Skip to content

[Dependencies]: Bump step-security/harden-runner from 2.7.0 to 2.7.1 #465

[Dependencies]: Bump step-security/harden-runner from 2.7.0 to 2.7.1

[Dependencies]: Bump step-security/harden-runner from 2.7.0 to 2.7.1 #465

name: "Dependabot: Approve updates"
on:
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests
# could and should work, at least for public repos;
# tracking issue for this action's issue:
# https://github.com/ahmadnassri/action-dependabot-auto-merge/issues/60
pull_request_target:
types:
- opened
- edited
- reopened
- synchronize
- ready_for_review
branches:
- main
jobs:
enable-auto-merge-github-actions:
if: |-
vars.DEPENDABOT_AUTOMERGE == 'true' &&
startsWith(github.head_ref, 'dependabot/github_actions/')
runs-on: [self-hosted, linux]
permissions:
contents: write
pull-requests: write
# Specifically check that dependabot (or another trusted party) created this pull-request, and that it has been labelled correctly.
steps:
- name: "Initialise Workspace"
if: startsWith(runner.name, 'buildagent-')
shell: bash
run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
- name: "Harden Security"
uses: step-security/[email protected]
with:
egress-policy: audit
disable-sudo: true
allowed-endpoints: >
api.github.com:443
api.osv.dev:443
api.securityscorecards.dev:443
codeload.github.com:443
fulcio.sigstore.dev:443
github.com:443
oss-fuzz-build-logs.storage.googleapis.com:443
rekor.sigstore.dev:443
tuf-repo-cdn.sigstore.dev:443
www.bestpractices.dev:443
#egress-policy: audit
- name: "Check Repo Owner"
uses: actions/[email protected]
with:
script: |
core.info('Owner: ${{github.repository_owner}}');
- name: "Auto Merge"
uses: alexwilson/[email protected]
with:
github-token: ${{secrets.SOURCE_PUSH_TOKEN}}
merge-method: "MERGE"
enable-auto-merge-npm:
if: |-
vars.DEPENDABOT_AUTOMERGE == 'true' &&
startsWith(github.head_ref, 'dependabot/npm_and_yarn/')
runs-on: [self-hosted, linux]
permissions:
contents: write
pull-requests: write
# Specifically check that dependabot (or another trusted party) created this pull-request, and that it has been labelled correctly.
steps:
- name: "Initialise Workspace"
if: startsWith(runner.name, 'buildagent-')
shell: bash
run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
- name: "Harden Security"
uses: step-security/[email protected]
with:
egress-policy: audit
disable-sudo: true
allowed-endpoints: >
api.github.com:443
api.osv.dev:443
api.securityscorecards.dev:443
codeload.github.com:443
fulcio.sigstore.dev:443
github.com:443
oss-fuzz-build-logs.storage.googleapis.com:443
rekor.sigstore.dev:443
tuf-repo-cdn.sigstore.dev:443
www.bestpractices.dev:443
#egress-policy: audit
- name: "Check Repo Owner"
uses: actions/[email protected]
with:
script: |
core.info('Owner: ${{github.repository_owner}}');
- name: "Auto Merge"
uses: alexwilson/[email protected]
with:
github-token: ${{secrets.SOURCE_PUSH_TOKEN}}
merge-method: "MERGE"
auto-approve-dependabot-gitub-actions:
if: |-
vars.DEPENDABOT_AUTOMERGE == 'true' &&
startsWith(github.head_ref, 'dependabot/github_actions/')
runs-on: [self-hosted, linux]
permissions:
contents: write
pull-requests: write
steps:
- name: "Initialise Workspace"
if: startsWith(runner.name, 'buildagent-')
shell: bash
run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
- name: "Harden Security"
uses: step-security/[email protected]
with:
egress-policy: audit
disable-sudo: true
allowed-endpoints: >
api.github.com:443
api.osv.dev:443
api.securityscorecards.dev:443
codeload.github.com:443
fulcio.sigstore.dev:443
github.com:443
oss-fuzz-build-logs.storage.googleapis.com:443
rekor.sigstore.dev:443
tuf-repo-cdn.sigstore.dev:443
www.bestpractices.dev:443
#egress-policy: audit
- name: "Check Repo Owner"
uses: actions/[email protected]
with:
script: |
core.info('Owner: ${{github.repository_owner}}');
- name: "Approve"
uses: hmarr/auto-approve-action@v4
with:
github-token: ${{secrets.SOURCE_PUSH_TOKEN}}
auto-approve-dependabot-npm:
if: |-
vars.DEPENDABOT_AUTOMERGE == 'true' &&
startsWith(github.head_ref, 'dependabot/npm_and_yarn/')
runs-on: [self-hosted, linux]
permissions:
contents: write
pull-requests: write
steps:
- name: "Initialise Workspace"
if: startsWith(runner.name, 'buildagent-')
shell: bash
run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
- name: "Harden Security"
uses: step-security/[email protected]
with:
egress-policy: audit
disable-sudo: true
allowed-endpoints: >
api.github.com:443
api.osv.dev:443
api.securityscorecards.dev:443
codeload.github.com:443
fulcio.sigstore.dev:443
github.com:443
oss-fuzz-build-logs.storage.googleapis.com:443
rekor.sigstore.dev:443
tuf-repo-cdn.sigstore.dev:443
www.bestpractices.dev:443
#egress-policy: audit
- name: "Check Repo Owner"
uses: actions/[email protected]
with:
script: |
core.info('Owner: ${{github.repository_owner}}');
- name: "Approve"
uses: hmarr/auto-approve-action@v4
with:
github-token: ${{secrets.SOURCE_PUSH_TOKEN}}