Skip to content

Commit 4afe174

Browse files
Bibo-JoshiBibo-Joshi
authored
Add Static Security Analysis of GitHub Actions Workflows (python-telegram-bot#4606)
1 parent 2ac5201 commit 4afe174

13 files changed

Lines changed: 89 additions & 45 deletions

‎.github/workflows/dependabot-prs.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,22 +16,23 @@ jobs:
1616

1717
- name: Fetch Dependabot metadata
1818
id: dependabot-metadata
19-
uses: dependabot/[email protected]
19+
uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0
2020

21-
- uses: actions/checkout@v4
21+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2222
with:
2323
ref: ${{ github.event.pull_request.head.ref }}
24+
persist-credentials: false
2425

2526
- name: Update Version Number in Other Files
26-
uses: jacobtomlinson/gha-find-replace@v3
27+
uses: jacobtomlinson/gha-find-replace@f1069b438f125e5395d84d1c6fd3b559a7880cb5 # v3
2728
with:
2829
find: ${{ steps.dependabot-metadata.outputs.previous-version }}
2930
replace: ${{ steps.dependabot-metadata.outputs.new-version }}
3031
regex: false
3132
exclude: CHANGES.rst
3233

3334
- name: Commit & Push Changes to PR
34-
uses: EndBug/[email protected]
35+
uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
3536
with:
3637
message: 'Update version number in other files'
3738
committer_name: GitHub Actions

‎.github/workflows/docs-linkcheck.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,11 @@ jobs:
1717
os: [ubuntu-latest]
1818
fail-fast: False
1919
steps:
20-
- uses: actions/checkout@v4
20+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21+
with:
22+
persist-credentials: false
2123
- name: Set up Python ${{ matrix.python-version }}
22-
uses: actions/setup-python@v5
24+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
2325
with:
2426
python-version: ${{ matrix.python-version }}
2527
- name: Install dependencies

‎.github/workflows/docs.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,11 @@ jobs:
1818
os: [ubuntu-latest]
1919
fail-fast: False
2020
steps:
21-
- uses: actions/checkout@v4
21+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
22+
with:
23+
persist-credentials: false
2224
- name: Set up Python ${{ matrix.python-version }}
23-
uses: actions/setup-python@v5
25+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
2426
with:
2527
python-version: ${{ matrix.python-version }}
2628
cache: 'pip'
@@ -34,7 +36,7 @@ jobs:
3436
- name: Build docs
3537
run: sphinx-build docs/source docs/build/html -W --keep-going -j auto
3638
- name: Upload docs
37-
uses: actions/upload-artifact@v4
39+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
3840
with:
3941
name: HTML Docs
4042
retention-days: 7

‎.github/workflows/gha_security.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: GitHub Actions Security Analysis
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
pull_request:
8+
9+
jobs:
10+
zizmor:
11+
name: Security Analysis with zizmor
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
security-events: write
16+
steps:
17+
- name: Checkout repository
18+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
19+
with:
20+
persist-credentials: false
21+
- name: Install the latest version of uv
22+
uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
23+
- name: Run zizmor
24+
run: uvx zizmor --persona=pedantic --format sarif . > results.sarif
25+
env:
26+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
27+
- name: Upload SARIF file
28+
uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
29+
with:
30+
sarif_file: results.sarif
31+
category: zizmor

‎.github/workflows/labelling.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
pull-requests: write # for srvaroa/labeler to add labels in PR
1212
runs-on: ubuntu-latest
1313
steps:
14-
- uses: srvaroa/[email protected]
14+
- uses: srvaroa/labeler@fe4b1c73bb8abf2f14a44a6912a8b4fee835d631 # v1.12.0
1515
# Config file at .github/labeler.yml
1616
env:
1717
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/lock.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ jobs:
88
lock:
99
runs-on: ubuntu-latest
1010
steps:
11-
- uses: dessant/[email protected]
11+
- uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
1212
with:
1313
github-token: ${{ github.token }}
1414
issue-inactive-days: '7'

‎.github/workflows/release_pypi.yml‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,11 @@ jobs:
1212
TAG: ${{ steps.get_tag.outputs.TAG }}
1313

1414
steps:
15-
- uses: actions/checkout@v4
15+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
16+
with:
17+
persist-credentials: false
1618
- name: Set up Python
17-
uses: actions/setup-python@v5
19+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
1820
with:
1921
python-version: "3.x"
2022
- name: Install pypa/build
@@ -23,7 +25,7 @@ jobs:
2325
- name: Build a binary wheel and a source tarball
2426
run: python3 -m build
2527
- name: Store the distribution packages
26-
uses: actions/upload-artifact@v4
28+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
2729
with:
2830
name: python-package-distributions
2931
path: dist/
@@ -47,12 +49,12 @@ jobs:
4749

4850
steps:
4951
- name: Download all the dists
50-
uses: actions/download-artifact@v4
52+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
5153
with:
5254
name: python-package-distributions
5355
path: dist/
5456
- name: Publish to PyPI
55-
uses: pypa/gh-action-pypi-publish@release/v1
57+
uses: pypa/gh-action-pypi-publish@67339c736fd9354cd4f8cb0b744f2b82a74b5c70 # v1.12.3
5658

5759
compute-signatures:
5860
name: Compute SHA1 Sums and Sign with Sigstore
@@ -65,7 +67,7 @@ jobs:
6567

6668
steps:
6769
- name: Download all the dists
68-
uses: actions/download-artifact@v4
70+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
6971
with:
7072
name: python-package-distributions
7173
path: dist/
@@ -77,13 +79,13 @@ jobs:
7779
sha1sum $file > $file.sha1
7880
done
7981
- name: Sign the dists with Sigstore
80-
uses: sigstore/[email protected]
82+
uses: sigstore/gh-action-sigstore-python@f514d46b907ebcd5bedc05145c03b69c1edd8b46 # v3.0.0
8183
with:
8284
inputs: >-
8385
./dist/*.tar.gz
8486
./dist/*.whl
8587
- name: Store the distribution packages and signatures
86-
uses: actions/upload-artifact@v4
88+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
8789
with:
8890
name: python-package-distributions-and-signatures
8991
path: dist/
@@ -101,7 +103,7 @@ jobs:
101103

102104
steps:
103105
- name: Download all the dists
104-
uses: actions/download-artifact@v4
106+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
105107
with:
106108
name: python-package-distributions-and-signatures
107109
path: dist/
@@ -113,7 +115,7 @@ jobs:
113115
# we don't define it through this workflow.
114116
run: >-
115117
gh release create
116-
'${{ env.TAG }}'
118+
"$TAG"
117119
--repo '${{ github.repository }}'
118120
--generate-notes
119121
- name: Upload artifact signatures to GitHub Release
@@ -125,5 +127,5 @@ jobs:
125127
# sigstore-produced signatures and certificates.
126128
run: >-
127129
gh release upload
128-
'${{ env.TAG }}' dist/**
130+
"$TAG" dist/**
129131
--repo '${{ github.repository }}'

‎.github/workflows/release_test_pypi.yml‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,11 @@ jobs:
1212
TAG: ${{ steps.get_tag.outputs.TAG }}
1313

1414
steps:
15-
- uses: actions/checkout@v4
15+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
16+
with:
17+
persist-credentials: false
1618
- name: Set up Python
17-
uses: actions/setup-python@v5
19+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
1820
with:
1921
python-version: "3.x"
2022
- name: Install pypa/build
@@ -23,7 +25,7 @@ jobs:
2325
- name: Build a binary wheel and a source tarball
2426
run: python3 -m build
2527
- name: Store the distribution packages
26-
uses: actions/upload-artifact@v4
28+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
2729
with:
2830
name: python-package-distributions
2931
path: dist/
@@ -47,12 +49,12 @@ jobs:
4749

4850
steps:
4951
- name: Download all the dists
50-
uses: actions/download-artifact@v4
52+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
5153
with:
5254
name: python-package-distributions
5355
path: dist/
5456
- name: Publish to Test PyPI
55-
uses: pypa/gh-action-pypi-publish@release/v1
57+
uses: pypa/gh-action-pypi-publish@67339c736fd9354cd4f8cb0b744f2b82a74b5c70 # v1.12.3
5658
with:
5759
repository-url: https://test.pypi.org/legacy/
5860

@@ -67,7 +69,7 @@ jobs:
6769

6870
steps:
6971
- name: Download all the dists
70-
uses: actions/download-artifact@v4
72+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
7173
with:
7274
name: python-package-distributions
7375
path: dist/
@@ -79,13 +81,13 @@ jobs:
7981
sha1sum $file > $file.sha1
8082
done
8183
- name: Sign the dists with Sigstore
82-
uses: sigstore/[email protected]
84+
uses: sigstore/gh-action-sigstore-python@f514d46b907ebcd5bedc05145c03b69c1edd8b46 # v3.0.0
8385
with:
8486
inputs: >-
8587
./dist/*.tar.gz
8688
./dist/*.whl
8789
- name: Store the distribution packages and signatures
88-
uses: actions/upload-artifact@v4
90+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
8991
with:
9092
name: python-package-distributions-and-signatures
9193
path: dist/
@@ -103,7 +105,7 @@ jobs:
103105

104106
steps:
105107
- name: Download all the dists
106-
uses: actions/download-artifact@v4
108+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
107109
with:
108110
name: python-package-distributions-and-signatures
109111
path: dist/
@@ -115,7 +117,7 @@ jobs:
115117
# we don't define it through this workflow.
116118
run: >-
117119
gh release create
118-
'${{ env.TAG }}'
120+
"$TAG"
119121
--repo '${{ github.repository }}'
120122
--generate-notes
121123
--draft
@@ -128,5 +130,5 @@ jobs:
128130
# sigstore-produced signatures and certificates.
129131
run: >-
130132
gh release upload
131-
'${{ env.TAG }}' dist/**
133+
"$TAG" dist/**
132134
--repo '${{ github.repository }}'

‎.github/workflows/stale.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ jobs:
77
stale:
88
runs-on: ubuntu-latest
99
steps:
10-
- uses: actions/stale@v9
10+
- uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
1111
with:
1212
# PRs never get stale
1313
days-before-stale: 3

‎.github/workflows/test_official.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,11 @@ jobs:
2121
os: [ubuntu-latest]
2222
fail-fast: False
2323
steps:
24-
- uses: actions/checkout@v4
24+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
25+
with:
26+
persist-credentials: false
2527
- name: Set up Python ${{ matrix.python-version }}
26-
uses: actions/setup-python@v5
28+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
2729
with:
2830
python-version: ${{ matrix.python-version }}
2931
- name: Install dependencies
@@ -41,7 +43,7 @@ jobs:
4143

4244
- name: Test Summary
4345
id: test_summary
44-
uses: test-summary/[email protected]
46+
uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 # v2.4
4547
if: always() # always run, even if tests fail
4648
with:
4749
paths: .test_report_official.xml

0 commit comments

Comments
 (0)