Skip to content

Commit 3ff6a7f

Browse files
tashiantashian
authored
Merge pull request #289 from smallstep/carl/cicd-security-hardening
Harden CI/CD workflows against expression injection and secret leakage
2 parents fc6cf54 + aafcff6 commit 3ff6a7f

10 files changed

Lines changed: 59 additions & 19 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ jobs:
1919
actionlint:
2020
name: Lint GitHub workflows
2121
uses: ./.github/workflows/actionlint.yml
22-
secrets: inherit
2322

2423
lint-dummy-app: # NOTE(@azazeal): this check is here to verify that .golangci.yml is valid
2524
name: Lint dummy app

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,12 @@ jobs:
4343
-
4444
name: Install Dependencies
4545
if: ${{ inputs.os-dependencies != '' }}
46+
env:
47+
OS_DEPS: ${{ inputs.os-dependencies }}
4648
run: |
4749
sudo apt-get update
48-
sudo apt-get install ${{ inputs.os-dependencies }}
50+
# shellcheck disable=SC2086
51+
sudo apt-get install ${OS_DEPS}
4952
-
5053
name: Checkout
5154
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -109,8 +112,10 @@ jobs:
109112
make bootstrap
110113
-
111114
name: Build
115+
env:
116+
CODEQL_BUILD_CMD: ${{ inputs.codeql-build-cmd }}
112117
run: |
113-
${{ inputs.codeql-build-cmd }}
118+
eval "${CODEQL_BUILD_CMD}"
114119
-
115120
name: Perform CodeQL Analysis
116121
uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,15 @@ on:
66
DEPENDABOT_TOKEN:
77
required: true
88

9-
permissions:
10-
contents: write
11-
pull-requests: write
9+
permissions: {}
1210

1311
jobs:
1412
dependabot:
1513
runs-on: ubuntu-latest
1614
if: ${{ github.actor == 'dependabot[bot]' }}
15+
permissions:
16+
contents: write
17+
pull-requests: write
1718
steps:
1819
- name: Dependabot metadata
1920
id: metadata

‎.github/workflows/goBuild.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,12 @@ jobs:
5353
-
5454
name: Install Dependencies # Some dependencies require this package
5555
if: ${{ inputs.os-dependencies != '' }}
56+
env:
57+
OS_DEPS: ${{ inputs.os-dependencies }}
5658
run: |
5759
sudo apt-get update
58-
sudo apt-get install ${{ inputs.os-dependencies }}
60+
# shellcheck disable=SC2086
61+
sudo apt-get install ${OS_DEPS}
5962
-
6063
name: Checkout
6164
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -88,4 +91,6 @@ jobs:
8891
${{ secrets.SSH_PRIVATE_KEY }}
8992
-
9093
name: Build
91-
run: ${{ inputs.build-command }}
94+
env:
95+
BUILD_CMD: ${{ inputs.build-command }}
96+
run: eval "${BUILD_CMD}"

‎.github/workflows/goCI.yml‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -104,15 +104,19 @@ jobs:
104104
os-dependencies: ${{ inputs.os-dependencies }}
105105
skip-go-generate: ${{ inputs.lint-skip-go-generate }}
106106
skip-go-mod-tidy: ${{ inputs.lint-skip-go-mod-tidy }}
107-
secrets: inherit
107+
secrets:
108+
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
109+
PAT: ${{ secrets.PAT }}
108110

109111
govulncheck:
110112
uses: ./.github/workflows/govulncheck.yml
111113
if: inputs.run-govulncheck
112114
with:
113115
os-dependencies: ${{ inputs.os-dependencies }}
114116
goprivate: ${{ inputs.goprivate }}
115-
secrets: inherit
117+
secrets:
118+
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
119+
PAT: ${{ secrets.PAT }}
116120

117121
codeql:
118122
if: inputs.run-codeql
@@ -122,7 +126,9 @@ jobs:
122126
os-dependencies: ${{ inputs.os-dependencies }}
123127
codeql-make-bootstrap: ${{ inputs.codeql-make-bootstrap }}
124128
codeql-build-cmd: ${{ inputs.codeql-build-cmd }}
125-
secrets: inherit
129+
secrets:
130+
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
131+
PAT: ${{ secrets.PAT }}
126132

127133
test:
128134
uses: ./.github/workflows/goTest.yml
@@ -134,7 +140,10 @@ jobs:
134140
run-codecov: ${{ inputs.run-codecov }}
135141
setup-bats: ${{ inputs.setup-bats }}
136142
test-command: ${{ inputs.test-command }}
137-
secrets: inherit
143+
secrets:
144+
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
145+
PAT: ${{ secrets.PAT }}
146+
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
138147

139148
build:
140149
uses: ./.github/workflows/goBuild.yml
@@ -144,4 +153,6 @@ jobs:
144153
goprivate: ${{ inputs.goprivate }}
145154
only-latest-golang: ${{ inputs.only-latest-golang }}
146155
os-dependencies: ${{ inputs.os-dependencies }}
147-
secrets: inherit
156+
secrets:
157+
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
158+
PAT: ${{ secrets.PAT }}

‎.github/workflows/goLint.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,12 @@ jobs:
3939
-
4040
name: Install Dependencies # Some dependencies require this package
4141
if: ${{ inputs.os-dependencies != '' }}
42+
env:
43+
OS_DEPS: ${{ inputs.os-dependencies }}
4244
run: |
4345
sudo apt-get update
44-
sudo apt-get install ${{ inputs.os-dependencies }}
46+
# shellcheck disable=SC2086
47+
sudo apt-get install ${OS_DEPS}
4548
-
4649
name: Checkout
4750
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/goTest.yml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,9 +70,12 @@ jobs:
7070
-
7171
name: Install Dependencies
7272
if: inputs.os-dependencies != ''
73+
env:
74+
OS_DEPS: ${{ inputs.os-dependencies }}
7375
run: |
7476
sudo apt-get update
75-
sudo apt-get install ${{ inputs.os-dependencies }}
77+
# shellcheck disable=SC2086
78+
sudo apt-get install ${OS_DEPS}
7679
-
7780
name: Checkout
7881
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -123,8 +126,10 @@ jobs:
123126
${{ secrets.SSH_PRIVATE_KEY }}
124127
-
125128
name: Install gotestsum
129+
env:
130+
GOTESTSUM_VERSION: ${{ inputs.gotestsum-version }}
126131
run: |
127-
go install gotest.tools/gotestsum@v${{ inputs.gotestsum-version }}
132+
go install "gotest.tools/gotestsum@v${GOTESTSUM_VERSION}"
128133
-
129134
name: Setup BATS
130135
if: inputs.setup-bats
@@ -133,9 +138,10 @@ jobs:
133138
bats-version: 1.9.0
134139
-
135140
name: Run Test Suite
136-
run: ${{ inputs.test-command }}
137141
env:
142+
TEST_CMD: ${{ inputs.test-command }}
138143
GOTESTSUM_JSONFILE: gotestsum.json
144+
run: eval "${TEST_CMD}"
139145

140146
-
141147
name: Annotate Test Suite Results

‎.github/workflows/goreleaser.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,9 +79,12 @@ jobs:
7979
-
8080
name: Install Dependencies # Some dependencies require this package
8181
if: ${{ inputs.os-dependencies != '' }}
82+
env:
83+
OS_DEPS: ${{ inputs.os-dependencies }}
8284
run: |
8385
sudo apt-get update
84-
sudo apt-get install ${{ inputs.os-dependencies }}
86+
# shellcheck disable=SC2086
87+
sudo apt-get install ${OS_DEPS}
8588
-
8689
name: Checkout
8790
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/govulncheck.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,12 @@ jobs:
2323
-
2424
name: Install Dependencies # Some dependencies require this package
2525
if: ${{ inputs.os-dependencies != '' }}
26+
env:
27+
OS_DEPS: ${{ inputs.os-dependencies }}
2628
run: |
2729
sudo apt-get update
28-
sudo apt-get install ${{ inputs.os-dependencies }}
30+
# shellcheck disable=SC2086
31+
sudo apt-get install ${OS_DEPS}
2932
-
3033
name: Checkout
3134
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/triage.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ on:
1515
type: boolean
1616
default: true
1717

18+
permissions:
19+
pull-requests: write
20+
issues: write
21+
1822
jobs:
1923
label-pr:
2024
name: Label PR

0 commit comments

Comments
 (0)