From a53b728388e85dd706f5b6afc128a88dd885fcae Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Tue, 28 Jul 2026 03:36:03 +0000 Subject: [PATCH] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .../api-surface-area-review-verification.yml | 7 ++ .github/workflows/changelog-verification.yml | 7 ++ .github/workflows/closed-issue-message.yml | 7 ++ .github/workflows/codebuild-ci.yml | 70 +++++++++++++++++++ .github/workflows/codeql.yml | 7 ++ .../workflows/handle-stale-discussions.yml | 7 ++ .../workflows/issue-regression-labeler.yml | 7 ++ .../workflows/lock-conversation-closed-pr.yml | 7 ++ .github/workflows/merge-queue-metric.yml | 14 ++++ .github/workflows/new-module-verification.yml | 7 ++ .github/workflows/s3-regression-tests.yml | 49 +++++++++++++ .github/workflows/stale-issue.yml | 7 ++ 12 files changed, 196 insertions(+) diff --git a/.github/workflows/api-surface-area-review-verification.yml b/.github/workflows/api-surface-area-review-verification.yml index 0d3bf63925e1..79cbdc168e5f 100644 --- a/.github/workflows/api-surface-area-review-verification.yml +++ b/.github/workflows/api-surface-area-review-verification.yml @@ -15,6 +15,13 @@ jobs: api-surface-area-review-verification: runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: actions/checkout@v4 - name: Verifies updates to protected/public APIs have been reviewed and approved by the team, if any id: api-surface-area-review-verification diff --git a/.github/workflows/changelog-verification.yml b/.github/workflows/changelog-verification.yml index e39917c80c27..abb52c39d364 100644 --- a/.github/workflows/changelog-verification.yml +++ b/.github/workflows/changelog-verification.yml @@ -15,6 +15,13 @@ jobs: changelog-verification: runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: actions/checkout@v4 - name: Check for changelog entry if: ${{ !contains(github.event.pull_request.labels.*.name, 'changelog-not-required') }} diff --git a/.github/workflows/closed-issue-message.yml b/.github/workflows/closed-issue-message.yml index 1464dd66821c..334ebc9a23ee 100644 --- a/.github/workflows/closed-issue-message.yml +++ b/.github/workflows/closed-issue-message.yml @@ -9,6 +9,13 @@ jobs: permissions: issues: write steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: aws-actions/closed-issue-message@v1 with: # These inputs are both required diff --git a/.github/workflows/codebuild-ci.yml b/.github/workflows/codebuild-ci.yml index fa523f4c0476..a6d39a709f56 100644 --- a/.github/workflows/codebuild-ci.yml +++ b/.github/workflows/codebuild-ci.yml @@ -18,6 +18,13 @@ jobs: if: github.repository == 'aws/aws-sdk-java-v2' runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -33,6 +40,13 @@ jobs: if: github.repository == 'aws/aws-sdk-java-v2' runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -48,6 +62,13 @@ jobs: if: github.repository == 'aws/aws-sdk-java-v2' runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -63,6 +84,13 @@ jobs: if: github.repository == 'aws/aws-sdk-java-v2' runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -78,6 +106,13 @@ jobs: if: github.repository == 'aws/aws-sdk-java-v2' runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -92,6 +127,13 @@ jobs: if: github.repository == 'aws/aws-sdk-java-v2' runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -106,6 +148,13 @@ jobs: if: github.repository == 'aws/aws-sdk-java-v2' runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -129,6 +178,13 @@ jobs: if: github.repository == 'aws/aws-sdk-java-v2' runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -143,6 +199,13 @@ jobs: if: github.repository == 'aws/aws-sdk-java-v2' runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -157,6 +220,13 @@ jobs: if: github.repository == 'aws/aws-sdk-java-v2' runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 48f3f08a6b46..9a8ba2d779e0 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -47,6 +47,13 @@ jobs: # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout repository uses: actions/checkout@v4 diff --git a/.github/workflows/handle-stale-discussions.yml b/.github/workflows/handle-stale-discussions.yml index cd916ad6eb7d..013823a0cf86 100644 --- a/.github/workflows/handle-stale-discussions.yml +++ b/.github/workflows/handle-stale-discussions.yml @@ -13,6 +13,13 @@ jobs: permissions: discussions: write steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Stale discussions action uses: aws-github-ops/handle-stale-discussions@v1 with: diff --git a/.github/workflows/issue-regression-labeler.yml b/.github/workflows/issue-regression-labeler.yml index 9ba107d3b0ce..cb918c7ec58e 100644 --- a/.github/workflows/issue-regression-labeler.yml +++ b/.github/workflows/issue-regression-labeler.yml @@ -10,6 +10,13 @@ jobs: permissions: issues: write steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Fetch template body id: check_regression uses: actions/github-script@v7 diff --git a/.github/workflows/lock-conversation-closed-pr.yml b/.github/workflows/lock-conversation-closed-pr.yml index 0e75c1b07aa1..e20f73e52031 100644 --- a/.github/workflows/lock-conversation-closed-pr.yml +++ b/.github/workflows/lock-conversation-closed-pr.yml @@ -12,6 +12,13 @@ jobs: permissions: pull-requests: write steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Lock PR conversation on Close uses: actions/github-script@v7 env: diff --git a/.github/workflows/merge-queue-metric.yml b/.github/workflows/merge-queue-metric.yml index 259f03e4d268..a5e50b3b341e 100644 --- a/.github/workflows/merge-queue-metric.yml +++ b/.github/workflows/merge-queue-metric.yml @@ -17,6 +17,13 @@ jobs: if: ${{ github.repository == 'aws/aws-sdk-java-v2' && github.event.action == 'enqueued' }} steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -31,6 +38,13 @@ jobs: runs-on: ubuntu-latest if: ${{ github.repository == 'aws/aws-sdk-java-v2' && github.event.action == 'dequeued' && github.event.reason != 'MERGE'}} steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: diff --git a/.github/workflows/new-module-verification.yml b/.github/workflows/new-module-verification.yml index 26465313c9ad..dfb6441341ad 100644 --- a/.github/workflows/new-module-verification.yml +++ b/.github/workflows/new-module-verification.yml @@ -18,6 +18,13 @@ jobs: timeout-minutes: 10 steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout repository uses: actions/checkout@v4 with: diff --git a/.github/workflows/s3-regression-tests.yml b/.github/workflows/s3-regression-tests.yml index abad4b4e675f..cf53f8cac49c 100644 --- a/.github/workflows/s3-regression-tests.yml +++ b/.github/workflows/s3-regression-tests.yml @@ -16,6 +16,13 @@ jobs: outputs: has_s3_related_changes: ${{ steps.check-changes.outputs.has_s3_related_changes }} steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: actions/checkout@v4 with: fetch-depth: 0 @@ -40,6 +47,13 @@ jobs: REGRESSION_TEST: DownloadStreamingRegressionTesting HAS_S3_CHANGES: ${{ needs.check-s3-related-changes.outputs.has_s3_related_changes }} steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -60,6 +74,13 @@ jobs: REGRESSION_TEST: ControlPlaneOperationRegressionTesting HAS_S3_CHANGES: ${{ needs.check-s3-related-changes.outputs.has_s3_related_changes }} steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -80,6 +101,13 @@ jobs: REGRESSION_TEST: UploadSyncRegressionTesting HAS_S3_CHANGES: ${{ needs.check-s3-related-changes.outputs.has_s3_related_changes }} steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -100,6 +128,13 @@ jobs: REGRESSION_TEST: UploadAsyncRegressionTesting HAS_S3_CHANGES: ${{ needs.check-s3-related-changes.outputs.has_s3_related_changes }} steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -120,6 +155,13 @@ jobs: REGRESSION_TEST: UploadCrtRegressionTesting HAS_S3_CHANGES: ${{ needs.check-s3-related-changes.outputs.has_s3_related_changes }} steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: @@ -140,6 +182,13 @@ jobs: REGRESSION_TEST: UploadTransferManagerRegressionTesting HAS_S3_CHANGES: ${{ needs.check-s3-related-changes.outputs.has_s3_related_changes }} steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: diff --git a/.github/workflows/stale-issue.yml b/.github/workflows/stale-issue.yml index 2ea048c36b84..8540a027b898 100644 --- a/.github/workflows/stale-issue.yml +++ b/.github/workflows/stale-issue.yml @@ -14,6 +14,13 @@ jobs: issues: write pull-requests: write steps: + - name: Harden the runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + use-policy-store: true + egress-policy: audit + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: aws-actions/stale-issue-cleanup@v4 with: # Setting messages to an empty string will cause the automation to skip