Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 3677c12

Browse files
step-security-botondrejmirtes
step-security-bot
authored and
ondrejmirtes
committed
[StepSecurity] ci: Harden GitHub Actions
Signed-off-by: StepSecurity Bot <[email protected]>
1 parent 3993c52 commit 3677c12

22 files changed

Lines changed: 328 additions & 117 deletions

‎.github/workflows/build-identifier-extractor.yml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ on:
1414
- 'identifier-extractor/**'
1515
- '.github/workflows/build-identifier-extractor.yml'
1616

17+
permissions:
18+
contents: read
19+
1720
jobs:
1821
build-identifier-extractor:
1922
name: "Build Identifier Extractor"
@@ -22,17 +25,22 @@ jobs:
2225
timeout-minutes: 60
2326

2427
steps:
28+
- name: Harden the runner (Audit all outbound calls)
29+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
30+
with:
31+
egress-policy: audit
32+
2533
- name: "Checkout"
26-
uses: actions/checkout@v4
34+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2735

2836
- name: "Install PHP"
29-
uses: "shivammathur/setup-php@v2"
37+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
3038
with:
3139
coverage: "none"
3240
php-version: "8.1"
3341

3442
- name: "Install Extractor dependencies"
35-
uses: "ramsey/composer-install@v3"
43+
uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
3644
with:
3745
working-directory: "identifier-extractor"
3846

‎.github/workflows/docker-nightly.yml‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ on:
1515
- '.phar-checksum'
1616
- 'bootstrap.php'
1717

18+
permissions:
19+
contents: read
20+
1821
jobs:
1922
docker:
2023
runs-on: ubuntu-latest
@@ -36,25 +39,30 @@ jobs:
3639
- docker-file: "./docker/Dockerfile.php.8.4"
3740
image-tag-suffix: "-php8.4"
3841
steps:
42+
- name: Harden the runner (Audit all outbound calls)
43+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
44+
with:
45+
egress-policy: audit
46+
3947
- name: Checkout
40-
uses: actions/checkout@v4
48+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
4149

4250
- name: Set up QEMU
43-
uses: docker/setup-qemu-action@v3
51+
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
4452

4553
- name: Set up Docker Buildx
4654
id: buildx
47-
uses: docker/setup-buildx-action@v3
55+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
4856

4957
- name: Login to ghcr
50-
uses: docker/login-action@v3
58+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
5159
with:
5260
registry: ghcr.io
5361
username: ${{ github.repository_owner }}
5462
password: ${{ secrets.GITHUB_TOKEN }}
5563

5664
- name: Build and push
57-
uses: docker/build-push-action@v5
65+
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
5866
with:
5967
builder: ${{ steps.buildx.outputs.name }}
6068
context: ./docker

‎.github/workflows/docker-stable.yml‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ on:
99
tags:
1010
- '2.*'
1111

12+
permissions:
13+
contents: read
14+
1215
jobs:
1316
docker:
1417
runs-on: ubuntu-latest
@@ -30,18 +33,23 @@ jobs:
3033
- docker-file: "./docker/Dockerfile.php.8.4"
3134
image-tag-suffix: "-php8.4"
3235
steps:
36+
- name: Harden the runner (Audit all outbound calls)
37+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
38+
with:
39+
egress-policy: audit
40+
3341
- name: Checkout
34-
uses: actions/checkout@v4
42+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3543

3644
- name: Set up QEMU
37-
uses: docker/setup-qemu-action@v3
45+
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
3846

3947
- name: Set up Docker Buildx
4048
id: buildx
41-
uses: docker/setup-buildx-action@v3
49+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
4250

4351
- name: Login to ghcr
44-
uses: docker/login-action@v3
52+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
4553
with:
4654
registry: ghcr.io
4755
username: ${{ github.repository_owner }}
@@ -52,7 +60,7 @@ jobs:
5260
run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
5361

5462
- name: Build and push
55-
uses: docker/build-push-action@v5
63+
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
5664
with:
5765
builder: ${{ steps.buildx.outputs.name }}
5866
context: ./docker

‎.github/workflows/extension-tests-run.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,15 @@ jobs:
2424
upload-phar:
2525
runs-on: "ubuntu-latest"
2626
steps:
27+
- name: Harden the runner (Audit all outbound calls)
28+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
29+
with:
30+
egress-policy: audit
31+
2732
- name: "Checkout"
28-
uses: actions/checkout@v4
33+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2934

30-
- uses: actions/upload-artifact@v4
35+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
3136
with:
3237
name: phar-file
3338
path: phpstan.phar

‎.github/workflows/extension-tests.yml‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,13 @@ jobs:
2121
outputs:
2222
checksum-result: ${{ steps.checksum-difference.outputs.result }}
2323
steps:
24+
- name: Harden the runner (Audit all outbound calls)
25+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
26+
with:
27+
egress-policy: audit
28+
2429
- name: "Checkout"
25-
uses: actions/checkout@v4
30+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2631
with:
2732
repository: "phpstan/phpstan"
2833
ref: ${{ inputs.ref }}
@@ -79,25 +84,30 @@ jobs:
7984
php-version: "8.5"
8085

8186
steps:
87+
- name: Harden the runner (Audit all outbound calls)
88+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
89+
with:
90+
egress-policy: audit
91+
8292
- name: "Checkout"
83-
uses: actions/checkout@v4
93+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
8494
with:
8595
repository: "phpstan/phpstan"
8696
ref: ${{ inputs.ref }}
8797

8898
- name: "Install PHP"
89-
uses: "shivammathur/setup-php@v2"
99+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
90100
with:
91101
coverage: "none"
92102
php-version: "${{ matrix.php-version }}"
93103
ini-file: development
94104
ini-values: memory_limit=768M
95105
extensions: soap
96106

97-
- uses: "ramsey/composer-install@v3"
107+
- uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
98108

99109
- name: "Download phpstan.phar"
100-
uses: Wandalen/[email protected]
110+
uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
101111
with:
102112
action: actions/download-artifact@v4
103113
with: |
@@ -106,12 +116,12 @@ jobs:
106116
attempt_delay: 1000
107117

108118
- name: "Checkout extension"
109-
uses: actions/checkout@v4
119+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
110120
with:
111121
repository: "phpstan/${{ matrix.extension-name }}"
112122
path: extension
113123

114-
- uses: "ramsey/composer-install@v3"
124+
- uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
115125
with:
116126
working-directory: "extension"
117127

‎.github/workflows/extract-identifiers.yml‎

Lines changed: 26 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ concurrency:
1616
group: extract-identifiers-${{ github.ref }} # will be canceled on subsequent pushes
1717
cancel-in-progress: true
1818

19+
permissions:
20+
contents: read
21+
1922
jobs:
2023
extract:
2124
name: "Extract identifiers"
@@ -38,23 +41,28 @@ jobs:
3841
- "phpstan/phpstan-mockery"
3942

4043
steps:
44+
- name: Harden the runner (Audit all outbound calls)
45+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
46+
with:
47+
egress-policy: audit
48+
4149
- name: "Checkout"
42-
uses: actions/checkout@v4
50+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
4351

4452
- name: "Checkout"
45-
uses: actions/checkout@v4
53+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
4654
with:
4755
repository: ${{ matrix.repository }}
4856
path: "identifier-extractor/repo"
4957

5058
- name: "Install PHP"
51-
uses: "shivammathur/setup-php@v2"
59+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
5260
with:
5361
coverage: "none"
5462
php-version: "8.1"
5563

5664
- name: "Install Extractor dependencies"
57-
uses: "ramsey/composer-install@v3"
65+
uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
5866
with:
5967
working-directory: "identifier-extractor"
6068

@@ -74,35 +82,42 @@ jobs:
7482
REPO: ${{ matrix.repository }}
7583
BRANCH: ${{ steps.branch-name.outputs.name }}
7684

77-
- uses: actions/upload-artifact@v4
85+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7886
with:
7987
name: identifiers-${{ steps.repo-name.outputs.name }}
8088
path: identifier-extractor/${{ steps.repo-name.outputs.name }}.json
8189

8290
merge:
91+
permissions:
92+
contents: write # for stefanzweifel/git-auto-commit-action to push code in repo
8393
name: "Merge and commit identifiers"
8494
needs: extract
8595

8696
runs-on: "ubuntu-latest"
8797

8898
steps:
99+
- name: Harden the runner (Audit all outbound calls)
100+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
101+
with:
102+
egress-policy: audit
103+
89104
- name: "Checkout"
90-
uses: actions/checkout@v4
105+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
91106
with:
92107
token: ${{ secrets.PHPSTAN_BOT_TOKEN }}
93108

94109
- name: "Install PHP"
95-
uses: "shivammathur/setup-php@v2"
110+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
96111
with:
97112
coverage: "none"
98113
php-version: "8.1"
99114

100115
- name: "Install Extractor dependencies"
101-
uses: "ramsey/composer-install@v3"
116+
uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
102117
with:
103118
working-directory: "identifier-extractor"
104119

105-
- uses: actions/download-artifact@v4
120+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
106121
with:
107122
pattern: identifiers-*
108123
path: identifier-extractor/tmp
@@ -112,7 +127,7 @@ jobs:
112127
run: "php merge.php > ../website/src/errorsIdentifiers.json"
113128

114129
- name: Import GPG key
115-
uses: crazy-max/ghaction-import-gpg@v6
130+
uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
116131
with:
117132
gpg_private_key: ${{ secrets.GPG_PHPSTANBOT_PRIVATE_KEY }}
118133
passphrase: ${{ secrets.GPG_PHPSTANBOT_KEY_PASSPHRASE }}
@@ -121,7 +136,7 @@ jobs:
121136
git_commit_gpgsign: true
122137

123138
- name: "Commit changes"
124-
uses: "stefanzweifel/git-auto-commit-action@v5"
139+
uses: "stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403" # v5.2.0
125140
id: "commit"
126141
with:
127142
commit_message: "Update errors identifiers"

‎.github/workflows/integration-tests-run.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,15 @@ jobs:
2626
upload-phar:
2727
runs-on: "ubuntu-latest"
2828
steps:
29+
- name: Harden the runner (Audit all outbound calls)
30+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
31+
with:
32+
egress-policy: audit
33+
2934
- name: "Checkout"
30-
uses: actions/checkout@v4
35+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3136

32-
- uses: actions/upload-artifact@v4
37+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
3338
with:
3439
name: phar-file
3540
path: phpstan.phar

0 commit comments

Comments
 (0)