diff options
| author |  StepSecurity Bot <bot@stepsecurity.io> | 2022-10-29 12:16:32 +0000 |
|---|---|---|
| committer |  Topi Miettinen <topimiettinen@users.noreply.github.com> | 2022-10-31 19:52:55 +0000 |
| commit | d8a5f385bf76ad21cb8942412a370bee3e7b8ce6 (patch) | |
| tree | 5620403edad06be5167a8c01cb3db0af0823f621 /.github/workflows/build-extra.yml | |
| parent | build(deps): bump github/codeql-action from 2.1.28 to 2.1.29 (diff) | |
| download | firejail-d8a5f385bf76ad21cb8942412a370bee3e7b8ce6.tar.gz firejail-d8a5f385bf76ad21cb8942412a370bee3e7b8ce6.tar.zst firejail-d8a5f385bf76ad21cb8942412a370bee3e7b8ce6.zip | |
[StepSecurity] ci: Harden GitHub Actions
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Diffstat (limited to '.github/workflows/build-extra.yml')
| -rw-r--r-- | .github/workflows/build-extra.yml | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/.github/workflows/build-extra.yml b/.github/workflows/build-extra.yml index 8c318ded8..a319e1ac6 100644 --- a/.github/workflows/build-extra.yml +++ b/.github/workflows/build-extra.yml | |||
| @@ -32,10 +32,18 @@ on: | |||
| 32 | - '.github/ISSUE_TEMPLATE/*' | 32 | - '.github/ISSUE_TEMPLATE/*' |
| 33 | - '.github/pull_request_template.md' | 33 | - '.github/pull_request_template.md' |
| 34 | 34 | ||
| 35 | permissions: # added using https://github.com/step-security/secure-workflows | ||
| 36 | contents: read | ||
| 37 | |||
| 35 | jobs: | 38 | jobs: |
| 36 | build-clang: | 39 | build-clang: |
| 37 | runs-on: ubuntu-22.04 | 40 | runs-on: ubuntu-22.04 |
| 38 | steps: | 41 | steps: |
| 42 | - name: Harden Runner | ||
| 43 | uses: step-security/harden-runner@2e205a28d0e1da00c5f53b161f4067b052c61f34 | ||
| 44 | with: | ||
| 45 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs | ||
| 46 | |||
| 39 | - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 | 47 | - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 |
| 40 | - name: install dependencies | 48 | - name: install dependencies |
| 41 | run: sudo apt-get install libapparmor-dev libselinux1-dev | 49 | run: sudo apt-get install libapparmor-dev libselinux1-dev |
| @@ -50,6 +58,11 @@ jobs: | |||
| 50 | scan-build: | 58 | scan-build: |
| 51 | runs-on: ubuntu-22.04 | 59 | runs-on: ubuntu-22.04 |
| 52 | steps: | 60 | steps: |
| 61 | - name: Harden Runner | ||
| 62 | uses: step-security/harden-runner@2e205a28d0e1da00c5f53b161f4067b052c61f34 | ||
| 63 | with: | ||
| 64 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs | ||
| 65 | |||
| 53 | - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 | 66 | - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 |
| 54 | - name: install clang-tools-14 and dependencies | 67 | - name: install clang-tools-14 and dependencies |
| 55 | run: sudo apt-get install clang-tools-14 libapparmor-dev libselinux1-dev | 68 | run: sudo apt-get install clang-tools-14 libapparmor-dev libselinux1-dev |
| @@ -60,6 +73,11 @@ jobs: | |||
| 60 | cppcheck: | 73 | cppcheck: |
| 61 | runs-on: ubuntu-22.04 | 74 | runs-on: ubuntu-22.04 |
| 62 | steps: | 75 | steps: |
| 76 | - name: Harden Runner | ||
| 77 | uses: step-security/harden-runner@2e205a28d0e1da00c5f53b161f4067b052c61f34 | ||
| 78 | with: | ||
| 79 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs | ||
| 80 | |||
| 63 | - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 | 81 | - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 |
| 64 | - name: install cppcheck | 82 | - name: install cppcheck |
| 65 | run: sudo apt-get install cppcheck | 83 | run: sudo apt-get install cppcheck |
| @@ -70,6 +88,11 @@ jobs: | |||
| 70 | cppcheck_old: | 88 | cppcheck_old: |
| 71 | runs-on: ubuntu-20.04 | 89 | runs-on: ubuntu-20.04 |
| 72 | steps: | 90 | steps: |
| 91 | - name: Harden Runner | ||
| 92 | uses: step-security/harden-runner@2e205a28d0e1da00c5f53b161f4067b052c61f34 | ||
| 93 | with: | ||
| 94 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs | ||
| 95 | |||
| 73 | - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 | 96 | - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 |
| 74 | - name: install cppcheck | 97 | - name: install cppcheck |
| 75 | run: sudo apt-get install cppcheck | 98 | run: sudo apt-get install cppcheck |