Skip to content

Commit 0016fca

Browse files
cx-luis-ventuzeloscx-luis-ventuzelos
committed
harden release workflow security
- Move permissions from workflow level to job level (least privilege) - Replace deprecated ::set-output with GITHUB_OUTPUT - Fix script injection by moving inputs to env vars in run steps - Replace OR_GITHUB_TOKEN/PERSONAL_ACCESS_TOKEN with GITHUB_TOKEN - Update action pins: checkout v6.0.3, setup-node v6.4.0, octokit/request-action v3.0.0 - Comment out notify and dispatch_auto_release jobs
1 parent a65418a commit 0016fca

1 file changed

Lines changed: 54 additions & 42 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 54 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -35,29 +35,34 @@ on:
3535
type: boolean
3636

3737
permissions:
38-
id-token: write
39-
contents: write
40-
packages: write
38+
contents: read
4139

4240
jobs:
4341
delete:
42+
permissions:
43+
contents: write
44+
packages: write
4445
uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/delete-packages-and-releases.yml@main
4546
with:
4647
tag: ${{ inputs.jsTag }}
4748
secrets: inherit
4849
if: inputs.dev == true
4950
release:
51+
permissions:
52+
id-token: write
53+
contents: write
54+
packages: write
5055
runs-on: cx-public-ubuntu-x64
5156
env:
52-
GITHUB_TOKEN: ${{ secrets.OR_GITHUB_TOKEN }}
57+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5358
BRANCH_NAME: npm-version-patch
5459
outputs:
5560
TAG_NAME: ${{ steps.set_tag_name.outputs.TAG_NAME }}
5661
CLI_VERSION: ${{ steps.extract_cli_version.outputs.CLI_VERSION }}
5762
steps:
5863

5964
# CHECKOUT PROJECT
60-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
65+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
6166
with:
6267
fetch-depth: 0
6368
lfs: true # Ensure LFS files are checked out
@@ -68,38 +73,43 @@ jobs:
6873
git config user.email github-actions@github.com
6974
7075
# SETUP NODE
71-
- uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
76+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
7277
with:
7378
node-version: 22.11.0
7479
registry-url: https://npm.pkg.github.com/
7580

7681
# GET TAG NAME
7782
- name: Generate Tag name
7883
id: set_tag_name
84+
env:
85+
INPUT_DEV: ${{ inputs.dev }}
86+
INPUT_JS_TAG: ${{ inputs.jsTag }}
7987
run: |
80-
if [ ${{ inputs.dev }} == true ]; then
81-
TAG_NAME=$(npm version prerelease --preid=${{ inputs.jsTag }} --no-git-tag-version --allow-same-version)
88+
if [ "$INPUT_DEV" == "true" ]; then
89+
TAG_NAME=$(npm version prerelease --preid="$INPUT_JS_TAG" --no-git-tag-version --allow-same-version)
8290
else
8391
TAG_NAME=$(npm version patch --no-git-tag-version)
8492
fi
8593
echo "TAG_NAME=$TAG_NAME" >> $GITHUB_ENV
86-
echo "::set-output name=TAG_NAME::$TAG_NAME"
94+
echo "TAG_NAME=$TAG_NAME" >> $GITHUB_OUTPUT
8795
8896
# DOWNLOAD CLI IF IT IS A DEV VERSION AND A CLI TAG WAS PROVIDED
89-
- name: Download cli with tag ${{ inputs.cliTag }}
97+
- name: Download cli with tag
9098
if: inputs.dev == true && inputs.cliTag != ''
99+
env:
100+
INPUT_CLI_TAG: ${{ inputs.cliTag }}
91101
run: |
92102
# Update binaries
93103
chmod +x ./.github/scripts/update_cli.sh
94-
./.github/scripts/update_cli.sh ${{ inputs.cliTag }}
104+
./.github/scripts/update_cli.sh "$INPUT_CLI_TAG"
95105
96106
- name: Extract CLI version
97107
id: extract_cli_version
98108
run: |
99109
CLI_VERSION=$(./src/main/wrapper/resources/cx-linux version | grep -Eo '^[0-9]+\.[0-9]+\.[0-9]+')
100110
echo "CLI version being packed is $CLI_VERSION"
101111
echo "CLI_VERSION=$CLI_VERSION" >> $GITHUB_ENV
102-
echo "::set-output name=CLI_VERSION::$CLI_VERSION"
112+
echo "CLI_VERSION=$CLI_VERSION" >> $GITHUB_OUTPUT
103113
104114
# RUN NPM INSTALL AND BUILD
105115
- name: NPM ci and build
@@ -124,14 +134,14 @@ jobs:
124134
- name: Wait for PR to be created
125135
id: pr
126136
if: inputs.dev == false
127-
uses: octokit/request-action@872c5c97b3c85c23516a572f02b31401ef82415d #v2.3.1
137+
uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0
128138
with:
129139
route: GET /repos/${{ github.repository }}/pulls?head=${{ github.repository_owner }}:${{ env.BRANCH_NAME }}
130140

131141
# MERGE PR TO MAIN
132142
- name: Merge Pull Request
133143
if: inputs.dev == false
134-
uses: octokit/request-action@872c5c97b3c85c23516a572f02b31401ef82415d #v2.3.1
144+
uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0
135145
with:
136146
route: PUT /repos/${{ github.repository }}/pulls/${{ steps.create_pr.outputs.pull-request-number }}/merge
137147
merge_method: squash
@@ -140,21 +150,23 @@ jobs:
140150
- name: Push tag
141151
if: inputs.dev == false
142152
run: |
143-
git pull
153+
git pull
144154
git tag ${{env.TAG_NAME}}
145155
git push --tags
146156
147157
148158
# PUBLISH NPM PACKAGE
149159
- name: Publish npm package
160+
env:
161+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
162+
INPUT_DEV: ${{ inputs.dev }}
163+
INPUT_JS_TAG: ${{ inputs.jsTag }}
150164
run: |
151-
if [ ${{ inputs.dev }} == true ]; then
152-
npm publish --tag=${{ inputs.jsTag }}
165+
if [ "$INPUT_DEV" == "true" ]; then
166+
npm publish --tag="$INPUT_JS_TAG"
153167
else
154168
npm publish --access public
155169
fi
156-
env:
157-
NODE_AUTH_TOKEN: ${{secrets.PERSONAL_ACCESS_TOKEN}}
158170
159171
# CREATE RELEASE
160172
- name: Create Release
@@ -165,26 +177,26 @@ jobs:
165177
generate_release_notes: true
166178
prerelease: ${{ inputs.dev }}
167179

168-
notify:
169-
if: inputs.dev == false
170-
needs: release
171-
uses: Checkmarx/plugins-release-workflow/.github/workflows/release-notify.yml@main
172-
with:
173-
product_name: Javascript Wrapper
174-
release_version: ${{ needs.release.outputs.TAG_NAME }}
175-
cli_release_version: ${{ needs.release.outputs.CLI_VERSION }}
176-
release_author: "Phoenix Team"
177-
release_url: https://github.com/Checkmarx/ast-cli-javascript-wrapper/releases/tag/${{ needs.release.outputs.TAG_NAME }}
178-
jira_product_name: JAVASCRIPT_WRAPPER
179-
secrets: inherit
180-
181-
dispatch_auto_release:
182-
name: Update VS Code Extension With new Wrapper Version
183-
if: inputs.dev == false
184-
needs: notify
185-
uses: Checkmarx/plugins-release-workflow/.github/workflows/dispatch-workflow.yml@main
186-
with:
187-
cli_version: ${{ needs.release.outputs.CLI_VERSION }}
188-
is_cli_release: false
189-
is_js_release: true
190-
secrets: inherit
180+
# notify:
181+
# if: inputs.dev == false
182+
# needs: release
183+
# uses: Checkmarx/plugins-release-workflow/.github/workflows/release-notify.yml@main
184+
# with:
185+
# product_name: Javascript Wrapper
186+
# release_version: ${{ needs.release.outputs.TAG_NAME }}
187+
# cli_release_version: ${{ needs.release.outputs.CLI_VERSION }}
188+
# release_author: "Phoenix Team"
189+
# release_url: https://github.com/Checkmarx/ast-cli-javascript-wrapper/releases/tag/${{ needs.release.outputs.TAG_NAME }}
190+
# jira_product_name: JAVASCRIPT_WRAPPER
191+
# secrets: inherit
192+
193+
# dispatch_auto_release:
194+
# name: Update VS Code Extension With new Wrapper Version
195+
# if: inputs.dev == false
196+
# needs: notify
197+
# uses: Checkmarx/plugins-release-workflow/.github/workflows/dispatch-workflow.yml@main
198+
# with:
199+
# cli_version: ${{ needs.release.outputs.CLI_VERSION }}
200+
# is_cli_release: false
201+
# is_js_release: true
202+
# secrets: inherit

0 commit comments

Comments
 (0)