Skip to content
This repository was archived by the owner on Feb 3, 2026. It is now read-only.

[StepSecurity] Apply security best practices #15

Open
stepsecurity-app wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[StepSecurity] Apply security best practices #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 26 additions & 8 deletions .github/workflows/integration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@ on: [push, pull_request]
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
permissions:
contents: read

jobs:
integration:
strategy:
Expand All @@ -14,11 +17,16 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 3
steps:
- uses: actions/checkout@v3
- uses: actions/setup-go@v3
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
with:
egress-policy: audit

- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
- uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
with:
go-version: ${{ matrix.go }}
- uses: actions/setup-node@v3
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
with:
node-version: ${{ matrix.node }}
- run: go mod download
Expand All @@ -32,11 +40,16 @@ jobs:
node: [14]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-go@v3
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
with:
egress-policy: audit

- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
- uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
with:
go-version: ${{ matrix.go }}
- uses: actions/setup-node@v3
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
with:
node-version: ${{ matrix.node }}
- run: go mod download
Expand All @@ -49,8 +62,13 @@ jobs:
go: ["1.18", "1.20"]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-go@v3
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
with:
egress-policy: audit

- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
- uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
with:
go-version: ${{ matrix.go }}
- run: .github/workflows/check-init
29 changes: 22 additions & 7 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,13 @@ jobs:
go: ["1.19", "1.20"]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-go@v3
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
with:
egress-policy: audit

- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
- uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
with:
go-version: ${{ matrix.go }}
- run: go mod download
Expand All @@ -26,8 +31,13 @@ jobs:
go: ["1.19", "1.20"]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-go@v3
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
with:
egress-policy: audit

- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
- uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
with:
go-version: ${{ matrix.go }}
- run: go mod download
Expand All @@ -41,12 +51,17 @@ jobs:
go: ["1.19", "1.20"]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-go@v3
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
with:
egress-policy: audit

- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
- uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
with:
go-version: ${{ matrix.go }}
- name: golangci-lint
uses: golangci/golangci-lint-action@v3.4.0
uses: golangci/golangci-lint-action@08e2f20817b15149a52b5b3ebe7de50aff2ba8c5 # v3.4.0
with:
version: latest
# skip cache because of flaky behaviors
Expand Down
11 changes: 8 additions & 3 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,14 @@ jobs:
go: ["1.20"] # nancy is a little flaky
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-go@v3
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
with:
egress-policy: audit

- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
- uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
with:
go-version: ${{ matrix.go }}
- run: go mod download && go list -json -deps all > go.list
- uses: sonatype-nexus-community/nancy-github-action@main
- uses: sonatype-nexus-community/nancy-github-action@395e2fb168f674f96502e5652103d112899ea369 # main
16 changes: 12 additions & 4 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@ on: [push, pull_request]
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
permissions:
contents: read

jobs:
test:
strategy:
Expand All @@ -14,20 +17,25 @@ jobs:
runs-on: ${{ matrix.os }}
continue-on-error: true
steps:
- uses: actions/checkout@v3
- uses: actions/setup-go@v3
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
with:
egress-policy: audit

- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
- uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
with:
go-version: ${{ matrix.go }}
- name: Core tests
uses: nick-fields/retry@v2
uses: step-security/retry@e1d59ce1f574b32f0915e3a8df055cfe9f99be5d # v3.0.4
with:
max_attempts: 3
timeout_minutes: 20
command: |
go mod download
go test -race ./...
- name: Example tests
uses: nick-fields/retry@v2
uses: step-security/retry@e1d59ce1f574b32f0915e3a8df055cfe9f99be5d # v3.0.4
with:
max_attempts: 3
timeout_minutes: 20
Expand Down
Loading