diff options
author | 2022-10-29 12:16:32 +0000 | |
---|---|---|
committer | 2022-10-31 19:52:55 +0000 | |
commit | d8a5f385bf76ad21cb8942412a370bee3e7b8ce6 (patch) | |
tree | 5620403edad06be5167a8c01cb3db0af0823f621 /.github/workflows/profile-checks.yml | |
parent | build(deps): bump github/codeql-action from 2.1.28 to 2.1.29 (diff) | |
download | firejail-d8a5f385bf76ad21cb8942412a370bee3e7b8ce6.tar.gz firejail-d8a5f385bf76ad21cb8942412a370bee3e7b8ce6.tar.zst firejail-d8a5f385bf76ad21cb8942412a370bee3e7b8ce6.zip |
[StepSecurity] ci: Harden GitHub Actions
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Diffstat (limited to '.github/workflows/profile-checks.yml')
-rw-r--r-- | .github/workflows/profile-checks.yml | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/.github/workflows/profile-checks.yml b/.github/workflows/profile-checks.yml index a530cdff5..f5de62412 100644 --- a/.github/workflows/profile-checks.yml +++ b/.github/workflows/profile-checks.yml | |||
@@ -16,10 +16,18 @@ on: | |||
16 | - 'src/firecfg/firecfg.config' | 16 | - 'src/firecfg/firecfg.config' |
17 | - 'contrib/sort.py' | 17 | - 'contrib/sort.py' |
18 | 18 | ||
19 | permissions: # added using https://github.com/step-security/secure-workflows | ||
20 | contents: read | ||
21 | |||
19 | jobs: | 22 | jobs: |
20 | profile-checks: | 23 | profile-checks: |
21 | runs-on: ubuntu-latest | 24 | runs-on: ubuntu-latest |
22 | steps: | 25 | steps: |
26 | - name: Harden Runner | ||
27 | uses: step-security/harden-runner@2e205a28d0e1da00c5f53b161f4067b052c61f34 | ||
28 | with: | ||
29 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs | ||
30 | |||
23 | - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 | 31 | - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 |
24 | - name: sort.py | 32 | - name: sort.py |
25 | run: ./ci/check/profiles/sort.py etc/inc/*.inc etc/{profile-a-l,profile-m-z}/*.profile | 33 | run: ./ci/check/profiles/sort.py etc/inc/*.inc etc/{profile-a-l,profile-m-z}/*.profile |