Skip to content

harden GitHub Actions against supply chain attacks #2421

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hu-ahmed wants to merge 2 commits into
base: master
Choose a base branch
from
Open

harden GitHub Actions against supply chain attacks #2421

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0cdfae9
harden GitHub Actions against supply chain attacks
hu-ahmed Apr 20, 2026
f32fc77
fix zizmor-flagged workflow security issues
hu-ahmed Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
# Copyright (c) 2026 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Eclipse Public License 2.0 which is available at
# http://www.eclipse.org/legal/epl-2.0
#
# SPDX-License-Identifier: EPL-2.0
version: 2
updates:
- package-ecosystem: github-actions
directory: "/"
schedule:
interval: weekly
cooldown:
default-days: 7
open-pull-requests-limit: 10
labels:
- dependencies
commit-message:
prefix: ci
include: scope
groups:
github-actions:
patterns:
- "*"
39 changes: 22 additions & 17 deletions .github/workflows/docker-nightly.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,16 +20,21 @@
if: github.repository == 'eclipse-ditto/ditto'
runs-on: ubuntu-latest
steps:
-
name: Harden Runner
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
with:
egress-policy: audit
-
name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
name: Set up QEMU
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-
name: Set up Docker Buildx
id: buildx
uses: docker/setup-buildx-action@v3 # setup buildx in order to do build and push multi-architecture images
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 # setup buildx in order to do build and push multi-architecture images
-
name: Inspect buildx builder
run: |
Expand All @@ -40,7 +45,7 @@
echo "Platforms: ${{ steps.buildx.outputs.platforms }}"
-
name: Login to Docker Hub
uses: docker/login-action@v2
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
with:
username: eclipsedittobot
password: ${{ secrets.DOCKER_HUB_TOKEN }}
Expand All @@ -55,7 +60,7 @@
echo $IMAGE_TAG
-
name: Build and push ditto-policies
uses: docker/build-push-action@v4
uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1
with:
context: .
file: dockerfile-release
Expand All @@ -70,7 +75,7 @@
eclipse/ditto-policies:${{ env.IMAGE_TAG }}
-
name: Build and push ditto-things
uses: docker/build-push-action@v4
uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1
with:
context: .
file: dockerfile-release
Expand All @@ -85,7 +90,7 @@
eclipse/ditto-things:${{ env.IMAGE_TAG }}
-
name: Build and push ditto-gateway
uses: docker/build-push-action@v4
uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1
with:
context: .
file: dockerfile-release
Expand All @@ -100,7 +105,7 @@
eclipse/ditto-gateway:${{ env.IMAGE_TAG }}
-
name: Build and push ditto-thingsearch
uses: docker/build-push-action@v4
uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1
with:
context: .
file: dockerfile-release
Expand All @@ -115,7 +120,7 @@
eclipse/ditto-things-search:${{ env.IMAGE_TAG }}
-
name: Build and push ditto-connectivity
uses: docker/build-push-action@v4
uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1
with:
context: .
file: dockerfile-release
Expand All @@ -131,7 +136,7 @@
eclipse/ditto-connectivity:${{ env.IMAGE_TAG }}
-
name: Use Node.js 18.x
uses: actions/setup-node@v6
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

Check failure

Code scanning / zizmor

runtime artifacts potentially vulnerable to a cache poisoning attack Error

runtime artifacts potentially vulnerable to a cache poisoning attack
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
with:
node-version: 20
-
Expand All @@ -144,7 +149,7 @@
working-directory: ./ui
-
name: Build and push ditto-ui image
uses: docker/build-push-action@v4
uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1
with:
context: ./ui
file: ui/Dockerfile
Expand All @@ -155,7 +160,7 @@
eclipse/ditto-ui:${{ env.IMAGE_TAG }}
-
name: Run Trivy vulnerability scanner for ditto-policies
uses: aquasecurity/trivy-action@v0.35.0
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
with:
image-ref: 'docker.io/eclipse/ditto-policies:${{ env.IMAGE_TAG }}'
format: 'table'
Expand All @@ -165,7 +170,7 @@
severity: 'CRITICAL'
-
name: Run Trivy vulnerability scanner for ditto-things
uses: aquasecurity/trivy-action@v0.35.0
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
with:
image-ref: 'docker.io/eclipse/ditto-things:${{ env.IMAGE_TAG }}'
format: 'table'
Expand All @@ -175,7 +180,7 @@
severity: 'CRITICAL'
-
name: Run Trivy vulnerability scanner for ditto-gateway
uses: aquasecurity/trivy-action@v0.35.0
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
with:
image-ref: 'docker.io/eclipse/ditto-gateway:${{ env.IMAGE_TAG }}'
format: 'table'
Expand All @@ -185,7 +190,7 @@
severity: 'CRITICAL'
-
name: Run Trivy vulnerability scanner for ditto-things-search
uses: aquasecurity/trivy-action@v0.35.0
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
with:
image-ref: 'docker.io/eclipse/ditto-things-search:${{ env.IMAGE_TAG }}'
format: 'table'
Expand All @@ -195,7 +200,7 @@
severity: 'CRITICAL'
-
name: Run Trivy vulnerability scanner for ditto-connectivity
uses: aquasecurity/trivy-action@v0.35.0
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
with:
image-ref: 'docker.io/eclipse/ditto-connectivity:${{ env.IMAGE_TAG }}'
format: 'table'
Expand All @@ -205,7 +210,7 @@
severity: 'CRITICAL'
-
name: Run Trivy vulnerability scanner for ditto-ui
uses: aquasecurity/trivy-action@v0.35.0
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
with:
image-ref: 'docker.io/eclipse/ditto-ui:${{ env.IMAGE_TAG }}'
format: 'table'
Expand Down
11 changes: 8 additions & 3 deletions .github/workflows/gh-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,9 +29,14 @@
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
steps:
- uses: actions/checkout@v6
- name: Harden Runner
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
with:
egress-policy: audit

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

Check notice

Code scanning / zizmor

credential persistence through GitHub Actions artifacts Note

credential persistence through GitHub Actions artifacts
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
- name: Use Node.js 18.x
uses: actions/setup-node@v6
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 20
- name: Install npm dependencies
Expand All @@ -41,7 +46,7 @@
run: npm run build
working-directory: ./ui
- name: Deploy
uses: peaceiris/actions-gh-pages@v4
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
publish_dir: ./ui
9 changes: 7 additions & 2 deletions .github/workflows/helm-chart-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,13 +24,18 @@ jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
with:
egress-policy: audit

- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0

- name: Set up Helm
uses: azure/setup-helm@v4.2.0
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
with:
version: ${{ env.VERSION_HELM }}

Expand Down
37 changes: 26 additions & 11 deletions .github/workflows/helm-chart.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,20 +27,25 @@ jobs:
lint-chart:
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
with:
egress-policy: audit

- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- name: Set up Helm
uses: azure/setup-helm@v4.2.0
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
with:
version: ${{ env.VERSION_HELM }}
- uses: actions/setup-python@v5
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: ${{ env.VERSION_PYTHON }}
check-latest: true
- name: Set up chart-testing
uses: helm/chart-testing-action@v2.6.1
uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
with:
version: ${{ env.VERSION_CHART_TESTING }}
- name: Run chart-testing (list-changed)
Expand All @@ -67,12 +72,17 @@ jobs:
- v1.34.3
- v1.35.1
steps:
- name: Harden Runner
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
with:
egress-policy: audit

- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Fetch history for chart testing
run: git fetch --prune --unshallow
- name: Set up Helm
uses: azure/setup-helm@v4.2.0
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
with:
version: ${{ env.VERSION_HELM }}
- name: Run kubeval
Expand All @@ -96,20 +106,25 @@ jobs:
- v1.34.3
- v1.35.1
steps:
- name: Harden Runner
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
with:
egress-policy: audit

- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Fetch history for chart testing
run: git fetch --prune --unshallow
- name: Set up Helm
uses: azure/setup-helm@v4.2.0
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
with:
version: ${{ env.VERSION_HELM }}
- uses: actions/setup-python@v5
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: ${{ env.VERSION_PYTHON }}
check-latest: true
- name: Set up chart-testing
uses: helm/chart-testing-action@v2.6.1
uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
with:
version: ${{ env.VERSION_CHART_TESTING }}
- name: Run chart-testing (list-changed)
Expand All @@ -121,7 +136,7 @@ jobs:
fi
- name: Create kind ${{ matrix.k8s }} cluster
if: steps.list-changed.outputs.changed == 'true'
uses: helm/kind-action@v1.4.0
uses: helm/kind-action@9e8295d178de23cbfbd8fa16cf844eec1d773a07 # v1.4.0
with:
node_image: kindest/node:${{ matrix.k8s }}
- name: Run chart-testing (install)
Expand Down
11 changes: 8 additions & 3 deletions .github/workflows/license-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,13 @@
check-license-header-year:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: jitterbit/get-changed-files@v1
- name: Harden Runner
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
with:
egress-policy: audit

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

Check notice

Code scanning / zizmor

credential persistence through GitHub Actions artifacts Note

credential persistence through GitHub Actions artifacts
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
- uses: jitterbit/get-changed-files@b17fbb00bdc0c0f63fcf166580804b4d2cdc2a42 # v1
id: the-files
continue-on-error: true
- name: Printing added files
Expand All @@ -43,4 +48,4 @@
fi
fi
done
exit $missing_counter
exit $missing_counter
9 changes: 7 additions & 2 deletions .github/workflows/maven.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,15 @@
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v6
- name: Harden Runner
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
with:
egress-policy: audit

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

Check notice

Code scanning / zizmor

credential persistence through GitHub Actions artifacts Note

credential persistence through GitHub Actions artifacts
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed

- name: Set up JDK 25
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0

Check failure

Code scanning / zizmor

runtime artifacts potentially vulnerable to a cache poisoning attack Error

runtime artifacts potentially vulnerable to a cache poisoning attack
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
with:
distribution: 'temurin'
java-version: 25
Expand Down
Loading
Loading