ci: GitHub Actions hardening (Security audit remediation) #345
+147
−92
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Enables automated dependency updates for GitHub Actions to ensure workflows use secure, up-to-date action versions. Updates will be grouped and checked monthly on Wednesdays at 09:00 Stockholm time.
CodeQL auto-detects languages from the repository. The explicit languages: csharp specification is no longer needed and was flagged as stale configuration by CodeQL. ci: enable CodeQL scanning for GitHub Actions workflows Adds workflow YAML files to CodeQL analysis triggers to scan for security issues in GitHub Actions workflows, including hardcoded secrets, injection vulnerabilities, and other action-specific risks.
Replaces manual dotnet nuget add source with --store-password-in-clear-text flag with secure actions/setup-dotnet configuration using NUGET_AUTH_TOKEN environment variable. Credentials are now handled securely without writing to disk in clear text. security: remove clear-text password storage in PR build workflow Removes manual dotnet nuget add source with --store-password-in-clear-text and configures source-url in setup-dotnet action with secure NUGET_AUTH_TOKEN environment variable instead. security: remove clear-text password storage in build workflow Removes all instances of dotnet nuget add source with --store-password-in-clear-text flag. Configures source-url in setup-dotnet action with secure NUGET_AUTH_TOKEN environment variable for both build and publish operations.
Combines nested if conditions into single logical AND expression for improved readability and reduced cognitive load. Behavior remains unchanged - validates ECC parameters are either P256 or P384.
Upgraded GitHub Actions to latest verified versions across workflows, ensuring enhanced security and compatibility.
DennisDyallo
changed the title
Contributor
Test Results: Windows 2 files 2 suites 16s ⏱️ Results for commit e0203d1. ♻️ This comment has been updated with latest results. |
DennisDyallo
changed the title
Contributor
Test Results: Ubuntu 2 files 2 suites 50s ⏱️ Results for commit e0203d1. ♻️ This comment has been updated with latest results. |
Contributor
Test Results: MacOS 4 files 4 suites 30s ⏱️ Results for commit e0203d1. ♻️ This comment has been updated with latest results. |
Overrides automatic language detection in CodeQL workflow to analyze only C#. Excludes C/C++ code requiring separate build configurations.
Contributor
Minimum allowed line rate is |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR implements critical and high-priority security findings from the GitHub Actions security audit.
Findings addressed
Security hardening
Pin GitHub Actions by SHA Hash
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0All Actions Pinned (9 Official + 5 Third-Party)
Official GitHub Actions:
08c6903cd8c0fde910a37f88322edcfb5dd907a867a3573c9a986a3f9c594539f4ab511d57bb3ce9ea165f8d65b6e75b540449e92b4886f43607fa02d3f86a106a0bac45b974a628896c90dbdf5c8093e8998f949152b193b063cb0ec769d69d929409be7bfa3a4717ef143a604ee0a99d859b8886a96d005d5cd550d3e189c569da8f16ea8de2d821c9bf7a5d5cd550d3e189c569da8f16ea8de2d821c9bf7ac200f3691d83b41bf9bbd8638997a462592937edThird-party actions:
b6b711c5bc739d4aff5cada3c89016d7a63a60e33e39bd1b454c2bac14560547e4394f931767270530eadd5010312f995f0d3b3cff7fe2984f69409e51cc3a756ddcd398d447c044c02cb6aa83fdae95331f8f5b4215f0445d3c07b4967662a32a2d3e31Remove Clear-Text password storage
--store-password-in-clear-textflags from NuGet operations.github/workflows/codeql-analysis.yml(line 66-68)NUGET_AUTH_TOKENenvironment variable exclusivelyDisable credential persistence in checkout actions (MEDIUM → COMPLETE)
persist-credentials: falseto all 16actions/checkoutinvocationsSecurity configuration & monitoring
Add GitHub Actions to Dependabot Configuration (MEDIUM → COMPLETE)
github-actionsecosystem to.github/dependabot.ymlRemove stale CodeQL configuration
languages: csharpspecification (auto-detected by CodeQL).github/workflows/codeql-analysis.ymlCode quality improvements
Simplify nested if statements
KeyConverter.csYubico.YubiKey/examples/PivSampleCode/Converters/KeyConverter.csSecurity impact summary
Files Changed (13 files)
Workflow Files (12):
Configuration Files (1):
Source Files (1):
Testing & Validation
Workflow testing:
git ls-remoteCode testing:
Automated maintenance
Dependabot will now:
Statistics
persist-credentials: false