Skip to content

Commit ada158d

Browse files
step-security-botstep-security-bot
authored
[StepSecurity] Apply security best practices (#527)
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
1 parent 6b96039 commit ada158d

File tree

7 files changed

+223
-8
lines changed

7 files changed

+223
-8
lines changed

‎.github/dependabot.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,99 @@ updates:
1010
reviewers:
1111
- "microsoft/clr-instrumentation-engine-owners"
1212
target-branch: "main"
13+
14+
15+
- package-ecosystem: nuget
16+
directory: /src/Dependencies
17+
schedule:
18+
interval: daily
19+
20+
- package-ecosystem: nuget
21+
directory: /src/Extensions.Base.Api.Tests
22+
schedule:
23+
interval: daily
24+
25+
- package-ecosystem: nuget
26+
directory: /src/Extensions.Base.Api
27+
schedule:
28+
interval: daily
29+
30+
- package-ecosystem: nuget
31+
directory: /src/InstrumentationEngine.Attach
32+
schedule:
33+
interval: daily
34+
35+
- package-ecosystem: nuget
36+
directory: /src/InstrumentationEngine.Installer.NuGet/Module
37+
schedule:
38+
interval: daily
39+
40+
- package-ecosystem: nuget
41+
directory: /src/InstrumentationEngine.NuGet.Headers
42+
schedule:
43+
interval: daily
44+
45+
- package-ecosystem: nuget
46+
directory: /src/InstrumentationEngine.NuGet
47+
schedule:
48+
interval: daily
49+
50+
- package-ecosystem: nuget
51+
directory: /src/InstrumentationEngine.SiteExtension
52+
schedule:
53+
interval: daily
54+
55+
- package-ecosystem: nuget
56+
directory: /src/InstrumentationEngine.XdtExtensions
57+
schedule:
58+
interval: daily
59+
60+
- package-ecosystem: nuget
61+
directory: /src/Tests/InstrEngineTests/InstrEngineTests
62+
schedule:
63+
interval: daily
64+
65+
- package-ecosystem: nuget
66+
directory: /src/Tests/InstrEngineTests/TestAppRunner
67+
schedule:
68+
interval: daily
69+
70+
- package-ecosystem: nuget
71+
directory: /src/Tests/RemoteUnitTestExecutor.Host
72+
schedule:
73+
interval: daily
74+
75+
- package-ecosystem: nuget
76+
directory: /src/Tests/RemoteUnitTestExecutor
77+
schedule:
78+
interval: daily
79+
80+
- package-ecosystem: nuget
81+
directory: /src/unix/dependencies
82+
schedule:
83+
interval: daily
84+
85+
- package-ecosystem: docker
86+
directory: /src/unix/docker/dockerfiles/build/alpine
87+
schedule:
88+
interval: daily
89+
90+
- package-ecosystem: docker
91+
directory: /src/unix/docker/dockerfiles/build/ubuntu
92+
schedule:
93+
interval: daily
94+
95+
- package-ecosystem: nuget
96+
directory: /tests/ApplicationInsightsCompatibility/Intercept.2.0.1.Tests
97+
schedule:
98+
interval: daily
99+
100+
- package-ecosystem: nuget
101+
directory: /tests/ApplicationInsightsCompatibility/Intercept.Latest.Tests
102+
schedule:
103+
interval: daily
104+
105+
- package-ecosystem: nuget
106+
directory: /tests/RawProfilerHook/RawProfilerHook.Tests
107+
schedule:
108+
interval: daily

‎.github/workflows/build.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ name: build
55

66
on: [push]
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
build:
1013
strategy:
@@ -18,9 +21,14 @@ jobs:
1821
runs-on: ${{ matrix.os }}
1922

2023
steps:
21-
- uses: actions/checkout@v3
24+
- name: Harden Runner
25+
uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v2.2.1
26+
with:
27+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
28+
29+
- uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
2230

23-
- uses: actions/cache@v3
31+
- uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
2432
with:
2533
path: out/packages
2634
key: nuget
@@ -29,14 +37,14 @@ jobs:
2937

3038
- name: archive so
3139
if: matrix.os == 'ubuntu-latest'
32-
uses: actions/upload-artifact@v3
40+
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
3341
with:
3442
name: libInstrumentationEngine.so
3543
path: out/Linux/bin/x64.Release/ClrInstrumentationEngine/libInstrumentationEngine.so
3644

3745
- name: archive dylib
3846
if: matrix.os == 'macos-latest'
39-
uses: actions/upload-artifact@v3
47+
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
4048
with:
4149
name: libInstrumentationEngine.dylib
4250
path: out/OSX/bin/x64.Release/ClrInstrumentationEngine/libInstrumentationEngine.dylib

‎.github/workflows/dependency-review.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Harden Runner
20+
uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v2.2.1
21+
with:
22+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
23+
24+
- name: 'Checkout Repository'
25+
uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
26+
- name: 'Dependency Review'
27+
uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1

‎.github/workflows/markdown-link-check.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,20 @@ on:
88
branches:
99
- main
1010

11+
permissions:
12+
contents: read
13+
1114
jobs:
1215
markdown-link-check:
1316
runs-on: ubuntu-latest
1417
steps:
15-
- uses: actions/checkout@v3
16-
- uses: gaurav-nelson/github-action-markdown-link-check@v1
18+
- name: Harden Runner
19+
uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v2.2.1
20+
with:
21+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
22+
23+
- uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
24+
- uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1
1725
with:
1826
config-file: .github/linters/check_links_config.json
1927
use-quiet-mode: 'yes'

‎.github/workflows/scorecards.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# This workflow uses actions that are not certified by GitHub. They are provided
2+
# by a third-party and are governed by separate terms of service, privacy
3+
# policy, and support documentation.
4+
5+
name: Scorecard supply-chain security
6+
on:
7+
# For Branch-Protection check. Only the default branch is supported. See
8+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
9+
branch_protection_rule:
10+
# To guarantee Maintained check is occasionally updated. See
11+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
12+
schedule:
13+
- cron: '20 7 * * 2'
14+
push:
15+
branches: ["main"]
16+
17+
# Declare default permissions as read only.
18+
permissions: read-all
19+
20+
jobs:
21+
analysis:
22+
name: Scorecard analysis
23+
runs-on: ubuntu-latest
24+
permissions:
25+
# Needed to upload the results to code-scanning dashboard.
26+
security-events: write
27+
# Needed to publish results and get a badge (see publish_results below).
28+
id-token: write
29+
contents: read
30+
actions: read
31+
32+
steps:
33+
- name: Harden Runner
34+
uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v2.2.1
35+
with:
36+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
37+
38+
- name: "Checkout code"
39+
uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
40+
with:
41+
persist-credentials: false
42+
43+
- name: "Run analysis"
44+
uses: ossf/scorecard-action@99c53751e09b9529366343771cc321ec74e9bd3d # v2.0.6
45+
with:
46+
results_file: results.sarif
47+
results_format: sarif
48+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
49+
# - you want to enable the Branch-Protection check on a *public* repository, or
50+
# - you are installing Scorecards on a *private* repository
51+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
52+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
53+
54+
# Public repositories:
55+
# - Publish results to OpenSSF REST API for easy access by consumers
56+
# - Allows the repository to include the Scorecard badge.
57+
# - See https://github.com/ossf/scorecard-action#publishing-results.
58+
# For private repositories:
59+
# - `publish_results` will always be set to `false`, regardless
60+
# of the value entered here.
61+
publish_results: true
62+
63+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
64+
# format to the repository Actions tab.
65+
- name: "Upload artifact"
66+
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
67+
with:
68+
name: SARIF file
69+
path: results.sarif
70+
retention-days: 5
71+
72+
# Upload the results to GitHub's code scanning dashboard.
73+
- name: "Upload to code-scanning"
74+
uses: github/codeql-action/upload-sarif@67a35a08586135a9573f4327e904ecbf517a882d # v2.2.8
75+
with:
76+
sarif_file: results.sarif

‎src/unix/docker/dockerfiles/build/alpine/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Copyright (c) Microsoft Corporation. All rights reserved.
22
# Licensed under the MIT License.
33

4-
FROM mcr.microsoft.com/dotnet-buildtools/prereqs:alpine-3.13-20211214164113-8a6f4f3
4+
FROM mcr.microsoft.com/dotnet-buildtools/prereqs:alpine-3.13-20211214164113-8a6f4f3@sha256:5ee23bef02e18237d1874a4f530e0b7d12ca803af87b2516717565f90540c25c
55

66
WORKDIR /
77

‎src/unix/docker/dockerfiles/build/ubuntu/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Licensed under the MIT License.
33

44
# This image is based on the public Ubuntu 18.04 LTS image
5-
FROM mcr.microsoft.com/mirror/docker/library/ubuntu:18.04
5+
FROM mcr.microsoft.com/mirror/docker/library/ubuntu:18.04@sha256:8aa9c2798215f99544d1ce7439ea9c3a6dfd82de607da1cec3a8a2fae005931b
66

77
RUN apt-get update \
88
&& apt-get install -y --no-install-recommends \

0 commit comments

Comments
 (0)