Skip to content

Commit d346d34

Browse files
varunsh-codervarunsh-coder
authored
Merge pull request #2514 from step-security/shubham/main
Update: Fix secure-repo parsing & Always pin harden runner
2 parents 6fb13bc + e3269b3 commit d346d34

File tree

6 files changed

+149
-4
lines changed

6 files changed

+149
-4
lines changed

‎remediation/workflow/hardenrunner/addaction.go

+3-1
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,9 @@ func addAction(inputYaml, jobName, action string) (string, error) {
6161
return "", fmt.Errorf("unable to parse yaml %v", err)
6262
}
6363

64-
jobNode := permissions.IterateNode(&t, jobName, "!!map", 0)
64+
jobNode := permissions.IterateNode(&t, "jobs", "!!map", 0)
65+
66+
jobNode = permissions.IterateNode(&t, jobName, "!!map", jobNode.Line)
6567

6668
jobNode = permissions.IterateNode(&t, "steps", "!!seq", jobNode.Line)
6769

‎remediation/workflow/hardenrunner/addaction_test.go

+1
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ func TestAddAction(t *testing.T) {
2525
{name: "already present", args: args{inputYaml: "alreadypresent.yml", action: "step-security/harden-runner@v2"}, want: "alreadypresent.yml", wantErr: false, wantUpdated: true},
2626
{name: "already present 2", args: args{inputYaml: "alreadypresent_2.yml", action: "step-security/harden-runner@v2"}, want: "alreadypresent_2.yml", wantErr: false, wantUpdated: false},
2727
{name: "reusable job", args: args{inputYaml: "reusablejob.yml", action: "step-security/harden-runner@v2"}, want: "reusablejob.yml", wantErr: false, wantUpdated: false},
28+
{name: "job name in input", args: args{inputYaml: "jobNameInInput.yml", action: "step-security/harden-runner@v2"}, want: "jobNameInInput.yml", wantErr: false, wantUpdated: true},
2829
}
2930
for _, tt := range tests {
3031
t.Run(tt.name, func(t *testing.T) {

‎remediation/workflow/secureworkflow.go

+4-2
Original file line numberDiff line numberDiff line change
@@ -85,10 +85,12 @@ func SecureWorkflow(queryStringParams map[string]string, inputYaml string, svc d
8585
}
8686

8787
if addHardenRunner {
88+
// Always pin harden-runner unless exempted
89+
pinHardenRunner := true
8890
if pin.ActionExists(HardenRunnerActionPath, exemptedActions) {
89-
pinActions = false
91+
pinHardenRunner = false
9092
}
91-
secureWorkflowReponse.FinalOutput, addedHardenRunner, _ = hardenrunner.AddAction(secureWorkflowReponse.FinalOutput, HardenRunnerActionPathWithTag, pinActions, pinToImmutable)
93+
secureWorkflowReponse.FinalOutput, addedHardenRunner, _ = hardenrunner.AddAction(secureWorkflowReponse.FinalOutput, HardenRunnerActionPathWithTag, pinHardenRunner, pinToImmutable)
9294
}
9395

9496
// Setting appropriate flags

‎testfiles/addaction/input/jobNameInInput.yml

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: coveo-example-library
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'coveo-example-library/**'
9+
- '!**.lock'
10+
- '!**.md'
11+
12+
pull_request:
13+
types: [opened, synchronize, reopened]
14+
paths:
15+
- 'coveo-example-library/**'
16+
- '.github/workflows/coveo-example-library.yml'
17+
- '!**.md'
18+
19+
workflow_dispatch:
20+
inputs:
21+
publish:
22+
description: "Publish to pypi.org?"
23+
required: false
24+
default: 'false'
25+
26+
jobs:
27+
pyprojectci:
28+
name: pyproject ci
29+
runs-on: ${{ matrix.os }}
30+
31+
strategy:
32+
fail-fast: false
33+
matrix:
34+
python-version: ["3.8", "3.10"]
35+
os: [ubuntu-latest, windows-latest, macos-latest]
36+
37+
steps:
38+
- name: Run stew ci
39+
uses: coveo/stew@main
40+
with:
41+
project-name: ${{ github.workflow }}
42+
python-version: ${{ matrix.python-version }}
43+
poetry-version: "<2"
44+
45+
publish:
46+
name: Publish to pypi.org
47+
runs-on: ubuntu-20.04
48+
needs: pyprojectci
49+
50+
steps:
51+
- name: Checkout repository
52+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
53+
54+
- name: Setup python 3.9
55+
uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
56+
with:
57+
python-version: 3.9
58+
59+
- name: Publish to pypi
60+
uses: ./.github/workflows/actions/publish-to-pypi
61+
with:
62+
project-name: ${{ github.workflow }}
63+
pypi-token: ${{ secrets.PYPI_TOKEN_COVEO_EXAMPLE_LIBRARY }}
64+
pre-release: ${{ github.ref != 'refs/heads/main' }}
65+
dry-run: true

‎testfiles/addaction/output/jobNameInInput.yml

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: coveo-example-library
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'coveo-example-library/**'
9+
- '!**.lock'
10+
- '!**.md'
11+
12+
pull_request:
13+
types: [opened, synchronize, reopened]
14+
paths:
15+
- 'coveo-example-library/**'
16+
- '.github/workflows/coveo-example-library.yml'
17+
- '!**.md'
18+
19+
workflow_dispatch:
20+
inputs:
21+
publish:
22+
description: "Publish to pypi.org?"
23+
required: false
24+
default: 'false'
25+
26+
jobs:
27+
pyprojectci:
28+
name: pyproject ci
29+
runs-on: ${{ matrix.os }}
30+
31+
strategy:
32+
fail-fast: false
33+
matrix:
34+
python-version: ["3.8", "3.10"]
35+
os: [ubuntu-latest, windows-latest, macos-latest]
36+
37+
steps:
38+
- name: Harden the runner (Audit all outbound calls)
39+
uses: step-security/harden-runner@v2
40+
with:
41+
egress-policy: audit
42+
43+
- name: Run stew ci
44+
uses: coveo/stew@main
45+
with:
46+
project-name: ${{ github.workflow }}
47+
python-version: ${{ matrix.python-version }}
48+
poetry-version: "<2"
49+
50+
publish:
51+
name: Publish to pypi.org
52+
runs-on: ubuntu-20.04
53+
needs: pyprojectci
54+
55+
steps:
56+
- name: Harden the runner (Audit all outbound calls)
57+
uses: step-security/harden-runner@v2
58+
with:
59+
egress-policy: audit
60+
61+
- name: Checkout repository
62+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
63+
64+
- name: Setup python 3.9
65+
uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
66+
with:
67+
python-version: 3.9
68+
69+
- name: Publish to pypi
70+
uses: ./.github/workflows/actions/publish-to-pypi
71+
with:
72+
project-name: ${{ github.workflow }}
73+
pypi-token: ${{ secrets.PYPI_TOKEN_COVEO_EXAMPLE_LIBRARY }}
74+
pre-release: ${{ github.ref != 'refs/heads/main' }}
75+
dry-run: true

‎testfiles/secureworkflow/output/nopin.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
runs-on: ubuntu-latest
1616
steps:
1717
- name: Harden the runner (Audit all outbound calls)
18-
uses: step-security/harden-runner@v2
18+
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
1919
with:
2020
egress-policy: audit
2121

0 commit comments

Comments
 (0)