From 124ae5d2c510bf1a9932621ba2c05997139262f2 Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Fri, 7 Nov 2025 01:16:53 +0000 Subject: [PATCH] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/workflows/build-and-quality-checks.yml | 7 +++++-- .github/workflows/check-pr-title.yml | 6 +++--- .github/workflows/deploy-cocoapods.yml | 7 +++++-- .github/workflows/draft-new-release.yml | 13 +++++++++---- .../manage-github-issue-for-outdated-pods.yml | 4 ++-- .github/workflows/notion-pr-sync.yml | 4 ++-- .github/workflows/publish-new-release.yml | 8 ++++---- .github/workflows/slack-notify.yml | 7 +++++-- 8 files changed, 35 insertions(+), 21 deletions(-) diff --git a/.github/workflows/build-and-quality-checks.yml b/.github/workflows/build-and-quality-checks.yml index c00e1f5..56b885d 100644 --- a/.github/workflows/build-and-quality-checks.yml +++ b/.github/workflows/build-and-quality-checks.yml @@ -4,6 +4,9 @@ on: branches: ['master'] types: ['opened', 'reopened', 'synchronize'] +permissions: + contents: read + jobs: build: name: Code Quality Checks @@ -11,12 +14,12 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2 with: egress-policy: audit - name: Checkout source branch - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Install Cocoapods run: gem install cocoapods diff --git a/.github/workflows/check-pr-title.yml b/.github/workflows/check-pr-title.yml index 5ce77ed..fdb8d26 100644 --- a/.github/workflows/check-pr-title.yml +++ b/.github/workflows/check-pr-title.yml @@ -10,12 +10,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2 with: egress-policy: audit - name: Checkout source branch - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Check PR title - uses: rudderlabs/github-action-check-pr-title@v1.0.7 + uses: rudderlabs/github-action-check-pr-title@29308e12984bdb3f3dcf8dcec3308f4f4652529c # v1.0.7 diff --git a/.github/workflows/deploy-cocoapods.yml b/.github/workflows/deploy-cocoapods.yml index 8e2a030..c345fd9 100644 --- a/.github/workflows/deploy-cocoapods.yml +++ b/.github/workflows/deploy-cocoapods.yml @@ -4,18 +4,21 @@ on: release: types: [created] +permissions: + contents: read + jobs: build: name: Deploy to Cocoapods runs-on: macOS-latest steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2 with: egress-policy: audit - name: Checkout source branch - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Install Cocoapods run: gem install cocoapods diff --git a/.github/workflows/draft-new-release.yml b/.github/workflows/draft-new-release.yml index 328c164..3dfbb62 100644 --- a/.github/workflows/draft-new-release.yml +++ b/.github/workflows/draft-new-release.yml @@ -3,24 +3,29 @@ name: Draft new release on: workflow_dispatch +permissions: + contents: read + jobs: draft-new-release: + permissions: + contents: write # for Git to git push name: Draft a new release runs-on: ubuntu-latest if: startsWith(github.ref, 'refs/heads/fix/') || startsWith(github.ref, 'refs/heads/feat/') steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2 with: egress-policy: audit - name: Checkout source branch - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 0 - name: Set Node 16 - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: 16 @@ -84,7 +89,7 @@ jobs: git push --follow-tags - name: Create pull request into master - uses: repo-sync/pull-request@v2 + uses: repo-sync/pull-request@7e79a9f5dc3ad0ce53138f01df2fad14a04831c5 # v2.12.1 with: source_branch: ${{ steps.create-release.outputs.branch_name }} destination_branch: 'master' diff --git a/.github/workflows/manage-github-issue-for-outdated-pods.yml b/.github/workflows/manage-github-issue-for-outdated-pods.yml index 37d182f..965571c 100644 --- a/.github/workflows/manage-github-issue-for-outdated-pods.yml +++ b/.github/workflows/manage-github-issue-for-outdated-pods.yml @@ -11,11 +11,11 @@ jobs: name: Check outdate pods and create issue if it doesn't exist steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2 with: egress-policy: audit - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Check outdated pods and create issue id: check-outdated-pods-and-create-issue diff --git a/.github/workflows/notion-pr-sync.yml b/.github/workflows/notion-pr-sync.yml index df5117f..1ebb7f4 100644 --- a/.github/workflows/notion-pr-sync.yml +++ b/.github/workflows/notion-pr-sync.yml @@ -48,12 +48,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2 with: egress-policy: audit - name: Sync Github PRs to Notion - uses: sivashanmukh/github-notion-pr-sync@1.0.0 + uses: sivashanmukh/github-notion-pr-sync@3967330238449a8550b06f6e1d6b83e1af569876 # 1.0.0 with: notionKey: ${{ secrets.NOTION_BOT_KEY }} notionDatabaseId: ${{ secrets.NOTION_PR_DB_ID }} diff --git a/.github/workflows/publish-new-release.yml b/.github/workflows/publish-new-release.yml index b66d450..365e971 100644 --- a/.github/workflows/publish-new-release.yml +++ b/.github/workflows/publish-new-release.yml @@ -14,7 +14,7 @@ jobs: if: startsWith(github.event.pull_request.head.ref, 'release/') && github.event.pull_request.merged == true # only merged pull requests must trigger this job steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2 with: egress-policy: audit @@ -26,12 +26,12 @@ jobs: echo "release_version=$VERSION" >> $GITHUB_OUTPUT - name: Checkout source branch - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 0 - name: Set Node 16 - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: 16 @@ -45,7 +45,7 @@ jobs: npx conventional-github-releaser -p angular - name: Delete release branch - uses: koj-co/delete-merged-action@master + uses: koj-co/delete-merged-action@63a03c35810a8a7d4840d18793c0f68ff8b59450 # master if: startsWith(github.event.pull_request.head.ref, 'release/') with: branches: 'release/*' diff --git a/.github/workflows/slack-notify.yml b/.github/workflows/slack-notify.yml index dbc8423..69bb332 100644 --- a/.github/workflows/slack-notify.yml +++ b/.github/workflows/slack-notify.yml @@ -4,19 +4,22 @@ on: release: types: [created] +permissions: + contents: read + jobs: deploy-tag: name: Notify Slack runs-on: ubuntu-latest steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@v2 + uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2 with: egress-policy: audit - name: Send message to Slack channel id: slack - uses: slackapi/slack-github-action@v1.23.0 + uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844 # v1.23.0 env: SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} PROJECT_NAME: 'iOS Facebook App Events SDK'