Skip to content

Commit f666928

Browse files
step-security-botondrejmirtes
step-security-bot
authored and
ondrejmirtes
committed
[StepSecurity] ci: Harden GitHub Actions
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
1 parent 44a216a commit f666928

9 files changed

Lines changed: 109 additions & 28 deletions

‎.github/workflows/build.yml‎

Lines changed: 37 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,16 @@ jobs:
3030
- "8.5"
3131

3232
steps:
33+
- name: Harden the runner (Audit all outbound calls)
34+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
35+
with:
36+
egress-policy: audit
37+
3338
- name: "Checkout"
34-
uses: actions/checkout@v5
39+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
3540

3641
- name: "Install PHP"
37-
uses: "shivammathur/setup-php@v2"
42+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
3843
with:
3944
coverage: "none"
4045
php-version: "${{ matrix.php-version }}"
@@ -56,18 +61,23 @@ jobs:
5661
runs-on: "ubuntu-latest"
5762

5863
steps:
64+
- name: Harden the runner (Audit all outbound calls)
65+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
66+
with:
67+
egress-policy: audit
68+
5969
- name: "Checkout"
60-
uses: actions/checkout@v5
70+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
6171

6272
- name: "Checkout build-cs"
63-
uses: actions/checkout@v5
73+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
6474
with:
6575
repository: "phpstan/build-cs"
6676
path: "build-cs"
6777
ref: "2.x"
6878

6979
- name: "Install PHP"
70-
uses: "shivammathur/setup-php@v2"
80+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
7181
with:
7282
coverage: "none"
7383
php-version: "8.2"
@@ -124,11 +134,16 @@ jobs:
124134
composer require --dev doctrine/orm:^3.0 doctrine/dbal:^4.0 carbonphp/carbon-doctrine-types:^3 gedmo/doctrine-extensions:^3 -W
125135
126136
steps:
137+
- name: Harden the runner (Audit all outbound calls)
138+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
139+
with:
140+
egress-policy: audit
141+
127142
- name: "Checkout"
128-
uses: actions/checkout@v5
143+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
129144

130145
- name: "Install PHP"
131-
uses: "shivammathur/setup-php@v2"
146+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
132147
with:
133148
coverage: "none"
134149
php-version: "${{ matrix.php-version }}"
@@ -163,11 +178,16 @@ jobs:
163178
- "8.4"
164179

165180
steps:
181+
- name: Harden the runner (Audit all outbound calls)
182+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
183+
with:
184+
egress-policy: audit
185+
166186
- name: "Checkout"
167-
uses: actions/checkout@v5
187+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
168188

169189
- name: "Checkout build-infection"
170-
uses: actions/checkout@v5
190+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
171191
with:
172192
repository: "phpstan/build-infection"
173193
path: "build-infection"
@@ -192,7 +212,7 @@ jobs:
192212
cat infection.json5 | jq
193213
194214
- name: "Cache Result cache"
195-
uses: actions/cache@v4
215+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
196216
with:
197217
path: ./tmp
198218
key: "result-cache-v1-${{ matrix.php-version }}-${{ github.run_id }}"
@@ -234,11 +254,16 @@ jobs:
234254
update-packages: "composer require --dev doctrine/orm:^3.0 doctrine/dbal:^4.0 carbonphp/carbon-doctrine-types:^3 gedmo/doctrine-extensions:^3 -W"
235255

236256
steps:
257+
- name: Harden the runner (Audit all outbound calls)
258+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
259+
with:
260+
egress-policy: audit
261+
237262
- name: "Checkout"
238-
uses: actions/checkout@v5
263+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
239264

240265
- name: "Install PHP"
241-
uses: "shivammathur/setup-php@v2"
266+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
242267
with:
243268
coverage: "none"
244269
php-version: "${{ matrix.php-version }}"

‎.github/workflows/claude-react-on-comment.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@ jobs:
2828
outputs:
2929
triggered: ${{ steps.check.outputs.triggered }}
3030
steps:
31+
- name: Harden the runner (Audit all outbound calls)
32+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
33+
with:
34+
egress-policy: audit
35+
3136
- name: "Check for trigger phrase"
3237
id: check
3338
env:
@@ -47,11 +52,16 @@ jobs:
4752
timeout-minutes: 60
4853

4954
steps:
55+
- name: Harden the runner (Audit all outbound calls)
56+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
57+
with:
58+
egress-policy: audit
59+
5060
- name: "Checkout"
51-
uses: actions/checkout@v4
61+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
5262

5363
- name: "React to feedback"
54-
uses: anthropics/claude-code-action@v1
64+
uses: anthropics/claude-code-action@35a9e0292d36f1186f5d842b14eb575074e8b450 # v1.0.57
5565
with:
5666
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
5767
trigger_phrase: "@phpstan-bot"

‎.github/workflows/create-tag.yml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,33 +20,38 @@ jobs:
2020
name: "Create tag"
2121
runs-on: "ubuntu-latest"
2222
steps:
23+
- name: Harden the runner (Audit all outbound calls)
24+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
25+
with:
26+
egress-policy: audit
27+
2328
- name: "Checkout"
24-
uses: actions/checkout@v5
29+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
2530
with:
2631
fetch-depth: 0
2732
token: ${{ secrets.PHPSTAN_BOT_TOKEN }}
2833

2934
- name: 'Get Previous tag'
3035
id: previoustag
31-
uses: "WyriHaximus/github-action-get-previous-tag@v1"
36+
uses: "WyriHaximus/github-action-get-previous-tag@04e8485ecb6487243907e330d522ff60f02283ce" # v1.4.0
3237
env:
3338
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
3439

3540
- name: 'Get next versions'
3641
id: semvers
37-
uses: "WyriHaximus/github-action-next-semvers@v1"
42+
uses: "WyriHaximus/github-action-next-semvers@d079934efaf011a4cf8912d4637097fe35d32b93" # v1
3843
with:
3944
version: ${{ steps.previoustag.outputs.tag }}
4045

4146
- name: "Create new minor tag"
42-
uses: rickstaa/action-create-tag@v1
47+
uses: rickstaa/action-create-tag@a1c7777fcb2fee4f19b0f283ba888afa11678b72 # v1.7.2
4348
if: inputs.version == 'minor'
4449
with:
4550
tag: ${{ steps.semvers.outputs.minor }}
4651
message: ${{ steps.semvers.outputs.minor }}
4752

4853
- name: "Create new patch tag"
49-
uses: rickstaa/action-create-tag@v1
54+
uses: rickstaa/action-create-tag@a1c7777fcb2fee4f19b0f283ba888afa11678b72 # v1.7.2
5055
if: inputs.version == 'patch'
5156
with:
5257
tag: ${{ steps.semvers.outputs.patch }}

‎.github/workflows/lock-closed-issues.yml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,21 @@ on:
44
schedule:
55
- cron: '3 0 * * *'
66

7+
permissions:
8+
contents: read
9+
710
jobs:
811
lock:
12+
permissions:
13+
issues: write # for dessant/lock-threads to lock issues
914
runs-on: ubuntu-latest
1015
steps:
11-
- uses: dessant/lock-threads@v5
16+
- name: Harden the runner (Audit all outbound calls)
17+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
18+
with:
19+
egress-policy: audit
20+
21+
- uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
1222
with:
1323
github-token: ${{ github.token }}
1424
issue-inactive-days: '31'

‎.github/workflows/platform-test.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ on:
88
branches:
99
- "2.0.x"
1010

11+
permissions:
12+
contents: read
13+
1114
jobs:
1215
tests:
1316
name: "Platform test"
@@ -39,11 +42,16 @@ jobs:
3942
update-packages: doctrine/orm:^3.0 doctrine/dbal:^4.0 carbonphp/carbon-doctrine-types:^3 gedmo/doctrine-extensions:^3
4043

4144
steps:
45+
- name: Harden the runner (Audit all outbound calls)
46+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
47+
with:
48+
egress-policy: audit
49+
4250
- name: "Checkout"
43-
uses: actions/checkout@v5
51+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
4452

4553
- name: "Install PHP"
46-
uses: "shivammathur/setup-php@v2"
54+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
4755
with:
4856
coverage: "none"
4957
php-version: "${{ matrix.php-version }}"

‎.github/workflows/release-toot.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,12 @@ jobs:
1010
toot:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: cbrgm/mastodon-github-action@v2
13+
- name: Harden the runner (Audit all outbound calls)
14+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
15+
with:
16+
egress-policy: audit
17+
18+
- uses: cbrgm/mastodon-github-action@845250b56b82d94e26bf23984d5e0cf5ced6d18f # v2.1.25
1419
if: ${{ !github.event.repository.private }}
1520
with:
1621
# GitHub event payload

‎.github/workflows/release-tweet.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,12 @@ jobs:
1010
tweet:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: Eomm/why-don-t-you-tweet@v2
13+
- name: Harden the runner (Audit all outbound calls)
14+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
15+
with:
16+
egress-policy: audit
17+
18+
- uses: Eomm/why-don-t-you-tweet@d9ec12835f4d494dda920f95f885df3dba380493 # v2.0.0
1419
if: ${{ !github.event.repository.private }}
1520
with:
1621
# GitHub event payload

‎.github/workflows/release.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,23 @@ jobs:
1313
runs-on: "ubuntu-latest"
1414

1515
steps:
16+
- name: Harden the runner (Audit all outbound calls)
17+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
18+
with:
19+
egress-policy: audit
20+
1621
- name: "Checkout"
17-
uses: actions/checkout@v5
22+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
1823

1924
- name: Generate changelog
2025
id: changelog
21-
uses: metcalfc/changelog-generator@v4.6.2
26+
uses: metcalfc/changelog-generator@3f82cef08fe5dcf57c591fe165e70e1d5032e15a # v4.6.2
2227
with:
2328
myToken: ${{ secrets.PHPSTAN_BOT_TOKEN }}
2429

2530
- name: "Create release"
2631
id: create-release
27-
uses: actions/create-release@v1
32+
uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
2833
env:
2934
GITHUB_TOKEN: ${{ secrets.PHPSTAN_BOT_TOKEN }}
3035
with:

‎.github/workflows/test-projects.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
branches:
88
- "2.0.x"
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
test-projects:
1215
name: "Test projects"
@@ -21,7 +24,12 @@ jobs:
2124
- "packagist/private-packagist"
2225

2326
steps:
24-
- uses: peter-evans/repository-dispatch@v3
27+
- name: Harden the runner (Audit all outbound calls)
28+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
29+
with:
30+
egress-policy: audit
31+
32+
- uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
2533
with:
2634
token: ${{ secrets.REPO_ACCESS_TOKEN }}
2735
repository: "${{ matrix.repository }}"

0 commit comments

Comments
 (0)