Skip to content

Commit 78f8d9c

Browse files
step-security-botstep-security-bot
authored
[StepSecurity] ci: Harden GitHub Actions (#1756)
Signed-off-by: StepSecurity Bot <[email protected]>
1 parent 65d4665 commit 78f8d9c

File tree

5 files changed

+95
-0
lines changed

5 files changed

+95
-0
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,11 @@ jobs:
3737
runs-on: [ubuntu-22.04]
3838
timeout-minutes: 10
3939
steps:
40+
- name: Harden the runner (Audit all outbound calls)
41+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
42+
with:
43+
egress-policy: audit
44+
4045
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4146
- name: Run scan
4247
run: |
@@ -47,6 +52,11 @@ jobs:
4752
runs-on: [ubuntu-22.04]
4853
timeout-minutes: 10
4954
steps:
55+
- name: Harden the runner (Audit all outbound calls)
56+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
57+
with:
58+
egress-policy: audit
59+
5060
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5161
- name: Run scan
5262
run: |
@@ -62,6 +72,11 @@ jobs:
6272
runs-on: [ubuntu-latest]
6373
timeout-minutes: 10
6474
steps:
75+
- name: Harden the runner (Audit all outbound calls)
76+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
77+
with:
78+
egress-policy: audit
79+
6580
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6681
- name: Install prerequisites
6782
run: |
@@ -89,6 +104,11 @@ jobs:
89104
runs-on: ubuntu-latest
90105
needs: [documentation]
91106
steps:
107+
- name: Harden the runner (Audit all outbound calls)
108+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
109+
with:
110+
egress-policy: audit
111+
92112
- name: Checkout gh-pages
93113
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
94114
with:
@@ -117,6 +137,11 @@ jobs:
117137
if: ${{ github.ref != 'refs/heads/master' }}
118138
runs-on: [ubuntu-latest]
119139
steps:
140+
- name: Harden the runner (Audit all outbound calls)
141+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
142+
with:
143+
egress-policy: audit
144+
120145
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
121146
with:
122147
fetch-depth: 0
@@ -137,6 +162,11 @@ jobs:
137162
runs-on: [ubuntu-latest]
138163
timeout-minutes: 15
139164
steps:
165+
- name: Harden the runner (Audit all outbound calls)
166+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
167+
with:
168+
egress-policy: audit
169+
140170
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
141171
- name: Run testing
142172
run: |
@@ -185,6 +215,11 @@ jobs:
185215
preview: 'ON'
186216
cmake_static: -DBUILD_SHARED_LIBS=OFF
187217
steps:
218+
- name: Harden the runner (Audit all outbound calls)
219+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
220+
with:
221+
egress-policy: audit
222+
188223
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
189224
- name: Run testing
190225
shell: bash
@@ -224,6 +259,11 @@ jobs:
224259
preview: 'ON'
225260
cmake_static: -DBUILD_SHARED_LIBS=OFF
226261
steps:
262+
- name: Harden the runner (Audit all outbound calls)
263+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
264+
with:
265+
egress-policy: audit
266+
227267
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
228268
- name: Run testing
229269
shell: bash
@@ -269,6 +309,11 @@ jobs:
269309
preview: 'OFF'
270310
job_name: windows_cl2022_cxx17_relwithdebinfo_preview=OFF
271311
steps:
312+
- name: Harden the runner (Audit all outbound calls)
313+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
314+
with:
315+
egress-policy: audit
316+
272317
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
273318
- name: Run testing
274319
run: |
@@ -307,6 +352,11 @@ jobs:
307352
build_type: debug
308353
preview: 'ON'
309354
steps:
355+
- name: Harden the runner (Audit all outbound calls)
356+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
357+
with:
358+
egress-policy: audit
359+
310360
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
311361
- name: Run testing
312362
shell: bash
@@ -333,6 +383,11 @@ jobs:
333383
build_type: relwithdebinfo
334384
preview: 'ON'
335385
steps:
386+
- name: Harden the runner (Audit all outbound calls)
387+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
388+
with:
389+
egress-policy: audit
390+
336391
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
337392
- name: Run testing
338393
shell: bash
@@ -369,6 +424,11 @@ jobs:
369424
preview: 'OFF'
370425
job_name: examples_windows_cl2022_cxx17_relwithdebinfo_preview=OFF
371426
steps:
427+
- name: Harden the runner (Audit all outbound calls)
428+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
429+
with:
430+
egress-policy: audit
431+
372432
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
373433
- name: Run testing
374434
run: |
@@ -393,6 +453,11 @@ jobs:
393453
std: 20
394454
build_type: relwithdebinfo
395455
steps:
456+
- name: Harden the runner (Audit all outbound calls)
457+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
458+
with:
459+
egress-policy: audit
460+
396461
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
397462
- name: Test doc examples
398463
run: |
@@ -418,6 +483,11 @@ jobs:
418483
std: 20
419484
build_type: relwithdebinfo
420485
steps:
486+
- name: Harden the runner (Audit all outbound calls)
487+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
488+
with:
489+
egress-policy: audit
490+
421491
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
422492
- name: Test doc examples
423493
run: |

‎.github/workflows/coverity.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,11 @@ jobs:
3232
if: github.repository == 'uxlfoundation/oneTBB'
3333
runs-on: [ubuntu-latest]
3434
steps:
35+
- name: Harden the runner (Audit all outbound calls)
36+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
37+
with:
38+
egress-policy: audit
39+
3540
- uses: actions/checkout@v4
3641
- name: Download Linux 64 Coverity Tool
3742
run: |
@@ -65,6 +70,11 @@ jobs:
6570
if: github.repository == 'uxlfoundation/oneTBB'
6671
runs-on: [windows-latest]
6772
steps:
73+
- name: Harden the runner (Audit all outbound calls)
74+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
75+
with:
76+
egress-policy: audit
77+
6878
- uses: actions/checkout@v4
6979
- name: Download Windows 64 Coverity Tool
7080
run: |

‎.github/workflows/issue_labeler.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,11 @@ jobs:
2929
issues: write
3030
contents: read
3131
steps:
32+
- name: Harden the runner (Audit all outbound calls)
33+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
34+
with:
35+
egress-policy: audit
36+
3237
- uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4
3338
with:
3439
repo-token: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/labeler.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,11 @@ jobs:
2424
pull-requests: write
2525
runs-on: ubuntu-latest
2626
steps:
27+
- name: Harden the runner (Audit all outbound calls)
28+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
29+
with:
30+
egress-policy: audit
31+
2732
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2833
- uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
2934
with:

‎.github/workflows/ossf-scorecard.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,11 @@ jobs:
4141
# actions: read
4242

4343
steps:
44+
- name: Harden the runner (Audit all outbound calls)
45+
uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
46+
with:
47+
egress-policy: audit
48+
4449
- name: "Checkout code"
4550
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
4651
with:

0 commit comments

Comments
 (0)