Skip to content

Commit 9ea41c5

Browse files
step-security-bottylertitsworthTyler Titsworth
authored
[StepSecurity] Apply security best practices (#65)
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Signed-off-by: Tyler Titsworth <tyler.titsworth@intel.com> Co-authored-by: Tyler Titsworth <titswortht@gmail.com> Co-authored-by: Tyler Titsworth <tyler.titsworth@intel.com>
1 parent 82f6b2e commit 9ea41c5

File tree

12 files changed

+171
-54
lines changed

12 files changed

+171
-54
lines changed

‎.github/dependabot.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,3 +71,43 @@ updates:
7171
package-ecosystem: pip
7272
schedule:
7373
interval: weekly
74+
75+
- package-ecosystem: docker
76+
directory: /classical-ml
77+
schedule:
78+
interval: weekly
79+
80+
- package-ecosystem: docker
81+
directory: /preset/classical-ml
82+
schedule:
83+
interval: weekly
84+
85+
- package-ecosystem: docker
86+
directory: /preset/data-analytics
87+
schedule:
88+
interval: weekly
89+
90+
- package-ecosystem: docker
91+
directory: /preset/deep-learning
92+
schedule:
93+
interval: weekly
94+
95+
- package-ecosystem: docker
96+
directory: /preset/inference-optimization
97+
schedule:
98+
interval: weekly
99+
100+
- package-ecosystem: docker
101+
directory: /python
102+
schedule:
103+
interval: weekly
104+
105+
- package-ecosystem: docker
106+
directory: /pytorch
107+
schedule:
108+
interval: weekly
109+
110+
- package-ecosystem: docker
111+
directory: /tensorflow
112+
schedule:
113+
interval: weekly

‎.github/workflows/chart-ci.yaml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,17 +27,22 @@ jobs:
2727
helm-ci:
2828
runs-on: kubectl
2929
steps:
30-
- uses: actions/checkout@v4
30+
- name: Harden Runner
31+
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
32+
with:
33+
egress-policy: audit
34+
35+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
3136
with:
3237
fetch-depth: 0
3338
# ref: "refs/pull/${{ github.event.number }}/merge"
34-
- uses: azure/setup-kubectl@v4
35-
- uses: azure/setup-helm@v4.2.0
36-
- uses: actions/setup-python@v5
39+
- uses: azure/setup-kubectl@3e0aec4d80787158d308d7b364cb1b702e7feb7f # v4.0.0
40+
- uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
41+
- uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
3742
with:
3843
python-version: 3.x
3944
- name: Setup chart-testing
40-
uses: helm/chart-testing-action@v2.6.1
45+
uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
4146
- name: Get chart diff
4247
id: changed
4348
run: |

‎.github/workflows/container-ci.yaml‎

Lines changed: 27 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ on:
3838
ref:
3939
description: 'Enter Git Ref:'
4040
required: true
41+
default: 'main'
4142
type: string
4243
runner_label:
4344
description: 'Enter Validation Runner Label:'
@@ -82,7 +83,11 @@ jobs:
8283
matrix: ${{ steps.build-matrix.outputs.matrix }}
8384
runs-on: ubuntu-latest
8485
steps:
85-
- uses: actions/checkout@v4
86+
- name: Harden Runner
87+
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
88+
with:
89+
egress-policy: audit
90+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
8691
with:
8792
ref: ${{ inputs.ref }}
8893
- name: Set Matrix
@@ -101,11 +106,11 @@ jobs:
101106
outputs:
102107
group: ${{ steps.build-group.outputs.container-group }}
103108
steps:
104-
- uses: actions/checkout@v4
109+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
105110
with:
106111
ref: ${{ inputs.ref }}
107112
if: ${{ !inputs.no_build }}
108-
- uses: docker/login-action@v3
113+
- uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
109114
with:
110115
registry: ${{ secrets.REGISTRY }}
111116
username: ${{ secrets.REGISTRY_USER }}
@@ -114,7 +119,7 @@ jobs:
114119
- name: Build Container Group
115120
if: ${{ !inputs.no_build }}
116121
id: build-group
117-
uses: intel/ai-containers/.github@main
122+
uses: intel/ai-containers/.github@5d9f53d02bdf065086dffa4ae6d99a412184710c # main
118123
with:
119124
group_dir: ${{ inputs.group_dir }}
120125
env_overrides: ${{ inputs.env_overrides || env.env_overrides || '' }}
@@ -131,7 +136,11 @@ jobs:
131136
outputs:
132137
matrix: ${{ steps.scan-matrix.outputs.matrix }}
133138
steps:
134-
- uses: actions/download-artifact@v4
139+
- name: Harden Runner
140+
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
141+
with:
142+
egress-policy: audit
143+
- uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
135144
with:
136145
path: matrix
137146
- name: Set Matrix
@@ -146,25 +155,25 @@ jobs:
146155
container: ${{ fromJSON(needs.setup-scan.outputs.matrix) }}
147156
fail-fast: false
148157
steps:
149-
- uses: actions/checkout@v4
158+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
150159
with:
151160
ref: ${{ inputs.ref }}
152-
- uses: docker/login-action@v3
161+
- uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
153162
with:
154163
registry: ${{ secrets.REGISTRY }}
155164
username: ${{ secrets.REGISTRY_USER }}
156165
password: ${{ secrets.REGISTRY_TOKEN }}
157166
- name: Pull Image
158167
run: docker pull ${{ secrets.REGISTRY }}/${{ secrets.REPO }}:${{ matrix.container }}
159168
- name: Scan Container
160-
uses: intel/ai-containers/.github/scan@main
169+
uses: intel/ai-containers/.github/scan@5d9f53d02bdf065086dffa4ae6d99a412184710c # main
161170
with:
162171
image-ref: ${{ secrets.REGISTRY }}/${{ secrets.REPO }}:${{ matrix.container }}
163172
output: ${{ matrix.container }}-scan.sarif
164173
- name: Cleanup
165174
if: always()
166175
run: docker rmi -f ${{ secrets.REGISTRY }}/${{ secrets.REPO }}:${{ matrix.container }}
167-
- uses: github/codeql-action/upload-sarif@v3
176+
- uses: github/codeql-action/upload-sarif@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
168177
with:
169178
sarif_file: '${{ matrix.container }}-scan.sarif'
170179
####################################################################################################
@@ -176,7 +185,11 @@ jobs:
176185
outputs:
177186
matrix: ${{ steps.test-matrix.outputs.matrix }}
178187
steps:
179-
- uses: actions/checkout@v4
188+
- name: Harden Runner
189+
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
190+
with:
191+
egress-policy: audit
192+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
180193
with:
181194
ref: ${{ inputs.ref }}
182195
- name: Get Recipes
@@ -192,19 +205,19 @@ jobs:
192205
experimental: [true]
193206
fail-fast: false
194207
steps:
195-
- uses: step-security/harden-runner@v2
208+
- uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
196209
with:
197210
egress-policy: audit
198-
- uses: actions/checkout@v4
211+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
199212
with:
200213
ref: ${{ inputs.ref }}
201-
- uses: docker/login-action@v3
214+
- uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
202215
with:
203216
registry: ${{ secrets.REGISTRY }}
204217
username: ${{ secrets.REGISTRY_USER }}
205218
password: ${{ secrets.REGISTRY_TOKEN }}
206219
- name: Test Container Group
207-
uses: intel/ai-containers/test-runner@main
220+
uses: intel/ai-containers/test-runner@5d9f53d02bdf065086dffa4ae6d99a412184710c # main
208221
with:
209222
cache_registry: ${{ secrets.CACHE_REGISTRY }}
210223
recipe_dir: ${{ inputs.group_dir }}

‎.github/workflows/dependency-review.yaml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,10 @@
2121
#
2222
# Source repository: https://github.com/actions/dependency-review-action
2323
name: 'Dependency Review'
24-
on: [pull_request]
24+
on:
25+
pull_request_target:
26+
types: [opened, edited, reopened, synchronize]
27+
branches: [main]
2528
permissions:
2629
contents: read
2730
concurrency:
@@ -32,7 +35,11 @@ jobs:
3235
permissions:
3336
pull-requests: write
3437
steps:
35-
- uses: actions/checkout@v4
36-
- uses: actions/dependency-review-action@v4
38+
- name: Harden Runner
39+
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
40+
with:
41+
egress-policy: audit
42+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
43+
- uses: actions/dependency-review-action@0c155c5e8556a497adf53f2c18edabf945ed8e70 # v4.3.2
3744
with:
3845
comment-summary-in-pr: true

‎.github/workflows/dockerhub-description.yml‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,12 @@ jobs:
2323
outputs:
2424
matrix: ${{ steps.set-matrix.outputs.matrix }}
2525
steps:
26-
- uses: actions/checkout@v4
26+
- name: Harden Runner
27+
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
28+
with:
29+
egress-policy: audit
30+
31+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
2732
- name: Set matrix data
2833
id: set-matrix
2934
run: echo "matrix=$(jq -c . < .github/dockerhub-readmes.json)" >> $GITHUB_OUTPUT
@@ -34,8 +39,13 @@ jobs:
3439
matrix: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
3540
fail-fast: false
3641
steps:
37-
- uses: actions/checkout@v4
38-
- uses: peter-evans/dockerhub-description@v4
42+
- name: Harden Runner
43+
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
44+
with:
45+
egress-policy: audit
46+
47+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
48+
- uses: peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae # v4.0.0
3949
with:
4050
username: ${{ secrets.DOCKERHUB_USERNAME }}
4151
password: ${{ secrets.DOCKERHUB_PASSWORD }}

‎.github/workflows/docs.yaml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,17 +30,21 @@ jobs:
3030
id-token: write
3131
pages: write
3232
steps:
33-
- uses: actions/checkout@v4
34-
- uses: actions/setup-python@v5
33+
- name: Harden Runner
34+
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
35+
with:
36+
egress-policy: audit
37+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
38+
- uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
3539
with:
3640
python-version: 3.8
3741
cache: pip
3842
- name: Install python requirements
3943
run: python -m pip install -r docs/requirements.txt
4044
- name: Build
4145
run: mkdocs build --clean
42-
- uses: actions/upload-pages-artifact@v3
46+
- uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
4347
with:
4448
path: site
4549
- if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
46-
uses: actions/deploy-pages@v4
50+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

‎.github/workflows/gitleaks.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,15 @@ jobs:
2424
name: gitleaks
2525
runs-on: ubuntu-latest
2626
steps:
27-
- uses: actions/checkout@v4
27+
- name: Harden Runner
28+
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
29+
with:
30+
egress-policy: audit
31+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
2832
with:
2933
fetch-depth: 0
3034
ref: "refs/pull/${{ github.event.number }}/merge"
31-
- uses: gitleaks/gitleaks-action@v2
35+
- uses: gitleaks/gitleaks-action@44c470ffc35caa8b1eb3e8012ca53c2f9bea4eb5 # v2.3.6
3236
env:
3337
GITHUB_TOKEN: ${{ secrets.ACTION_TOKEN }}
3438
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}}

‎.github/workflows/integration-test.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,11 @@ jobs:
2828
outputs:
2929
groups: ${{ steps.group-list.outputs.FOLDERS }}
3030
steps:
31-
- uses: actions/checkout@v4
31+
- name: Harden Runner
32+
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
33+
with:
34+
egress-policy: audit
35+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
3236
with:
3337
fetch-depth: 0
3438
ref: "refs/pull/${{ github.event.number }}/merge"
@@ -75,6 +79,10 @@ jobs:
7579
runs-on: ubuntu-latest
7680
if: always()
7781
steps:
82+
- name: Harden Runner
83+
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
84+
with:
85+
egress-policy: audit
7886
- run: exit 1
7987
if: >-
8088
${{

‎.github/workflows/lint.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,15 @@ jobs:
2727
name: Lint
2828
runs-on: ubuntu-latest
2929
steps:
30-
- uses: actions/checkout@v4
30+
- name: Harden Runner
31+
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
32+
with:
33+
egress-policy: audit
34+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
3135
with:
3236
fetch-depth: 0
3337
ref: "refs/pull/${{ github.event.number }}/merge"
34-
- uses: super-linter/super-linter/slim@v6.5.1
38+
- uses: super-linter/super-linter/slim@5b638caee6ba65e25e07143887b669a1233847a0 # v6.5.1
3539
env:
3640
# To report GitHub Actions status checks
3741
GITHUB_TOKEN: ${{ secrets.ACTION_TOKEN }}

‎.github/workflows/scorecard.yaml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,20 +35,25 @@ jobs:
3535
contents: read
3636
actions: read
3737
steps:
38-
- uses: actions/checkout@v4
38+
- name: Harden Runner
39+
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
40+
with:
41+
egress-policy: audit
42+
43+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
3944
with:
4045
persist-credentials: false
41-
- uses: ossf/scorecard-action@v2.3.3
46+
- uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
4247
with:
4348
results_file: results.sarif
4449
results_format: sarif
4550
repo_token: ${{ secrets.ACTION_TOKEN }}
4651
publish_results: true
47-
- uses: actions/upload-artifact@v4
52+
- uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
4853
with:
4954
name: SARIF file
5055
path: results.sarif
5156
retention-days: 5
52-
- uses: github/codeql-action/upload-sarif@v3.25.3
57+
- uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
5358
with:
5459
sarif_file: results.sarif

0 commit comments

Comments
 (0)