Skip to content

Commit 4335920

Browse files
cx-luis-ventuzeloscx-luis-ventuzelos
committed
harden all workflow files security
- Fix startup failure: remove unnecessary id-token:write from delete-packages-and-releases.yml - Move permissions to job level across all workflows (least privilege) - Replace PERSONAL_ACCESS_TOKEN with GITHUB_TOKEN everywhere - Fix script injection: move inputs/context expressions to env vars in run steps - Replace deprecated ::set-output with GITHUB_OUTPUT (update-cli.yml) - Update action pins: checkout v6.0.3, setup-node v6.4.0 - Add pull-requests:write to auto-merge and dependabot-merge jobs - Fix PR number injection in ast-cli-team-review.yml
1 parent a65418a commit 4335920

7 files changed

Lines changed: 46 additions & 33 deletions

File tree

‎.github/workflows/ast-cli-team-review.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
if: ${{ github.event.pull_request.user.type != 'Bot' }}
1616
steps:
1717
- name: Set up GitHub CLI
18-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
18+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
1919
with:
2020
version: latest
2121

@@ -37,8 +37,9 @@ jobs:
3737
id: reviewers
3838
env:
3939
GH_TOKEN: ${{ secrets.AST_CLI_GH_TOKEN }}
40+
PR_NUMBER: ${{ github.event.pull_request.number }}
4041
run: |
41-
gh pr view ${{ github.event.pull_request.number }} --json reviewRequests --jq '.reviewRequests' > all_reviewers.json
42+
gh pr view "$PR_NUMBER" --json reviewRequests --jq '.reviewRequests' > all_reviewers.json
4243
4344
jq -r '.[] | select(.type == "User") | .login' all_reviewers.json > user_reviewers.txt
4445
jq -r '.[] | select(.type == "Team") | .login' all_reviewers.json > team_reviewers.txt

‎.github/workflows/auto-merge-pr.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,22 @@ name: Post-Check Actions
22
on: [pull_request]
33

44
permissions:
5-
contents: write
5+
contents: read
66

77
jobs:
88
dependabot-merge:
9+
permissions:
10+
contents: write
11+
pull-requests: write
912
runs-on: cx-public-ubuntu-x64
1013
if: contains(github.head_ref, 'feature/update_cli')
1114
steps:
1215
- name: Enable auto-merge for Dependabot PRs
1316
env:
14-
PR_URL: ${{github.event.pull_request.html_url}}
15-
GITHUB_TOKEN: ${{secrets.PERSONAL_ACCESS_TOKEN }}
17+
PR_URL: ${{ github.event.pull_request.html_url }}
18+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1619
run: gh pr merge --auto --squash "$PR_URL"
1720
- name: Auto approve dependabot PRs
1821
uses: step-security/auto-approve-action@0c28339628c8e79ab2f6813291e7e6cd584b4d30 # v4.0.0
1922
with:
20-
github-token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
23+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ jobs:
88
integration-tests:
99
runs-on: cx-public-ubuntu-x64
1010
steps:
11-
- uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 #v4
11+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
1212
with:
1313
lfs: true
1414

@@ -19,7 +19,7 @@ jobs:
1919
git lfs install
2020
2121
- name: Use Node.js 22.11.0
22-
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 #v4.0.2
22+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
2323
with:
2424
node-version: 22.11.0
2525
registry-url: https://npm.pkg.github.com/

‎.github/workflows/delete-packages-and-releases.yml‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,37 +14,39 @@ on:
1414
required: true
1515

1616
permissions:
17-
id-token: write
18-
contents: write
19-
packages: write
20-
17+
contents: read
2118

2219
jobs:
2320
delete:
21+
permissions:
22+
contents: write
23+
packages: write
2424
runs-on: cx-public-ubuntu-x64
2525
steps:
2626

2727
- name: Delete npm packages
2828
continue-on-error: true
29+
env:
30+
INPUT_TAG: ${{ inputs.tag }}
31+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2932
run: |
33+
echo "Deleting all npm packages whose name ends with '-${INPUT_TAG}.0'"
3034
31-
echo "Deleting all npm packages whose name ends with '-${{inputs.tag}}.0'"
32-
33-
VERSION_IDS=($(curl -L -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.PERSONAL_ACCESS_TOKEN }}" -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/orgs/Checkmarx/packages/npm/ast-cli-javascript-wrapper/versions | jq '.[]|select(.name | contains("-${{inputs.tag}}.0"))|.id'))
35+
VERSION_IDS=($(curl -L -H "Accept: application/vnd.github+json" -H "Authorization: Bearer $GH_TOKEN" -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/orgs/Checkmarx/packages/npm/ast-cli-javascript-wrapper/versions | jq ".[]|select(.name | contains(\"-${INPUT_TAG}.0\"))|.id"))
3436
3537
for versionId in "${VERSION_IDS[@]}"
3638
do
3739
echo "Deleting version $versionId..."
38-
curl -L -X DELETE -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.PERSONAL_ACCESS_TOKEN }}" -H "X-GitHub-Api-Version: 2022-11-28" "https://api.github.com/orgs/Checkmarx/packages/npm/ast-cli-javascript-wrapper/versions/$versionId"
40+
curl -L -X DELETE -H "Accept: application/vnd.github+json" -H "Authorization: Bearer $GH_TOKEN" -H "X-GitHub-Api-Version: 2022-11-28" "https://api.github.com/orgs/Checkmarx/packages/npm/ast-cli-javascript-wrapper/versions/$versionId"
3941
echo "Version $versionId deleted successfully!"
4042
done
4143
4244
- name: Delete releases and tags
4345
continue-on-error: true
4446
uses: dev-drprasad/delete-older-releases@dfbe6be2a006e9475dfcbe5b8d201f1824c2a9fe #v0.3.4
4547
env:
46-
GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
48+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4749
with:
4850
keep_latest: 0
49-
delete_tag_pattern: "-${{inputs.tag}}.0"
51+
delete_tag_pattern: "-${{ inputs.tag }}.0"
5052
delete_tags: true

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,24 +2,27 @@ name: Dependabot auto-merge
22
on: pull_request
33

44
permissions:
5-
contents: write
5+
contents: read
66

77
jobs:
88
dependabot-merge:
9+
permissions:
10+
contents: write
11+
pull-requests: write
912
runs-on: cx-public-ubuntu-x64
1013
if: ${{ github.actor == 'dependabot[bot]' }}
1114
steps:
1215
- name: Dependabot metadata
1316
id: metadata
1417
uses: step-security/dependabot-fetch-metadata@bf8fb6e0be0a711c669dc236de6e7f7374ba626e # v3.1.0
1518
with:
16-
github-token: "${{ secrets.PERSONAL_ACCESS_TOKEN }}"
19+
github-token: ${{ secrets.GITHUB_TOKEN }}
1720
- name: Enable auto-merge for Dependabot PRs
1821
env:
19-
PR_URL: ${{github.event.pull_request.html_url}}
20-
GITHUB_TOKEN: ${{secrets.PERSONAL_ACCESS_TOKEN }}
22+
PR_URL: ${{ github.event.pull_request.html_url }}
23+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2124
run: gh pr merge --auto --squash "$PR_URL"
2225
- name: Auto approve dependabot PRs
2326
uses: step-security/auto-approve-action@0c28339628c8e79ab2f6813291e7e6cd584b4d30 # v4.0.0
2427
with:
25-
github-token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
28+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/nightly.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
11
name: Nightly Release
22

33
permissions:
4-
id-token: write
5-
contents: write
6-
packages: write
4+
contents: read
75

86
on:
97
push:
@@ -12,5 +10,9 @@ on:
1210

1311
jobs:
1412
nightly:
13+
permissions:
14+
id-token: write
15+
contents: write
16+
packages: write
1517
uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/release.yml@main
1618
secrets: inherit

‎.github/workflows/update-cli.yml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,11 @@ permissions:
99

1010
jobs:
1111
update-checkmarx-cli:
12+
permissions:
13+
contents: write
1214
runs-on: cx-public-ubuntu-x64
1315
steps:
14-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
16+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
1517
with:
1618
lfs: true
1719

@@ -29,23 +31,23 @@ jobs:
2931
- name: Get Latest Checkmarx API version
3032
id: checkmarx-ast-cli
3133
run: |
32-
echo ::set-output name=release_tag::$(curl -sL https://api.github.com/repos/Checkmarx/ast-cli/releases/latest | jq -r ".tag_name")
33-
echo ::set-output name=current_tag::$(<checkmarx-ast-cli.version)
34+
echo "release_tag=$(curl -sL https://api.github.com/repos/Checkmarx/ast-cli/releases/latest | jq -r '.tag_name')" >> $GITHUB_OUTPUT
35+
echo "current_tag=$(<checkmarx-ast-cli.version)" >> $GITHUB_OUTPUT
3436
3537
- name: Update Checkmarx cli version
3638
if: steps.checkmarx-ast-cli.outputs.current_tag != steps.checkmarx-ast-cli.outputs.release_tag
3739
env:
3840
RELEASE_TAG: ${{ steps.checkmarx-ast-cli.outputs.release_tag }}
3941
run: |
40-
# Update current release
41-
echo ${{ steps.checkmarx-ast-cli.outputs.release_tag }} > checkmarx-ast-cli.version
42+
echo "$RELEASE_TAG" > checkmarx-ast-cli.version
4243
4344
- name: Download latest cli and update branch
4445
if: steps.checkmarx-ast-cli.outputs.current_tag != steps.checkmarx-ast-cli.outputs.release_tag
46+
env:
47+
RELEASE_TAG: ${{ steps.checkmarx-ast-cli.outputs.release_tag }}
4548
run: |
46-
# Update binaries
4749
chmod +x ./.github/scripts/update_cli.sh
48-
./.github/scripts/update_cli.sh ${{ steps.checkmarx-ast-cli.outputs.release_tag }}
50+
./.github/scripts/update_cli.sh "$RELEASE_TAG"
4951
5052
- name: Track large files with Git LFS
5153
if: steps.checkmarx-ast-cli.outputs.current_tag != steps.checkmarx-ast-cli.outputs.release_tag

0 commit comments

Comments
 (0)