diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6c0376723c..cbf2b256f6 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -15,6 +15,9 @@ defaults: run: shell: bash +permissions: + contents: read + jobs: build-debs: strategy: @@ -28,10 +31,10 @@ jobs: outputs: artifact_id: ${{ steps.upload.outputs.artifact-id }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.versions.python }} - name: Build SecureDrop packages @@ -43,7 +46,7 @@ jobs: - name: Build admin packages run: | OS_VERSION=${{ matrix.versions.ubuntu }} WHAT=admin ./builder/build-debs.sh - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 id: upload with: name: ${{ matrix.versions.ubuntu }}-${{ matrix.build }} @@ -63,7 +66,7 @@ jobs: run: | apt-get update && apt-get install --yes diffoscope-minimal xz-utils \ --no-install-recommends - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: "${{ matrix.ubuntu_version }}-*" - name: diffoscope diff --git a/.github/workflows/cargo-vet.yml b/.github/workflows/cargo-vet.yml index 1b58d8d287..a0472af244 100644 --- a/.github/workflows/cargo-vet.yml +++ b/.github/workflows/cargo-vet.yml @@ -9,6 +9,9 @@ on: types: ["opened", "synchronize"] merge_group: +permissions: + contents: read + jobs: cargo-vet: name: Vet Dependencies @@ -18,10 +21,10 @@ jobs: env: CARGO_VET_VERSION: 0.10.2 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/cache@v6.1.0 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 id: cache-vet with: path: /usr/local/cargo/bin/cargo-vet diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 330376a308..033373fe1d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,6 +12,9 @@ defaults: run: shell: bash +permissions: + contents: read + jobs: lint: runs-on: ubuntu-latest @@ -25,7 +28,7 @@ jobs: - name: Install Git run: | apt-get update && apt-get install --yes git - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install dependencies @@ -52,7 +55,7 @@ jobs: ubuntu_version: - noble steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Build image @@ -70,7 +73,7 @@ jobs: ubuntu_version: - noble steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Build image @@ -88,7 +91,7 @@ jobs: ubuntu_version: - noble steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Build image @@ -109,7 +112,7 @@ jobs: # Keep version in sync with rust-toolchain.toml container: rust:1.96.0 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install dependencies @@ -124,7 +127,7 @@ jobs: admin-tests: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run tests diff --git a/.github/workflows/demo-test.yml b/.github/workflows/demo-test.yml index 97b06b7559..c7aa2b3961 100644 --- a/.github/workflows/demo-test.yml +++ b/.github/workflows/demo-test.yml @@ -12,6 +12,9 @@ defaults: run: shell: bash +permissions: + contents: read + jobs: build: name: Build Demo @@ -29,11 +32,11 @@ jobs: env: DOCKERIZE_VERSION: v0.6.1 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Download artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ needs.build.outputs.artifact-name }} - name: Restore container image diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 327bfa2c96..15677fc296 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -9,8 +9,8 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout Repository' - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: 'Dependency Review' - uses: actions/dependency-review-action@v5.0.0 + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 0defbb9c81..a4a561431c 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -8,13 +8,16 @@ on: schedule: - cron: '0 3 * * *' +permissions: + contents: read + jobs: rust-audit: runs-on: ubuntu-latest # Keep version in sync with rust-toolchain.toml container: rust:1.96.0 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Check Rust dependencies @@ -24,10 +27,10 @@ jobs: static-analysis: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' - name: Install dependencies diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml index 110d159c03..f04d0e2804 100644 --- a/.github/workflows/staging.yml +++ b/.github/workflows/staging.yml @@ -7,6 +7,9 @@ on: schedule: - cron: '0 3 * * *' +permissions: + contents: read + jobs: staging: strategy: @@ -18,7 +21,7 @@ jobs: GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }} UBUNTU_VERSION: ${{ matrix.ubuntu_version }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run staging tests on GCE diff --git a/.github/workflows/translation.yml b/.github/workflows/translation.yml index 269c128f9e..e69bf40087 100644 --- a/.github/workflows/translation.yml +++ b/.github/workflows/translation.yml @@ -13,6 +13,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !startsWith( github.ref, 'refs/heads/release/' ) }} +permissions: + contents: read + jobs: locales: runs-on: ubuntu-latest @@ -21,7 +24,7 @@ jobs: env: GITHUB_ACTOR: ${{ github.actor }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Generate locale list @@ -55,7 +58,7 @@ jobs: env: LOCALES: ${{ matrix.locale }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Build image @@ -65,7 +68,7 @@ jobs: run: | make translation-test - name: Save screenshots - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: screenshots-${{ matrix.locale }} path: securedrop/tests/functional/pageslayout/screenshots/ diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000000..d69921e498 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,10 @@ +rules: + cache-poisoning: + ignore: + # not used for releases / sensitive artifacts + - cargo-vet.yml + unpinned-uses: + config: + policies: + freedomofpress/actionslib/.github/workflows/oci-build.yaml: any + freedomofpress/actionslib/.github/workflows/update-k8s-trigger.yaml: any diff --git a/securedrop/requirements/develop-requirements.in b/securedrop/requirements/develop-requirements.in index 7bc1618287..fbbe615a8c 100644 --- a/securedrop/requirements/develop-requirements.in +++ b/securedrop/requirements/develop-requirements.in @@ -39,4 +39,4 @@ pytest-testinfra>=5.3.1 translate-toolkit uv>=0.11.15 yamllint -zizmor +zizmor>=1.27 diff --git a/securedrop/requirements/develop-requirements.txt b/securedrop/requirements/develop-requirements.txt index b12bb5b37e..7c50146cb3 100644 --- a/securedrop/requirements/develop-requirements.txt +++ b/securedrop/requirements/develop-requirements.txt @@ -1493,19 +1493,16 @@ zipp==3.23.0 \ --hash=sha256:071652d6115ed432f5ce1d34c336c0adfd6a884660d1e9712a256d3d3bd4b14e \ --hash=sha256:a07157588a12518c9d4034df3fbbee09c814741a33ff63c05fa29d26a2404166 # via importlib-metadata -zizmor==0.10.0 \ - --hash=sha256:01743f434d8dacd3d4009999e92ddf2952c2138bfc10ab2eb1e2e592f31cb0a2 \ - --hash=sha256:1c64fcd25149107aa6a5435fa2cf909b8fd92af2a7dfb8650aad59a1eb10f35e \ - --hash=sha256:20eb70b037116ef29f4b90f298801f3cccb54f0a04e3454ae0ee31e70d554d77 \ - --hash=sha256:4894141e6f0adb4821d377aad91cbcb699c88ae5c816267189926b2d40becdd3 \ - --hash=sha256:514c5f0e104008884e4e0a2cdd1ad4cc63fc280791f43a8521f3fb96a7f264af \ - --hash=sha256:7bbf8275ac411682200217a60a3f8ce8bf3b545ff9a1ea3c2d26436ad4ca81e1 \ - --hash=sha256:7d74d430feb5c0a28fba3a200eac1ae6ce7e7ecbf593f386149f9c41fa02aeea \ - --hash=sha256:85da4c1dd42b031aad3550024c6f9d2525668f04285b4280454c278153383e59 \ - --hash=sha256:948eda1c8a33ac28946972f4672fddd09dd9ad793934b6f5d572b74acce1ec15 \ - --hash=sha256:b88048c5b11af489ff37ff064fdd9a9cad6ea9cc34e8c25a9d2e196819859cf1 \ - --hash=sha256:c9319af1c1806525aa18501488be2f9ba9f03b16ce8cb1c10e98b563e89aacfc \ - --hash=sha256:d74ec6b1547f529756315238805fdfb58b59b09b6b7b85b49d38a68dc96aa706 \ - --hash=sha256:ecac7a28aef6c7e058e0292da6f04345cfd21d36def7acff0038500544bd48c1 \ - --hash=sha256:ffdacfddbb4eb4cbb0126e3875eb21a453414be47fe423824fdf1946fff9cc02 +zizmor==1.27.0 \ + --hash=sha256:0bba3eff43f919b04b9b6365b4ef17437649e11eafb73f603407873b65ad01dd \ + --hash=sha256:0de272b6c19910f5bc6965ac7d4566af26db31571e983e3b567298389d0c84c7 \ + --hash=sha256:138e65d560e3875dbbbec50eae56a9e14707f8f4e006112174e4752155c01db9 \ + --hash=sha256:90004342c3c5122d7e4e8e27ac6d3c462b878da0ea3d408ff45fa7d768139a76 \ + --hash=sha256:afb28123882d2b8248f1e480bf6cc6d1af102e0d3fbe22a40f7f795b1aa9d435 \ + --hash=sha256:b70697ebe555a28fbd3deaa259936f059f64b9f8531020f5b1f3d99087d4f62a \ + --hash=sha256:cc94158472428e04298b879ef36cb94360b753ece38fa2303464dd7dae07bc68 \ + --hash=sha256:debc723721172c170d5922171a40eaebf5787a02ff3e69d30597dafdb66a21ba \ + --hash=sha256:e1042dd14fb4597a1e3007c7ef3f5a017305ca50cfacf43d603f3ae870c65eb1 \ + --hash=sha256:fe8947f635c925b83ef83fcd66de5f89a012b22784bb86fcd7e2a1f4e7648c9d \ + --hash=sha256:ffaf8e1bb39447e643592d669761bfbc2aa636875db9079614f6a6c81cec60c8 # via -r requirements/develop-requirements.in