Skip to content

Commit

Permalink
ci: github actions hardening (#91)
Browse files Browse the repository at this point in the history
Restrict permissions of github token. Pin action versions.

Following advice in briansmith/untrusted#50.
  • Loading branch information
mmcloughlin authored Apr 28, 2021
1 parent 0d18240 commit 0c8ef15
Show file tree
Hide file tree
Showing 4 changed files with 39 additions and 15 deletions.
18 changes: 13 additions & 5 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
name: ci

permissions:
contents: read

on:
push:
branches:
Expand All @@ -6,7 +11,6 @@ on:
schedule:
- cron: "33 11 * * 6"

name: ci
jobs:
test:
strategy:
Expand All @@ -16,17 +20,19 @@ jobs:
runs-on: ${{ matrix.platform }}
steps:
- name: Install Go
uses: actions/setup-go@v1
uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8 # v2.1.3
with:
go-version: ${{ matrix.go-version }}
- name: Checkout code
uses: actions/checkout@v1
uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
with:
persist-credentials: false
- name: Build
run: go build ./...
- name: Test
run: go test -coverprofile=coverage.out -covermode=count ./...
- name: Upload Coverage
uses: codecov/codecov-action@v1.0.5
uses: codecov/codecov-action@967e2b38a85a62bd61be5529ada27ebc109948c2 #v1.4.1
with:
token: ${{ secrets.CODECOV_TOKEN }}
file: coverage.out
Expand All @@ -40,7 +46,9 @@ jobs:
echo GOPATH=${{ runner.workspace }} >> $GITHUB_ENV
echo ${{ runner.workspace }}/bin >> $GITHUB_PATH
- name: Checkout code
uses: actions/checkout@v1
uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
with:
persist-credentials: false
- name: Bootstrap
run: ./script/bootstrap
- name: Lint
Expand Down
10 changes: 8 additions & 2 deletions .github/workflows/install.yml
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
name: install

permissions:
contents: read

on:
push:
branches:
Expand All @@ -8,7 +13,6 @@ on:
schedule:
- cron: "47 18 * * *"

name: install
jobs:
install:
strategy:
Expand All @@ -17,7 +21,9 @@ jobs:
runs-on: ${{ matrix.platform }}
steps:
- name: Checkout code
uses: actions/checkout@v1
uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
with:
persist-credentials: false
- name: Run Installer
run: cat install.sh | sh -s -- -b ${{ runner.workspace }}/bin
- name: Run Binary
Expand Down
12 changes: 8 additions & 4 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
name: release

permissions:
contents: write

on:
push:
tags:
Expand All @@ -10,17 +13,18 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v2
uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
with:
fetch-depth: 0
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@v2
uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8 # v2.1.3
with:
go-version: 1.16.x
- name: Run GoReleaser
uses: goreleaser/goreleaser-action@v2
uses: goreleaser/goreleaser-action@5e15885530fb01d81d1f24e8a6f54ebbd0fed7eb # v2.5.0
with:
version: latest
version: v0.160.0
args: release --rm-dist
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
14 changes: 10 additions & 4 deletions .github/workflows/stress.yml
Original file line number Diff line number Diff line change
@@ -1,8 +1,12 @@
name: stress

permissions:
contents: read

on:
schedule:
- cron: "42 10 * * 3"

name: stress
jobs:
test:
strategy:
Expand All @@ -12,21 +16,23 @@ jobs:
runs-on: ${{ matrix.platform }}
steps:
- name: Install Go
uses: actions/setup-go@v1
uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8 # v2.1.3
with:
go-version: ${{ matrix.go-version }}
- name: Configure Go Environment
run: |
echo GOPATH=${{ runner.workspace }} >> $GITHUB_ENV
echo ${{ runner.workspace }}/bin >> $GITHUB_PATH
- name: Checkout code
uses: actions/checkout@v1
uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
with:
persist-credentials: false
- name: Bootstrap
run: ./script/bootstrap
- name: Stress Test
run: ./script/stress -c coverage.out
- name: Upload Coverage
uses: codecov/codecov-action@v1.0.5
uses: codecov/codecov-action@967e2b38a85a62bd61be5529ada27ebc109948c2 #v1.4.1
with:
token: ${{ secrets.CODECOV_TOKEN }}
file: coverage.out
Expand Down

0 comments on commit 0c8ef15

Please sign in to comment.