Skip to content

Commit 690005d

Browse files
tankerkiller125tankerkiller125
committed
Harden all github actions
1 parent f0b8bb8 commit 690005d

File tree

5 files changed

+92
-36
lines changed

5 files changed

+92
-36
lines changed

‎.github/ISSUE_TEMPLATE/internal.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
name: "🛠️ Internal / Developer Issue"
3+
about: "Unstructured issue for project members only. Outside contributors: please use a standard template."
4+
title: "[INT]: "
5+
labels: ["internal"]
6+
assignees: []
7+
---
8+
9+
**Summary:**
10+
[Write here]

‎.github/workflows/docker-publish-hardened.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ jobs:
5656
ACTIONS_STEP_DEBUG: true
5757

5858
- name: Checkout repository
59-
uses: actions/checkout@v4
59+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
6060

6161
- name: Prepare
6262
run: |
@@ -123,7 +123,7 @@ jobs:
123123
annotations: ${{ steps.meta.outputs.annotations }}
124124

125125
- name: Attest platform-specific images
126-
uses: actions/attest-build-provenance@v1
126+
uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8
127127
if: github.event_name != 'pull_request'
128128
with:
129129
subject-name: ${{ env.GHCR_REPO }}
@@ -216,7 +216,7 @@ jobs:
216216
echo "digest=$digest" >> $GITHUB_OUTPUT
217217
218218
- name: Attest GHCR images
219-
uses: actions/attest-build-provenance@v1
219+
uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8
220220
if: github.event_name != 'pull_request'
221221
with:
222222
subject-name: ${{ env.GHCR_REPO }}
@@ -240,7 +240,7 @@ jobs:
240240
echo "digest=$digest" >> $GITHUB_OUTPUT
241241
242242
- name: Attest Dockerhub images
243-
uses: actions/attest-build-provenance@v1
243+
uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8
244244
if: (github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/'))
245245
with:
246246
subject-name: docker.io/${{ env.DOCKERHUB_REPO }}

‎.github/workflows/docker-publish-rootless.yaml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ jobs:
6060
ACTIONS_STEP_DEBUG: true
6161

6262
- name: Checkout repository
63-
uses: actions/checkout@v4
63+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
6464

6565
- name: Prepare
6666
run: |
@@ -75,40 +75,40 @@ jobs:
7575
7676
- name: Docker meta
7777
id: meta
78-
uses: docker/metadata-action@v5
78+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f
7979
with:
8080
images: |
8181
name=${{ env.DOCKERHUB_REPO }},enable=${{ github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/') }}
8282
name=${{ env.GHCR_REPO }}
8383
8484
- name: Login to Docker Hub
85-
uses: docker/login-action@v3
85+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
8686
if: (github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/'))
8787
with:
8888
username: ${{ secrets.DOCKER_USERNAME }}
8989
password: ${{ secrets.DOCKER_PASSWORD }}
9090

9191
- name: Login to GHCR
92-
uses: docker/login-action@v3
92+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
9393
with:
9494
registry: ghcr.io
9595
username: ${{ github.actor }}
9696
password: ${{ secrets.GITHUB_TOKEN }}
9797

9898
- name: Set up QEMU
99-
uses: docker/setup-qemu-action@v3
99+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
100100
with:
101101
image: ghcr.io/sysadminsmedia/binfmt:latest
102102

103103
- name: Set up Docker Buildx
104-
uses: docker/setup-buildx-action@v3
104+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
105105
with:
106106
driver-opts: |
107107
image=ghcr.io/sysadminsmedia/buildkit:master
108108
109109
- name: Build and push by digest
110110
id: build
111-
uses: docker/build-push-action@v6
111+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
112112
with:
113113
context: . # Explicitly specify the build context
114114
file: ./Dockerfile.rootless # Explicitly specify the Dockerfile
@@ -125,7 +125,7 @@ jobs:
125125
annotations: ${{ steps.meta.outputs.annotations }}
126126

127127
- name: Attest platform-specific images
128-
uses: actions/attest-build-provenance@v1
128+
uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8
129129
if: github.event_name != 'pull_request'
130130
with:
131131
subject-name: ${{ env.GHCR_REPO }}
@@ -139,7 +139,7 @@ jobs:
139139
touch "/tmp/digests/${digest#sha256:}"
140140
141141
- name: Upload digest
142-
uses: actions/upload-artifact@v4
142+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
143143
with:
144144
name: digests-${{ env.PLATFORM_PAIR }}
145145
path: /tmp/digests/*
@@ -159,35 +159,35 @@ jobs:
159159

160160
steps:
161161
- name: Download digests
162-
uses: actions/download-artifact@v4
162+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
163163
with:
164164
path: /tmp/digests
165165
pattern: digests-*
166166
merge-multiple: true
167167

168168
- name: Login to Docker Hub
169-
uses: docker/login-action@v3
169+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
170170
if: (github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/'))
171171
with:
172172
username: ${{ secrets.DOCKER_USERNAME }}
173173
password: ${{ secrets.DOCKER_PASSWORD }}
174174

175175
- name: Login to GHCR
176-
uses: docker/login-action@v3
176+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
177177
with:
178178
registry: ghcr.io
179179
username: ${{ github.actor }}
180180
password: ${{ secrets.GITHUB_TOKEN }}
181181

182182
- name: Set up Docker Buildx
183-
uses: docker/setup-buildx-action@v3
183+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
184184
with:
185185
driver-opts: |
186186
image=ghcr.io/sysadminsmedia/buildkit:master
187187
188188
- name: Docker meta
189189
id: meta
190-
uses: docker/metadata-action@v5
190+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f
191191
with:
192192
images: |
193193
name=${{ env.DOCKERHUB_REPO }},enable=${{ github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/') }}
@@ -218,7 +218,7 @@ jobs:
218218
echo "digest=$digest" >> $GITHUB_OUTPUT
219219
220220
- name: Attest GHCR images
221-
uses: actions/attest-build-provenance@v1
221+
uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8
222222
if: github.event_name != 'pull_request'
223223
with:
224224
subject-name: ${{ env.GHCR_REPO }}
@@ -242,7 +242,7 @@ jobs:
242242
echo "digest=$digest" >> $GITHUB_OUTPUT
243243
244244
- name: Attest Dockerhub images
245-
uses: actions/attest-build-provenance@v1
245+
uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8
246246
if: (github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/'))
247247
with:
248248
subject-name: docker.io/${{ env.DOCKERHUB_REPO }}

‎.github/workflows/docker-publish.yaml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ jobs:
5454

5555
steps:
5656
- name: Checkout repository
57-
uses: actions/checkout@v4
57+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
5858

5959
- name: Prepare
6060
run: |
@@ -70,40 +70,40 @@ jobs:
7070
7171
- name: Docker meta
7272
id: meta
73-
uses: docker/metadata-action@v5
73+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f
7474
with:
7575
images: |
7676
name=${{ env.DOCKERHUB_REPO }},enable=${{ github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/') }}
7777
name=${{ env.GHCR_REPO }}
7878
7979
- name: Login to Docker Hub
80-
uses: docker/login-action@v3
80+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
8181
if: (github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/'))
8282
with:
8383
username: ${{ secrets.DOCKER_USERNAME }}
8484
password: ${{ secrets.DOCKER_PASSWORD }}
8585

8686
- name: Login to GHCR
87-
uses: docker/login-action@v3
87+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
8888
with:
8989
registry: ghcr.io
9090
username: ${{ github.actor }}
9191
password: ${{ secrets.GITHUB_TOKEN }}
9292

9393
- name: Set up QEMU
94-
uses: docker/setup-qemu-action@v3
94+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
9595
with:
9696
image: ghcr.io/sysadminsmedia/binfmt:latest
9797

9898
- name: Set up Docker Buildx
99-
uses: docker/setup-buildx-action@v3
99+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
100100
with:
101101
driver-opts: |
102102
image=ghcr.io/sysadminsmedia/buildkit:latest
103103
104104
- name: Build and push by digest
105105
id: build
106-
uses: docker/build-push-action@v6
106+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
107107
with:
108108
platforms: ${{ matrix.platform }}
109109
labels: ${{ steps.meta.outputs.labels }}
@@ -118,7 +118,7 @@ jobs:
118118
annotations: ${{ steps.meta.outputs.annotations }}
119119

120120
- name: Attest platform-specific images
121-
uses: actions/attest-build-provenance@v1
121+
uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8
122122
if: github.event_name != 'pull_request'
123123
with:
124124
subject-name: ${{ env.GHCR_REPO }}
@@ -132,7 +132,7 @@ jobs:
132132
touch "/tmp/digests/${digest#sha256:}"
133133
134134
- name: Upload digest
135-
uses: actions/upload-artifact@v4
135+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
136136
with:
137137
name: digests-${{ env.PLATFORM_PAIR }}
138138
path: /tmp/digests/*
@@ -152,35 +152,35 @@ jobs:
152152

153153
steps:
154154
- name: Download digests
155-
uses: actions/download-artifact@v4
155+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
156156
with:
157157
path: /tmp/digests
158158
pattern: digests-*
159159
merge-multiple: true
160160

161161
- name: Login to Docker Hub
162-
uses: docker/login-action@v3
162+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
163163
if: (github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/'))
164164
with:
165165
username: ${{ secrets.DOCKER_USERNAME }}
166166
password: ${{ secrets.DOCKER_PASSWORD }}
167167

168168
- name: Login to GHCR
169-
uses: docker/login-action@v3
169+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
170170
with:
171171
registry: ghcr.io
172172
username: ${{ github.actor }}
173173
password: ${{ secrets.GITHUB_TOKEN }}
174174

175175
- name: Set up Docker Buildx
176-
uses: docker/setup-buildx-action@v3
176+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
177177
with:
178178
driver-opts: |
179179
image=ghcr.io/sysadminsmedia/buildkit:master
180180
181181
- name: Docker meta
182182
id: meta
183-
uses: docker/metadata-action@v5
183+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f
184184
with:
185185
images: |
186186
name=${{ env.DOCKERHUB_REPO }},enable=${{ github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/') }}
@@ -209,7 +209,7 @@ jobs:
209209
echo "digest=$digest" >> $GITHUB_OUTPUT
210210
211211
- name: Attest GHCR images
212-
uses: actions/attest-build-provenance@v1
212+
uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8
213213
if: github.event_name != 'pull_request'
214214
with:
215215
subject-name: ${{ env.GHCR_REPO }}
@@ -233,7 +233,7 @@ jobs:
233233
echo "digest=$digest" >> $GITHUB_OUTPUT
234234
235235
- name: Attest Dockerhub images
236-
uses: actions/attest-build-provenance@v1
236+
uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8
237237
if: (github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/'))
238238
with:
239239
subject-name: docker.io/${{ env.DOCKERHUB_REPO }}

‎.github/workflows/issue-gatekeeper.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Issue Gatekeeper
2+
on:
3+
issues:
4+
types: [ opened ]
5+
6+
jobs:
7+
check-permissions:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Verify Internal Template Use
11+
uses: actions/github-script@v7
12+
with:
13+
script: |
14+
const { owner, repo } = context.repo;
15+
const issue_number = context.issue.number;
16+
const actor = context.payload.sender.login;
17+
18+
// 1. Get user permission level
19+
const { data: perms } = await github.rest.repos.getCollaboratorPermissionLevel({
20+
owner,
21+
repo,
22+
username: actor
23+
});
24+
25+
const isMember = ['admin', 'write'].includes(perms.permission);
26+
const body = context.payload.issue.body || "";
27+
28+
// 2. Check if they used the internal template (or if the issue is blank)
29+
// We detect this by checking for our specific template string or the 'internal' label
30+
const usedInternal = context.payload.issue.labels.some(l => l.name === 'internal');
31+
32+
if (usedInternal && !isMember) {
33+
await github.rest.issues.createComment({
34+
owner,
35+
repo,
36+
issue_number,
37+
body: `@${actor}, the "Internal" template is restricted to project members. Please use one of the standard bug or feature templates for this repository.`
38+
});
39+
40+
await github.rest.issues.update({
41+
owner,
42+
repo,
43+
issue_number,
44+
state: 'closed'
45+
});
46+
}

0 commit comments

Comments
 (0)