Skip to content

Commit e08c4db

Browse files
aquint-zamaaquint-zama
committed
ci(common): security fixes
- remove persist-credentials - fixes job permissions
1 parent 171f5f7 commit e08c4db

28 files changed

+194
-104
lines changed

‎.github/workflows/charts-helm-checks.yml‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,16 @@ jobs:
1010
check-changes:
1111
name: charts-helm-checks/check-changes
1212
permissions:
13-
actions: 'read'
14-
contents: 'read'
15-
pull-requests: 'read'
13+
actions: read
14+
contents: read
15+
pull-requests: read
1616
runs-on: ubuntu-latest
1717
outputs:
1818
changes-charts: ${{ steps.filter.outputs.charts }}
1919
steps:
2020
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21+
with:
22+
persist-credentials: 'false'
2123
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
2224
id: filter
2325
with:
@@ -31,9 +33,11 @@ jobs:
3133
if: ${{ needs.check-changes.outputs.changes-charts == 'true' }}
3234
runs-on: 'ubuntu-latest'
3335
permissions:
34-
contents: 'read'
36+
contents: read
3537
steps:
36-
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
38+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
39+
with:
40+
persist-credentials: 'false'
3741
- name: Lint
3842
uses: WyriHaximus/github-action-helm3@fc4ba26e75cf5d08182c6ce3b72623c8bfd7272b # v3.1.0
3943
with:
@@ -44,12 +48,13 @@ jobs:
4448
if: ${{ needs.check-changes.outputs.changes-charts == 'true' }}
4549
runs-on: ubuntu-latest
4650
permissions:
47-
contents: 'read'
51+
contents: read
4852
steps:
4953
- name: Checkout
5054
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5155
with:
5256
fetch-depth: 0
57+
persist-credentials: false
5358

5459
- name: Set up Helm
5560
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 #v4.2.0

‎.github/workflows/charts-helm-release.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ jobs:
2424
changes-charts: ${{ steps.filter.outputs.charts }}
2525
steps:
2626
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
27+
with:
28+
persist-credentials: 'false'
2729
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
2830
id: filter
2931
with:
@@ -42,6 +44,7 @@ jobs:
4244
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4345
with:
4446
fetch-depth: 0
47+
persist-credentials: 'false'
4548

4649
- name: Configure Git
4750
run: |

‎.github/workflows/common-pull-request-lint.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
env:
77
ACTIONLINT_VERSION: 1.6.27
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
lint:
1114
name: common-pull-request/lint (bpr)

‎.github/workflows/coprocessor-cargo-tests.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,16 @@ jobs:
1111
check-changes:
1212
name: coprocessor-cargo-test/check-changes
1313
permissions:
14-
actions: 'read'
15-
contents: 'read'
16-
pull-requests: 'read'
14+
actions: read
15+
contents: read
16+
pull-requests: read
1717
runs-on: ubuntu-latest
1818
outputs:
1919
changes-rust-files: ${{ steps.filter.outputs.rust-files }}
2020
steps:
2121
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
22+
with:
23+
persist-credentials: 'false'
2224
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
2325
id: filter
2426
with:

‎.github/workflows/coprocessor-dependency-analysis.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,16 @@ jobs:
1111
check-changes:
1212
name: coprocessor-dependency-analysis/check-changes
1313
permissions:
14-
actions: 'read'
15-
contents: 'read'
16-
pull-requests: 'read'
14+
actions: read
15+
contents: read
16+
pull-requests: read
1717
runs-on: ubuntu-latest
1818
outputs:
1919
changes-rust-files: ${{ steps.filter.outputs.rust-files }}
2020
steps:
2121
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
22+
with:
23+
persist-credentials: 'false'
2224
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
2325
id: filter
2426
with:

‎.github/workflows/coprocessor-gpu-tests.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,14 +23,16 @@ jobs:
2323
check-changes:
2424
name: coprocessor-gpu-tests/check-changes
2525
permissions:
26-
actions: 'read'
27-
contents: 'read'
28-
pull-requests: 'read'
26+
actions: read
27+
contents: read
28+
pull-requests: read
2929
runs-on: ubuntu-latest
3030
outputs:
3131
changes-coprocessor-gpu: ${{ steps.filter.outputs.coprocessor-gpu }}
3232
steps:
3333
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
34+
with:
35+
persist-credentials: 'false'
3436
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
3537
id: filter
3638
with:

‎.github/workflows/coprocessor-gw-listener-docker-build.yml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,16 @@ jobs:
1717
check-changes:
1818
name: coprocessor-gw-listener-docker-build/check-changes
1919
permissions:
20-
actions: 'read'
21-
contents: 'read'
22-
pull-requests: 'read'
20+
actions: read
21+
contents: read
22+
pull-requests: read
2323
runs-on: ubuntu-latest
2424
outputs:
2525
changes-coprocessor-gw-listener: ${{ steps.filter.outputs.coprocessor-gw-listener }}
2626
steps:
2727
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
with:
29+
persist-credentials: 'false'
2830
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
2931
id: filter
3032
with:
@@ -44,12 +46,12 @@ jobs:
4446
AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
4547
AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
4648
permissions:
47-
actions: 'read'
48-
contents: 'read'
49-
pull-requests: 'read'
50-
attestations: 'write'
51-
packages: 'write'
52-
id-token: 'write'
49+
actions: read
50+
contents: read
51+
pull-requests: read
52+
attestations: write
53+
packages: write
54+
id-token: write
5355
with:
5456
working-directory: "."
5557
docker-context: "."

‎.github/workflows/coprocessor-tx-sender-docker-build.yml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,16 @@ jobs:
1717
check-changes:
1818
name: coprocessor-tx-sender-docker-build/check-changes
1919
permissions:
20-
actions: 'read'
21-
contents: 'read'
22-
pull-requests: 'read'
20+
actions: read
21+
contents: read
22+
pull-requests: read
2323
runs-on: ubuntu-latest
2424
outputs:
2525
changes-coprocessor-tx-sender: ${{ steps.filter.outputs.coprocessor-tx-sender }}
2626
steps:
2727
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
with:
29+
persist-credentials: 'false'
2830
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
2931
id: filter
3032
with:
@@ -44,12 +46,12 @@ jobs:
4446
AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
4547
AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
4648
permissions:
47-
actions: 'read'
48-
contents: 'read'
49-
pull-requests: 'read'
50-
attestations: 'write'
51-
packages: 'write'
52-
id-token: 'write'
49+
actions: read
50+
contents: read
51+
pull-requests: read
52+
attestations: write
53+
packages: write
54+
id-token: write
5355
with:
5456
working-directory: "."
5557
docker-context: "."

‎.github/workflows/gateway-contracts-deployment-tests.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,16 @@ jobs:
1111
check-changes:
1212
name: gateway-contracts-deploymenent-tests/check-changes
1313
permissions:
14-
actions: 'read'
15-
contents: 'read'
16-
pull-requests: 'read'
14+
actions: read
15+
contents: read
16+
pull-requests: read
1717
runs-on: ubuntu-latest
1818
outputs:
1919
changes-gw-contracts: ${{ steps.filter.outputs.gw-contracts }}
2020
steps:
2121
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
22+
with:
23+
persist-credentials: 'false'
2224
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
2325
id: filter
2426
with:
@@ -33,7 +35,9 @@ jobs:
3335
runs-on: ubuntu-latest
3436
steps:
3537
- name: Checkout code
36-
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
38+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
39+
with:
40+
persist-credentials: 'false'
3741
- name: Set up Docker Buildx
3842
uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
3943
- name: Login to Docker Registry

‎.github/workflows/gateway-contracts-docker-build.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,16 @@ jobs:
1717
check-changes:
1818
name: gateway-contracts-docker-build/check-changes
1919
permissions:
20-
actions: 'read'
21-
contents: 'read'
22-
pull-requests: 'read'
20+
actions: read
21+
contents: read
22+
pull-requests: read
2323
runs-on: ubuntu-latest
2424
outputs:
2525
changes-gw-contracts: ${{ steps.filter.outputs.gw-contracts }}
2626
steps:
2727
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
with:
29+
persist-credentials: 'false'
2830
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
2931
id: filter
3032
with:
@@ -41,9 +43,9 @@ jobs:
4143
GHCR_ACTION_TOKEN: ${{ secrets.BLOCKCHAIN_ACTIONS_TOKEN }}
4244
GRAVITON_BUILDER_SSH_PRIVATE_KEY: ${{ secrets.GRAVITON_BUILDER_SSH_PRIVATE_KEY }}
4345
permissions:
44-
contents: "read"
45-
id-token: "write"
46-
packages: "write"
46+
contents: read
47+
id-token: write
48+
packages: write
4749
with:
4850
working-directory: "gateway-contracts"
4951
docker-context: "gateway-contracts"

0 commit comments

Comments
 (0)