diff --git a/.github/workflows/build-image.yaml b/.github/workflows/build-image.yaml index a2116fa3..de68ffc8 100644 --- a/.github/workflows/build-image.yaml +++ b/.github/workflows/build-image.yaml @@ -19,10 +19,6 @@ jobs: packages: write # for docker/build-push-action to push images runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0 - uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 58107f62..c0c202cb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,7 +8,7 @@ on: concurrency: group: ci-${{ github.head_ref || github.ref }} cancel-in-progress: true -permissions: # added using https://github.com/step-security/secure-workflows +permissions: contents: read jobs: golangci-lint: @@ -17,10 +17,6 @@ jobs: pull-requests: read # for golangci/golangci-lint-action to fetch pull requests runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: @@ -34,19 +30,11 @@ jobs: yaml-lint: runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3.1.1 markdown-lint: runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - uses: nosborn/github-action-markdown-cli@9b5e871c11cc0649c5ac2526af22e23525fa344d # v3.3.0 with: @@ -54,10 +42,6 @@ jobs: verify-generated: runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: @@ -82,10 +66,6 @@ jobs: needs: verify-generated runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: @@ -103,10 +83,6 @@ jobs: # renovate: datasource=github-tags depName=k3d-io/k3d K3D_VERSION: v5.6.0 steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0 - uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 diff --git a/.github/workflows/clean-ghcr.yaml b/.github/workflows/clean-ghcr.yaml index 6d453459..5126c556 100644 --- a/.github/workflows/clean-ghcr.yaml +++ b/.github/workflows/clean-ghcr.yaml @@ -14,10 +14,6 @@ jobs: packages: write # for snok/container-retention-policy to delete images runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - name: Delete untagged container images older than a week uses: snok/container-retention-policy@04c70fd030033036d69c0057e0d125bf25820544 # v2.1.2 with: diff --git a/.github/workflows/clear-cache.yaml b/.github/workflows/clear-cache.yaml index 128f4ffa..fa13b3bd 100644 --- a/.github/workflows/clear-cache.yaml +++ b/.github/workflows/clear-cache.yaml @@ -8,11 +8,6 @@ jobs: clear-cache: runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - - name: Clear cache run: | gh extension install actions/gh-actions-cache diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 07fdc8d2..d155c3af 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -22,7 +22,7 @@ on: concurrency: group: codeql-${{ github.head_ref || github.ref }} cancel-in-progress: true -permissions: # added using https://github.com/step-security/secure-workflows +permissions: contents: read jobs: analyze: @@ -39,10 +39,6 @@ jobs: # CodeQL supports [ $supported-codeql-languages ] # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - name: Checkout repository uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 # Initializes the CodeQL tools for scanning. @@ -84,9 +80,6 @@ jobs: contents: read security-events: write steps: - - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # v0.12.0 with: diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 53402080..3cb8a0dc 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -9,11 +9,6 @@ jobs: runs-on: ubuntu-latest if: ${{ github.actor == 'dependabot[bot]' }} steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - - name: Dependabot metadata id: metadata uses: dependabot/fetch-metadata@c9c4182bf1b97f5224aee3906fd373f6b61b4526 # v1.6.0 diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index bd42d326..79893802 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -16,11 +16,6 @@ jobs: dependency-review: runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - - name: 'Checkout Repository' uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: 'Dependency Review' diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 111d2f22..e8a046ab 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -13,10 +13,5 @@ jobs: trigger-api-docs-indexing: runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - - run: | curl https://doc.crds.dev/github.com/${{ github.event.repository.full_name }}@${{ github.event.release.tag_name }} diff --git a/.github/workflows/lint-pr.yml b/.github/workflows/lint-pr.yml index 5cebaeeb..458d1925 100644 --- a/.github/workflows/lint-pr.yml +++ b/.github/workflows/lint-pr.yml @@ -5,7 +5,7 @@ on: types: - opened - edited -permissions: # added using https://github.com/step-security/secure-workflows +permissions: contents: read jobs: pr-title-lint: @@ -14,10 +14,6 @@ jobs: statuses: write # for amannn/action-semantic-pull-request to mark status of analyzed PR runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: amannn/action-semantic-pull-request@47b15d52c5c30e94a17ec87eb8dd51ff5221fed9 # v5.3.0 with: # Ensure the subject doesn't start with an uppercase character. diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index e4ffaca8..c0527232 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -13,10 +13,6 @@ jobs: if: ${{ github.repository == 'statnett/image-scanner-operator' }} runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: google-github-actions/release-please-action@4c5670f886fe259db4d11222f7dff41c1382304d # v3.7.12 with: token: ${{ secrets.BOT_PAT }} diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 828abb4e..e6024e67 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -30,11 +30,6 @@ jobs: actions: read steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - - name: "Checkout code" uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 with: