: Login to DockerHub
5763
if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork
58-
uses: docker/login-action@v4
64+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
5965
with:
6066
username: ${{ secrets.DOCKER_USERNAME }}
6167
password: ${{ secrets.DOCKER_PASSWORD }}
6268

6369
- name: Build and push Docker image
64-
uses: docker/build-push-action@v7
70+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
6571
with:
6672
context: .
6773
file: ./containers/docker/Dockerfile
@@ -79,35 +85,35 @@ jobs:
7985
- name: Post job failure details to Campfire
8086
if: failure() && github.ref == 'refs/heads/master'
8187
continue-on-error: true
82-
uses: shane-lamb/campfire-notify-action@v1.1.6
88+
uses: shane-lamb/campfire-notify-action@df63cf73810147306276e281bedccf71c1519caf # v1.1.6
8389
with:
8490
messages_url: ${{ secrets.CAMPFIRE_MESSAGES_URL }}
8591
template: job_failed
8692

8793

8894
public-gateway-container:
89-
if: github.event.label && github.event.label.name == 'docker' || github.event_name != 'pull_request'
95+
if: secrets.DOCKER_USERNAME != '' && ((github.event.label && github.event.label.name == 'docker') || github.event_name != 'pull_request')
9096
needs: pwpush-container
9197
runs-on: ubuntu-latest
9298
steps:
9399
- name: Checkout
94-
uses: actions/checkout@v6
100+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
95101
with:
96102
repository: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || github.repository }}
97103
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
98104
fetch-depth: 1
99105

100106
- name: Set up QEMU
101-
uses: docker/setup-qemu-action@v4
107+
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
102108
with:
103109
image: tonistiigi/binfmt:master
104110

105111
- name: Set up Docker Buildx
106-
uses: docker/setup-buildx-action@v4
112+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
107113

108114
- name: Populate Docker metadata
109115
id: meta
110-
uses: docker/metadata-action@v6
116+
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
111117
with:
112118
images: ${{ secrets.DOCKER_USERNAME }}/pwpush-public-gateway
113119
tags: |
@@ -121,13 +127,13 @@ jobs:
121127
122128
- name: Login to DockerHub
123129
if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork
124-
uses: docker/login-action@v4
130+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
125131
with:
126132
username: ${{ secrets.DOCKER_USERNAME }}
127133
password: ${{ secrets.DOCKER_PASSWORD }}
128134

129135
- name: Build and push Docker image
130-
uses: docker/build-push-action@v7
136+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
131137
with:
132138
context: .
133139
file: ./containers/docker/Dockerfile.public-gateway
@@ -145,34 +151,34 @@ jobs:
145151
- name: Post job failure details to Campfire
146152
if: failure() && github.ref == 'refs/heads/master'
147153
continue-on-error: true
148-
uses: shane-lamb/campfire-notify-action@v1.1.6
154+
uses: shane-lamb/campfire-notify-action@df63cf73810147306276e281bedccf71c1519caf # v1.1.6
149155
with:
150156
messages_url: ${{ secrets.CAMPFIRE_MESSAGES_URL }}
151157
template: job_failed
152158

153159
worker-container:
154-
if: github.event.label && github.event.label.name == 'docker' || github.event_name != 'pull_request'
160+
if: secrets.DOCKER_USERNAME != '' && ((github.event.label && github.event.label.name == 'docker') || github.event_name != 'pull_request')
155161
needs: pwpush-container
156162
runs-on: ubuntu-latest
157163
steps:
158164
- name: Checkout
159-
uses: actions/checkout@v6
165+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
160166
with:
161167
repository: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || github.repository }}
162168
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
163169
fetch-depth: 1
164170

165171
- name: Set up QEMU
166-
uses: docker/setup-qemu-action@v4
172+
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
167173
with:
168174
image: tonistiigi/binfmt:master
169175

170176
- name: Set up Docker Buildx
171-
uses: docker/setup-buildx-action@v4
177+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
172178

173179
- name: Populate Docker metadata
174180
id: meta
175-
uses: docker/metadata-action@v6
181+
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
176182
with:
177183
images: ${{ secrets.DOCKER_USERNAME }}/pwpush-worker
178184
tags: |
@@ -186,13 +192,13 @@ jobs:
186192
187193
- name: Login to DockerHub
188194
if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork
189-
uses: docker/login-action@v4
195+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
190196
with:
191197
username: ${{ secrets.DOCKER_USERNAME }}
192198
password: ${{ secrets.DOCKER_PASSWORD }}
193199

194200
- name: Build and push Docker image
195-
uses: docker/build-push-action@v7
201+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
196202
with:
197203
context: .
198204
file: ./containers/docker/Dockerfile.worker
@@ -210,7 +216,7 @@ jobs:
210216
- name: Post job failure details to Campfire
211217
if: failure() && github.ref == 'refs/heads/master'
212218
continue-on-error: true
213-
uses: shane-lamb/campfire-notify-action@v1.1.6
219+
uses: shane-lamb/campfire-notify-action@df63cf73810147306276e281bedccf71c1519caf # v1.1.6
214220
with:
215221
messages_url: ${{ secrets.CAMPFIRE_MESSAGES_URL }}
216222
template: job_failed

‎.github/workflows/greetings.yml‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

0 commit comments

Comments
 (0)