Skip to content

Commit 1dc5a19

Browse files
heitorlessaheitorlessa
authored
chore(ci): lockdown 3rd party workflows to pin sha (#1301)
* chore(ci): enforce 3rd party workflows to use sha * fix(ci): pin 3rd party workflows * chore(ci): upgrade checkout@v2 to @V3
1 parent b28c7a9 commit 1dc5a19

8 files changed

+71
-44
lines changed

Diff for: ‎.github/workflows/publish.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -93,14 +93,14 @@ jobs:
9393
make release-docs VERSION=${RELEASE_TAG_VERSION} ALIAS="latest"
9494
poetry run mike set-default --push latest
9595
- name: Release API docs to release version
96-
uses: peaceiris/actions-gh-pages@v3
96+
uses: peaceiris/actions-gh-pages@068dc23d9710f1ba62e86896f84735d869951305 # v3.8.0
9797
with:
9898
github_token: ${{ secrets.GITHUB_TOKEN }}
9999
publish_dir: ./api
100100
keep_files: true
101101
destination_dir: ${{ env.RELEASE_TAG_VERSION }}/api
102102
- name: Release API docs to latest
103-
uses: peaceiris/actions-gh-pages@v3
103+
uses: peaceiris/actions-gh-pages@068dc23d9710f1ba62e86896f84735d869951305 # v3.8.0
104104
with:
105105
github_token: ${{ secrets.GITHUB_TOKEN }}
106106
publish_dir: ./api

Diff for: ‎.github/workflows/publish_layer.yml

+5-6
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,10 @@ on:
1212
default: "v1.22.0"
1313
required: true
1414
workflow_run:
15-
workflows: [ "Publish to PyPi" ]
15+
workflows: ["Publish to PyPi"]
1616
types:
1717
- completed
1818

19-
2019
jobs:
2120
build-layer:
2221
runs-on: ubuntu-latest
@@ -25,16 +24,16 @@ jobs:
2524
working-directory: ./layer
2625
steps:
2726
- name: checkout
28-
uses: actions/checkout@v2
27+
uses: actions/checkout@v3
2928
- name: Setup Node.js
3029
uses: actions/setup-node@v3
3130
with:
32-
node-version: '16.12'
31+
node-version: "16.12"
3332
- name: Setup python
3433
uses: actions/setup-python@v4
3534
with:
36-
python-version: '3.9'
37-
cache: 'pip'
35+
python-version: "3.9"
36+
cache: "pip"
3837
- name: Set release notes tag
3938
run: |
4039
RELEASE_INPUT=${{ inputs.latest_published_version }}

Diff for: ‎.github/workflows/python_build.yml

+1-2
Original file line numberDiff line numberDiff line change
@@ -49,11 +49,10 @@ jobs:
4949
- name: Complexity baseline
5050
run: make complexity-baseline
5151
- name: Upload coverage to Codecov
52-
uses: codecov/codecov-action@v3.1.0
52+
uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # 3.1.0
5353
with:
5454
file: ./coverage.xml
5555
# flags: unittests
5656
env_vars: OS,PYTHON
5757
name: aws-lambda-powertools-python-codecov
5858
# fail_ci_if_error: true # failing more consistently making CI unreliable despite all tests above passing
59-
token: ${{ secrets.CODECOV_TOKEN }}

Diff for: ‎.github/workflows/python_docs.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
python-version: "3.8"
2828
# Maintenance: temporarily until we drop Python 3.6 and make cfn-lint a dev dependency
2929
- name: Setup Cloud Formation Linter with Latest Version
30-
uses: scottbrenner/cfn-lint-action@v2
30+
uses: scottbrenner/cfn-lint-action@ee9ee62016ef62c5fd366e6be920df4b310ed353 # v2.2.4
3131
- name: Install dependencies
3232
run: make dev
3333
- name: Lint documentation
@@ -41,7 +41,7 @@ jobs:
4141
- name: Build docs website and API reference
4242
run: make release-docs VERSION="develop" ALIAS="stage"
4343
- name: Deploy all docs
44-
uses: peaceiris/actions-gh-pages@v3
44+
uses: peaceiris/actions-gh-pages@068dc23d9710f1ba62e86896f84735d869951305 # v3.8.0
4545
with:
4646
github_token: ${{ secrets.GITHUB_TOKEN }}
4747
publish_dir: ./api

Diff for: ‎.github/workflows/rebuild_latest_docs.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,14 @@ jobs:
4949
make release-docs VERSION=${RELEASE_TAG_VERSION} ALIAS="latest"
5050
poetry run mike set-default --push latest
5151
- name: Release API docs to release version
52-
uses: peaceiris/actions-gh-pages@v3
52+
uses: peaceiris/actions-gh-pages@068dc23d9710f1ba62e86896f84735d869951305 # v3.8.0
5353
with:
5454
github_token: ${{ secrets.GITHUB_TOKEN }}
5555
publish_dir: ./api
5656
keep_files: true
5757
destination_dir: ${{ env.RELEASE_TAG_VERSION }}/api
5858
- name: Release API docs to latest
59-
uses: peaceiris/actions-gh-pages@v3
59+
uses: peaceiris/actions-gh-pages@068dc23d9710f1ba62e86896f84735d869951305 # v3.8.0
6060
with:
6161
github_token: ${{ secrets.GITHUB_TOKEN }}
6262
publish_dir: ./api

Diff for: ‎.github/workflows/release-drafter.yml

+1-2
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ name: Release Drafter
22

33
on:
44
push:
5-
# branches to consider in the event; optional, defaults to all
65
branches:
76
- develop
87
workflow_dispatch:
@@ -11,6 +10,6 @@ jobs:
1110
update_release_draft:
1211
runs-on: ubuntu-latest
1312
steps:
14-
- uses: release-drafter/release-drafter@v5
13+
- uses: release-drafter/release-drafter@ac463ffd9cc4c6ad5682af93dc3e3591c4657ee3 # v5.20.0
1514
env:
1615
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Diff for: ‎.github/workflows/reusable_deploy_layer_stack.yml

+26-28
Original file line numberDiff line numberDiff line change
@@ -26,33 +26,31 @@ jobs:
2626
strategy:
2727
fail-fast: false
2828
matrix:
29-
region: [
30-
"af-south-1",
31-
# "eu-central-1",
32-
# "us-east-1",
33-
# "us-east-2",
34-
# "us-west-1",
35-
# "us-west-2",
36-
# "ap-east-1",
37-
# "ap-south-1",
38-
# "ap-northeast-1",
39-
# "ap-northeast-2",
40-
# "ap-southeast-1",
41-
# "ap-southeast-2",
42-
# "ca-central-1",
43-
# "eu-west-1",
44-
# "eu-west-2",
45-
# "eu-west-3",
46-
# "eu-south-1",
47-
# "eu-north-1",
48-
# "sa-east-1",
49-
# "ap-southeast-3",
50-
# "ap-northeast-3",
51-
# "me-south-1"
52-
]
29+
region: ["af-south-1"]
30+
# "eu-central-1",
31+
# "us-east-1",
32+
# "us-east-2",
33+
# "us-west-1",
34+
# "us-west-2",
35+
# "ap-east-1",
36+
# "ap-south-1",
37+
# "ap-northeast-1",
38+
# "ap-northeast-2",
39+
# "ap-southeast-1",
40+
# "ap-southeast-2",
41+
# "ca-central-1",
42+
# "eu-west-1",
43+
# "eu-west-2",
44+
# "eu-west-3",
45+
# "eu-south-1",
46+
# "eu-north-1",
47+
# "sa-east-1",
48+
# "ap-southeast-3",
49+
# "ap-northeast-3",
50+
# "me-south-1"
5351
steps:
5452
- name: checkout
55-
uses: actions/checkout@v2
53+
uses: actions/checkout@v3
5654
- name: aws credentials
5755
uses: aws-actions/configure-aws-credentials@v1
5856
with:
@@ -61,12 +59,12 @@ jobs:
6159
- name: Setup Node.js
6260
uses: actions/setup-node@v3
6361
with:
64-
node-version: '16.12'
62+
node-version: "16.12"
6563
- name: Setup python
6664
uses: actions/setup-python@v4
6765
with:
68-
python-version: '3.9'
69-
cache: 'pip'
66+
python-version: "3.9"
67+
cache: "pip"
7068
- name: install cdk and deps
7169
run: |
7270
npm install -g aws-cdk@2.29.0

Diff for: ‎.github/workflows/secure_workflows.yml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Lockdown untrusted workflows
2+
3+
on:
4+
push:
5+
paths:
6+
- ".github/workflows/**"
7+
pull_request:
8+
paths:
9+
- ".github/workflows/**"
10+
11+
jobs:
12+
enforce_pinned_workflows:
13+
name: Harden Security
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout code
17+
uses: actions/checkout@v3
18+
- name: Ensure 3rd party workflows have SHA pinned
19+
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@6ca5574367befbc9efdb2fa25978084159c5902d # v1.3.0
20+
with:
21+
# Trusted GitHub Actions and/or organizations
22+
allowlist: |
23+
aws-actions/
24+
actions/checkout
25+
actions/github-script
26+
actions/setup-node
27+
actions/setup-python
28+
actions/upload-artifact
29+
actions/download-artifact
30+
github/codeql-action/init
31+
github/codeql-action/analyze
32+
dependabot/fetch-metadata

0 commit comments

Comments
 (0)