Skip to content

Commit a9f2ba0

Browse files
varunsh-codervarunsh-coder
authored
Release v1.3.2 (#2095)
1 parent d8f79f0 commit a9f2ba0

22 files changed

+169
-13
lines changed

Diff for: ‎.github/workflows/codeql.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ jobs:
4343
- name: Harden Runner
4444
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5
4545
with:
46-
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
46+
egress-policy: audit
4747

4848
- name: Checkout repository
4949
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b

Diff for: ‎.github/workflows/kbanalysis.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
- name: Harden Runner
2525
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5
2626
with:
27-
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
27+
egress-policy: audit
2828

2929
- uses: actions/checkout@d0651293c4a5a52e711f25b41b05b2212f385d28
3030
with:

Diff for: ‎remediation/workflow/hardenrunner/addaction.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ func addAction(inputYaml, jobName, action string) (string, error) {
8383
output = append(output, spaces+fmt.Sprintf("- name: %s", HardenRunnerActionName))
8484
output = append(output, spaces+fmt.Sprintf(" uses: %s", action))
8585
output = append(output, spaces+" with:")
86-
output = append(output, spaces+" egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs")
86+
output = append(output, spaces+" egress-policy: audit")
8787
output = append(output, "")
8888

8989
for i := jobNode.Line - 1; i < len(inputLines); i++ {

Diff for: ‎remediation/workflow/permissions/permissions.go

+3
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,9 @@ func AddWorkflowLevelPermissions(inputYaml string, addProjectComment bool) (stri
101101
line := 0
102102
column := 0
103103
topNode := t.Content
104+
if len(topNode) == 0 {
105+
return inputYaml, fmt.Errorf("Workflow file provided is Empty")
106+
}
104107
for _, n := range topNode[0].Content {
105108
if n.Value == "jobs" && n.Tag == "!!str" {
106109
line = n.Line

Diff for: ‎remediation/workflow/pin/pinactions.go

+28
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,34 @@ func PinAction(action, inputYaml string) (string, bool) {
7676
pinnedAction := fmt.Sprintf("%s@%s # %s", leftOfAt[0], commitSHA, tagOrBranch)
7777
updated = !strings.EqualFold(action, pinnedAction)
7878
inputYaml = strings.ReplaceAll(inputYaml, action, pinnedAction)
79+
yamlWithPreviousActionCommentsRemoved, wasModified := removePreviousActionComments(pinnedAction, inputYaml)
80+
if wasModified {
81+
return yamlWithPreviousActionCommentsRemoved, updated
82+
}
83+
return inputYaml, updated
84+
}
85+
86+
// It may be that there was already a comment next to the action
87+
// In this case we want to remove the earlier comment
88+
// we add a comment with the Action version so dependabot/ renovatebot can update it
89+
// if there was no comment next to any action, updated will be false
90+
func removePreviousActionComments(pinnedAction, inputYaml string) (string, bool) {
91+
updated := false
92+
stringParts := strings.Split(inputYaml, pinnedAction)
93+
if len(stringParts) > 1 {
94+
inputYaml = ""
95+
inputYaml = stringParts[0]
96+
for idx := 1; idx < len(stringParts); idx++ {
97+
trimmedString := strings.SplitN(stringParts[idx], "\n", 2)
98+
if len(trimmedString) > 1 {
99+
if strings.Contains(trimmedString[0], "#") {
100+
updated = true
101+
}
102+
inputYaml = inputYaml + pinnedAction + "\n" + trimmedString[1]
103+
}
104+
}
105+
}
106+
79107
return inputYaml, updated
80108
}
81109

Diff for: ‎remediation/workflow/pin/pinactions_test.go

+2
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,8 @@ func TestPinActions(t *testing.T) {
182182
{fileName: "basic.yml", wantUpdated: true},
183183
{fileName: "dockeraction.yml", wantUpdated: true},
184184
{fileName: "multipleactions.yml", wantUpdated: true},
185+
{fileName: "actionwithcomment.yml", wantUpdated: true},
186+
{fileName: "repeatedactionwithcomment.yml", wantUpdated: true},
185187
}
186188
for _, tt := range tests {
187189
input, err := ioutil.ReadFile(path.Join(inputDirectory, tt.fileName))

Diff for: ‎remediation/workflow/secureworkflow_test.go

+1
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ func TestSecureWorkflow(t *testing.T) {
120120
{fileName: "nopin.yml", wantPinnedActions: false, wantAddedHardenRunner: true, wantAddedPermissions: true},
121121
{fileName: "allperms.yml", wantPinnedActions: false, wantAddedHardenRunner: false, wantAddedPermissions: true},
122122
{fileName: "multiplejobperms.yml", wantPinnedActions: false, wantAddedHardenRunner: false, wantAddedPermissions: true},
123+
{fileName: "error.yml", wantPinnedActions: false, wantAddedHardenRunner: false, wantAddedPermissions: false},
123124
}
124125
for _, test := range tests {
125126
input, err := ioutil.ReadFile(path.Join(inputDirectory, test.fileName))

Diff for: ‎testfiles/addaction/input/alreadypresent_2.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,6 @@ jobs:
1313
- name: Harden Runner
1414
uses: step-security/harden-runner@v2
1515
with:
16-
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
16+
egress-policy: audit
1717

1818
- run: ls -R

Diff for: ‎testfiles/addaction/output/2jobs.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ jobs:
88
- name: Harden Runner
99
uses: step-security/harden-runner@v2
1010
with:
11-
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
11+
egress-policy: audit
1212

1313
- run: ls -R
1414
list-directory1:
@@ -17,6 +17,6 @@ jobs:
1717
- name: Harden Runner
1818
uses: step-security/harden-runner@v2
1919
with:
20-
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
20+
egress-policy: audit
2121

2222
- run: ls -R

Diff for: ‎testfiles/addaction/output/action-issues.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
- name: Harden Runner
1313
uses: step-security/harden-runner@v2
1414
with:
15-
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
15+
egress-policy: audit
1616

1717
- name: Close Issue
1818
uses: peter-evans/close-issue@v1

Diff for: ‎testfiles/addaction/output/alreadypresent.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,6 @@ jobs:
1313
- name: Harden Runner
1414
uses: step-security/harden-runner@v2
1515
with:
16-
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
16+
egress-policy: audit
1717

1818
- run: ls -R

Diff for: ‎testfiles/addaction/output/alreadypresent_2.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,6 @@ jobs:
1313
- name: Harden Runner
1414
uses: step-security/harden-runner@v2
1515
with:
16-
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
16+
egress-policy: audit
1717

1818
- run: ls -R

Diff for: ‎testfiles/pinactions/input/actionwithcomment.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: "close issue"
2+
3+
on:
4+
push:
5+
6+
jobs:
7+
closeissue:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- name: Close Issue
12+
uses: peter-evans/close-issue@v1 #Mock comment to remove
13+
with:
14+
issue-number: 1
15+
comment: Auto-closing issue
16+
publish:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- uses: actions/checkout@v1 #Mock Comment
20+
- uses: actions/setup-node@v1 #Mock Comment
21+
with:
22+
node-version: 10
23+
- run: npm install
24+
- run: npm test
25+
- uses: JS-DevTools/npm-publish@v1 #Mock Comment
26+
with:
27+
token: ${{ secrets.GITHUB_TOKEN }}
28+
registry: https://npm.pkg.github.com

Diff for: ‎testfiles/pinactions/input/repeatedactionwithcomment.yml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: "close issue"
2+
3+
on:
4+
push:
5+
6+
jobs:
7+
closeissue:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- name: Close Issue
12+
uses: peter-evans/close-issue@v1 #Mock comment to remove
13+
with:
14+
issue-number: 1
15+
comment: Auto-closing issue
16+
publish:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- uses: actions/checkout@v1 #Mock Comment
20+
- uses: actions/setup-node@v1 #Mock Comment
21+
with:
22+
node-version: 10
23+
- run: npm install
24+
- run: npm test
25+
- uses: JS-DevTools/npm-publish@v1 #Mock Comment
26+
with:
27+
token: ${{ secrets.GITHUB_TOKEN }}
28+
registry: https://npm.pkg.github.com
29+
- name: Close Issue
30+
uses: peter-evans/close-issue@v1 #Mock comment to remove
31+
with:
32+
issue-number: 1
33+
comment: Auto-closing issue

Diff for: ‎testfiles/pinactions/output/actionwithcomment.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: "close issue"
2+
3+
on:
4+
push:
5+
6+
jobs:
7+
closeissue:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- name: Close Issue
12+
uses: peter-evans/close-issue@a700eac5bf2a1c7a8cb6da0c13f93ed96fd53dbe # v1.0.3
13+
with:
14+
issue-number: 1
15+
comment: Auto-closing issue
16+
publish:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- uses: actions/checkout@544eadc6bf3d226fd7a7a9f0dc5b5bf7ca0675b9 # v1.2.0
20+
- uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6
21+
with:
22+
node-version: 10
23+
- run: npm install
24+
- run: npm test
25+
- uses: JS-DevTools/npm-publish@0f451a94170d1699fd50710966d48fb26194d939 # v1.4.3
26+
with:
27+
token: ${{ secrets.GITHUB_TOKEN }}
28+
registry: https://npm.pkg.github.com

Diff for: ‎testfiles/pinactions/output/repeatedactionwithcomment.yml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: "close issue"
2+
3+
on:
4+
push:
5+
6+
jobs:
7+
closeissue:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- name: Close Issue
12+
uses: peter-evans/close-issue@a700eac5bf2a1c7a8cb6da0c13f93ed96fd53dbe # v1.0.3
13+
with:
14+
issue-number: 1
15+
comment: Auto-closing issue
16+
publish:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- uses: actions/checkout@544eadc6bf3d226fd7a7a9f0dc5b5bf7ca0675b9 # v1.2.0
20+
- uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6
21+
with:
22+
node-version: 10
23+
- run: npm install
24+
- run: npm test
25+
- uses: JS-DevTools/npm-publish@0f451a94170d1699fd50710966d48fb26194d939 # v1.4.3
26+
with:
27+
token: ${{ secrets.GITHUB_TOKEN }}
28+
registry: https://npm.pkg.github.com
29+
- name: Close Issue
30+
uses: peter-evans/close-issue@a700eac5bf2a1c7a8cb6da0c13f93ed96fd53dbe # v1.0.3
31+
with:
32+
issue-number: 1
33+
comment: Auto-closing issue

Diff for: ‎testfiles/secureworkflow/input/error.yml

Whitespace-only changes.

Diff for: ‎testfiles/secureworkflow/output/allscenarios.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
- name: Harden Runner
1818
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
1919
with:
20-
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
20+
egress-policy: audit
2121

2222
- uses: actions/checkout@544eadc6bf3d226fd7a7a9f0dc5b5bf7ca0675b9 # v1.2.0
2323
- uses: github/super-linter@34b2f8032d759425f6b42ea2e52231b33ae05401 # v3.17.1

Diff for: ‎testfiles/secureworkflow/output/error.yml

Whitespace-only changes.

Diff for: ‎testfiles/secureworkflow/output/missingaction.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
- name: Harden Runner
1212
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
1313
with:
14-
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
14+
egress-policy: audit
1515

1616
- uses: actions/missingaction@v2
1717
- uses: github/super-linter@34b2f8032d759425f6b42ea2e52231b33ae05401 # v3.17.1

Diff for: ‎testfiles/secureworkflow/output/noperms.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
- name: Harden Runner
1212
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
1313
with:
14-
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
14+
egress-policy: audit
1515

1616
- uses: actions/checkout@544eadc6bf3d226fd7a7a9f0dc5b5bf7ca0675b9 # v1.2.0
1717
- uses: github/super-linter@34b2f8032d759425f6b42ea2e52231b33ae05401 # v3.17.1

Diff for: ‎testfiles/secureworkflow/output/nopin.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
- name: Harden Runner
1818
uses: step-security/harden-runner@v2
1919
with:
20-
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
20+
egress-policy: audit
2121

2222
- uses: actions/checkout@v1
2323
- uses: github/super-linter@v3

0 commit comments

Comments
 (0)