[StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <[email protected]>
FrancoisCarouge · Sep 28, 2023 · 5811e20 · 5811e20
1 parent e2f1090
commit 5811e20
Show file tree

Hide file tree

Showing 13 changed files with 135 additions and 0 deletions.
diff --git a/.github/workflows/clang_tidy.yml b/.github/workflows/clang_tidy.yml
@@ -8,10 +8,18 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-22.04
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: "Tool: Clang 16"

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -8,6 +8,9 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
@@ -22,6 +25,11 @@ jobs:
       matrix:
         language: [ 'cpp' ]
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout repository
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: Initialize CodeQL

diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
@@ -8,10 +8,18 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-22.04
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: Install

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -0,0 +1,27 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1
diff --git a/.github/workflows/deploy_doxygen.yml b/.github/workflows/deploy_doxygen.yml
@@ -6,10 +6,20 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      contents: write  # for peaceiris/actions-gh-pages to push pages branch
     runs-on: ubuntu-20.04
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: Doxygen

diff --git a/.github/workflows/deploy_test_coverage_coveralls.yml b/.github/workflows/deploy_test_coverage_coveralls.yml
@@ -8,10 +8,21 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      checks: write  # for coverallsapp/github-action to create new checks
+      contents: read  # for actions/checkout to fetch code
     runs-on: ubuntu-22.04
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: "Install"

diff --git a/.github/workflows/doxygen.yml b/.github/workflows/doxygen.yml
@@ -8,10 +8,18 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-20.04
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: Doxygen

diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
@@ -8,10 +8,18 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: "Checkout"
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: "Install"

diff --git a/.github/workflows/memory_valgrind.yml b/.github/workflows/memory_valgrind.yml
@@ -8,10 +8,18 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-22.04
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: Install

diff --git a/.github/workflows/openssf_scorecard.yml b/.github/workflows/openssf_scorecard.yml
@@ -15,6 +15,11 @@ jobs:
       security-events: write
       id-token: write
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+        with:
+          egress-policy: audit
+
       - name: "Checkout Code"
         uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
         with:

diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
@@ -8,6 +8,9 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
@@ -23,6 +26,11 @@ jobs:
     name: "${{ matrix.os }} / ${{ matrix.compiler }} / ${{ matrix.generator }} / ${{ matrix.config }}"
     runs-on: "${{ matrix.os }}"
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: "Checkout"
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: "Tool: Microsoft Windows"

diff --git a/.github/workflows/sanitizer.yml b/.github/workflows/sanitizer.yml
@@ -8,6 +8,9 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
@@ -31,6 +34,11 @@ jobs:
     env:
       CXXFLAGS: "${{ matrix.sanitizer.cpp_flags }}"
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: "Checkout"
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: "Configure"

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -0,0 +1,18 @@
+repos:
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.16.3
+  hooks:
+  - id: gitleaks
+- repo: https://github.com/jumanjihouse/pre-commit-hooks
+  rev: 3.0.0
+  hooks:
+  - id: shellcheck
+- repo: https://github.com/pocc/pre-commit-hooks
+  rev: v1.3.5
+  hooks:
+  - id: cpplint
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace