Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply best security practices for OpenSSF (#3069)

Browse Source 
* [StepSecurity] Apply security best practices
* Keep needed check in precommit

---------

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
Co-authored-by: StepSecurity Bot <bot@stepsecurity.io>
This commit is contained in:
Sanket Sudake
2024-12-08 11:07:14 +05:30
committed by GitHub
co-authored by StepSecurity Bot
parent 0aa1a12cdc
commit 11a2fdbdab
16 changed files with 154 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/dependabot.yml
+36
View File
@@ -0,0 +1,36 @@
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: daily
- package-ecosystem: docker
directory: /cmd/builder
schedule:
interval: daily
- package-ecosystem: docker
directory: /cmd/fetcher
schedule:
interval: daily
- package-ecosystem: docker
directory: /cmd/fission-bundle
schedule:
interval: daily
- package-ecosystem: docker
directory: /cmd/preupgradechecks
schedule:
interval: daily
- package-ecosystem: docker
directory: /cmd/reporter
schedule:
interval: daily
- package-ecosystem: gomod
directory: /
schedule:
interval: daily
.github/workflows/codeql.yaml
+12
View File
@@ -11,11 +11,23 @@ on:
- cron: "0 0 * * 0"
workflow_dispatch:
permissions:
contents: read
jobs:
CodeQL-Build:
permissions:
actions: read # for github/codeql-action/init to get workflow details
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/analyze to upload SARIF results
runs-on: ubuntu-latest
if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
steps:
- name: Harden Runner
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
with:
egress-policy: audit
- name: Check out code
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
.github/workflows/dependency-review.yml
+27
View File
@@ -0,0 +1,27 @@
# Dependency Review Action
#
# This Action will scan dependency manifest files that change as part of a Pull Request,
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
# Once installed, if the workflow run is marked as required,
# PRs introducing known-vulnerable packages will be blocked from merging.
#
# Source repository: https://github.com/actions/dependency-review-action
name: 'Dependency Review'
on: [pull_request]
permissions:
contents: read
jobs:
dependency-review:
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
with:
egress-policy: audit
- name: 'Checkout Repository'
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: 'Dependency Review'
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
.github/workflows/lint-dashboards.yaml
+8
View File
@@ -13,11 +13,19 @@ on:
- 'charts/fission-all/dashboards/**.json'
workflow_dispatch:
permissions:
contents: read
jobs:
lint-dashboards:
runs-on: ubuntu-latest
if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
steps:
- name: Harden Runner
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
with:
egress-policy: audit
- name: Check out code
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
.github/workflows/lint.yaml
+11
View File
@@ -21,11 +21,22 @@ env:
GOLANGCI_LINT_VERSION: v1.61.0
GOLANGCI_LINT_TIMEOUT: 5m
permissions:
contents: read
jobs:
lint:
permissions:
contents: read # for actions/checkout to fetch code
pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
runs-on: ubuntu-latest
# if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
steps:
- name: Harden Runner
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
with:
egress-policy: audit
- name: Check out code
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
.github/workflows/push_pr.yaml
+13
View File
@@ -26,6 +26,9 @@ env:
KIND_VERSION: v0.23.0
KIND_CLUSTER_NAME: kind
permissions:
contents: read
jobs:
# Job to run change detection
integration-test:
@@ -37,6 +40,11 @@ jobs:
kindversion: ["v1.25.16", "v1.27.13", "v1.30.0"]
os: [ubuntu-latest]
steps:
- name: Harden Runner
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
with:
egress-policy: audit
- name: Checkout sources
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
@@ -180,6 +188,11 @@ jobs:
kindversion: ["v1.19.16"]
os: [ubuntu-latest]
steps:
- name: Harden Runner
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
with:
egress-policy: audit
- name: Checkout sources
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
.github/workflows/release.yaml
+10
View File
@@ -10,10 +10,20 @@ env:
KIND_NODE_IMAGE_TAG: v1.25.16
KIND_CLUSTER_NAME: kind
permissions:
contents: read
jobs:
create-draft-release:
permissions:
contents: write # for goreleaser/goreleaser-action to create a GitHub release
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
with:
egress-policy: audit
- name: Check out code
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
with:
.github/workflows/scorecard.yml
+6 -1
View File
@@ -31,6 +31,11 @@ jobs:
# actions: read
steps:
- name: Harden Runner
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
with:
egress-policy: audit
- name: "Checkout code"
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
@@ -68,6 +73,6 @@ jobs:
# Upload the results to GitHub's code scanning dashboard (optional).
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
- name: "Upload to code-scanning"
uses: github/codeql-action/upload-sarif@v3
uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
with:
sarif_file: results.sarif
.github/workflows/upgrade_test.yaml
+8
View File
@@ -26,6 +26,9 @@ env:
KIND_VERSION: v0.23.0
KIND_CLUSTER_NAME: kind
permissions:
contents: read
jobs:
upgrade-test:
runs-on: ${{ matrix.os }}
@@ -36,6 +39,11 @@ jobs:
kindversion: ["v1.25.16"]
os: [ubuntu-latest]
steps:
- name: Harden Runner
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
with:
egress-policy: audit
- name: Checkout action sources
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
.pre-commit-config.yaml
+18
View File
@@ -0,0 +1,18 @@
repos:
- repo: https://github.com/gitleaks/gitleaks
rev: v8.16.3
hooks:
- id: gitleaks
- repo: https://github.com/golangci/golangci-lint
rev: v1.52.2
hooks:
- id: golangci-lint
- repo: https://github.com/jumanjihouse/pre-commit-hooks
rev: 3.0.0
hooks:
- id: shellcheck
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v4.4.0
hooks:
- id: end-of-file-fixer
- id: trailing-whitespace
cmd/builder/Dockerfile
+1 -1
View File
@@ -1,3 +1,3 @@
FROM cgr.dev/chainguard/static:latest
FROM cgr.dev/chainguard/static:latest@sha256:5ff428f8a48241b93a4174dbbc135a4ffb2381a9e10bdbbc5b9db145645886d5
COPY builder /builder
ENTRYPOINT ["/builder"]
cmd/fetcher/Dockerfile
+1 -1
View File
@@ -1,3 +1,3 @@
FROM cgr.dev/chainguard/static:latest
FROM cgr.dev/chainguard/static:latest@sha256:5ff428f8a48241b93a4174dbbc135a4ffb2381a9e10bdbbc5b9db145645886d5
COPY fetcher /
ENTRYPOINT ["/fetcher"]
cmd/fission-bundle/Dockerfile
+1 -1
View File
@@ -1,3 +1,3 @@
FROM cgr.dev/chainguard/static:latest
FROM cgr.dev/chainguard/static:latest@sha256:5ff428f8a48241b93a4174dbbc135a4ffb2381a9e10bdbbc5b9db145645886d5
COPY fission-bundle /
ENTRYPOINT ["/fission-bundle"]
cmd/fission-bundle/main.go
-1
View File
@@ -161,7 +161,6 @@ func main() {
Use it to start one or more of the fission servers:
Pool manager maintains a pool of generalized function containers, and
specializes them on-demand. Executor must be run from a pod in a
Kubernetes cluster.
cmd/preupgradechecks/Dockerfile
+1 -1
View File
@@ -1,3 +1,3 @@
FROM cgr.dev/chainguard/static:latest
FROM cgr.dev/chainguard/static:latest@sha256:5ff428f8a48241b93a4174dbbc135a4ffb2381a9e10bdbbc5b9db145645886d5
COPY pre-upgrade-checks /
ENTRYPOINT ["/pre-upgrade-checks"]
cmd/reporter/Dockerfile
+1 -1
View File
@@ -1,3 +1,3 @@
FROM cgr.dev/chainguard/static:latest
FROM cgr.dev/chainguard/static:latest@sha256:5ff428f8a48241b93a4174dbbc135a4ffb2381a9e10bdbbc5b9db145645886d5
COPY reporter /
ENTRYPOINT ["/reporter"]