From 8717d055fb73723bce468be5d2377c08ed52f751 Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Mon, 4 May 2026 15:04:26 +0000 Subject: [PATCH] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/dependabot.yml | 73 +++++++++++++++++++++ .github/workflows/build-gradle-plugin.yml | 7 +- .github/workflows/build-maven-plugin.yml | 12 +++- .github/workflows/build-sdk.yml | 8 +++ .github/workflows/manual.yml | 8 +++ .github/workflows/publish-gradle-plugin.yml | 7 +- .github/workflows/publish-maven-plugin.yml | 13 ++++ .github/workflows/publish-sdk.yml | 13 ++++ .pre-commit-config.yaml | 13 ++++ 9 files changed, 151 insertions(+), 3 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .pre-commit-config.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..cdf00f5d --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,73 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + dev-dependencies: + applies-to: version-updates + patterns: + - '*' + dependency-type: development + production-dependencies: + applies-to: version-updates + patterns: + - '*' + dependency-type: production + cooldown: + default-days: 7 + include: + - '*' + exclude: + - react + + - package-ecosystem: maven + directory: /maven-plugin + schedule: + interval: daily + groups: + dev-dependencies: + applies-to: version-updates + patterns: + - '*' + dependency-type: development + production-dependencies: + applies-to: version-updates + patterns: + - '*' + dependency-type: production + cooldown: + default-days: 7 + semver-major-days: 30 + semver-minor-days: 14 + semver-patch-days: 5 + include: + - '*' + exclude: + - react + + - package-ecosystem: maven + directory: /sdk + schedule: + interval: daily + groups: + dev-dependencies: + applies-to: version-updates + patterns: + - '*' + dependency-type: development + production-dependencies: + applies-to: version-updates + patterns: + - '*' + dependency-type: production + cooldown: + default-days: 7 + semver-major-days: 30 + semver-minor-days: 14 + semver-patch-days: 5 + include: + - '*' + exclude: + - react diff --git a/.github/workflows/build-gradle-plugin.yml b/.github/workflows/build-gradle-plugin.yml index 3bac45e6..710e6e99 100644 --- a/.github/workflows/build-gradle-plugin.yml +++ b/.github/workflows/build-gradle-plugin.yml @@ -13,6 +13,11 @@ jobs: name: Build runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 + with: + egress-policy: audit + - name: Checkout uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 @@ -23,7 +28,7 @@ jobs: distribution: temurin - name: 🐘 Setup Gradle - uses: gradle/actions/setup-gradle@v4 + uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3 - name: Build Gradle Plugin run: cd gradle-plugin/ && ./gradlew build diff --git a/.github/workflows/build-maven-plugin.yml b/.github/workflows/build-maven-plugin.yml index dad5cfcc..d2bceb72 100644 --- a/.github/workflows/build-maven-plugin.yml +++ b/.github/workflows/build-maven-plugin.yml @@ -6,11 +6,21 @@ jobs: changelog: runs-on: ubuntu-latest steps: - - uses: dangoslen/changelog-enforcer@v3 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 + with: + egress-policy: audit + + - uses: dangoslen/changelog-enforcer@204e7d3ef26579f4cd0fd759c57032656fdf23c7 # v3.6.1 build: name: Verify runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 + with: + egress-policy: audit + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0 diff --git a/.github/workflows/build-sdk.yml b/.github/workflows/build-sdk.yml index 66790d3f..0116afdd 100644 --- a/.github/workflows/build-sdk.yml +++ b/.github/workflows/build-sdk.yml @@ -8,11 +8,19 @@ on: - main pull_request: +permissions: + contents: read + jobs: build: name: Verify runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 + with: + egress-policy: audit + - name: Checkout uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 diff --git a/.github/workflows/manual.yml b/.github/workflows/manual.yml index d57a777b..35794b86 100644 --- a/.github/workflows/manual.yml +++ b/.github/workflows/manual.yml @@ -3,9 +3,17 @@ name: manual on: workflow_dispatch: +permissions: + contents: read + jobs: hello: runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 + with: + egress-policy: audit + - name: Say Hello run: echo "hello world" diff --git a/.github/workflows/publish-gradle-plugin.yml b/.github/workflows/publish-gradle-plugin.yml index 0c4bdc1e..b928080a 100644 --- a/.github/workflows/publish-gradle-plugin.yml +++ b/.github/workflows/publish-gradle-plugin.yml @@ -9,6 +9,11 @@ jobs: runs-on: ubuntu-latest environment: Gradle Plugin Portal steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 + with: + egress-policy: audit + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Setup Java @@ -18,7 +23,7 @@ jobs: distribution: temurin - name: 🐘 Setup Gradle - uses: gradle/actions/setup-gradle@v4 + uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3 - name: Gradle Release diff --git a/.github/workflows/publish-maven-plugin.yml b/.github/workflows/publish-maven-plugin.yml index 9ce8302e..62bd39f3 100644 --- a/.github/workflows/publish-maven-plugin.yml +++ b/.github/workflows/publish-maven-plugin.yml @@ -3,11 +3,19 @@ name: publish-maven-plugin on: workflow_dispatch: +permissions: + contents: read + jobs: check-branch: runs-on: ubuntu-latest if: github.ref == 'refs/heads/main' steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 + with: + egress-policy: audit + - name: Fail if on main branch run: | echo "Error: This workflow must be run on a release branch" @@ -19,6 +27,11 @@ jobs: environment: Maven Central runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 + with: + egress-policy: audit + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Set up JDK 11 diff --git a/.github/workflows/publish-sdk.yml b/.github/workflows/publish-sdk.yml index a482d638..d9e6873c 100644 --- a/.github/workflows/publish-sdk.yml +++ b/.github/workflows/publish-sdk.yml @@ -3,11 +3,19 @@ name: publish-sdk on: workflow_dispatch: +permissions: + contents: read + jobs: check-branch: runs-on: ubuntu-latest if: github.ref == 'refs/heads/main' steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 + with: + egress-policy: audit + - name: Fail if on main branch run: | echo "Error: This workflow must be run on a release branch" @@ -19,6 +27,11 @@ jobs: environment: Maven Central runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 + with: + egress-policy: audit + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Set up JDK 11 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 00000000..e17b03df --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,13 @@ +repos: +- repo: https://github.com/gitleaks/gitleaks + rev: v8.16.3 + hooks: + - id: gitleaks +- repo: https://github.com/jumanjihouse/pre-commit-hooks + rev: 3.0.0 + hooks: + - id: shellcheck +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.4.0 + hooks: + - id: end-of-file-fixer