From 77f55b2bd66079aed77ef03ab6a9d5ea7f358074 Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 12:22:27 +0000 Subject: [PATCH] Apply GitHub Actions security best practices Signed-off-by: StepSecurity Bot --- .github/dependabot.yml | 19 +++++++++++++++++++ .github/workflows/validate.yml | 14 +++++++++++--- 2 files changed, 30 insertions(+), 3 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..8e8ade2 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,19 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + cooldown: + default-days: 7 + + - package-ecosystem: gomod + directory: / + schedule: + interval: weekly + day: monday + cooldown: + default-days: 7 + semver-major-days: 30 + semver-minor-days: 14 + semver-patch-days: 7 diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index af65ff9..375dfc0 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -10,12 +10,20 @@ on: - synchronize - reopened +permissions: + contents: read + jobs: validate: runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + egress-policy: audit + - name: Check out main branch - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: ref: main @@ -24,10 +32,10 @@ jobs: run: echo "data=$(cat projects.json | jq -c)" >> $GITHUB_OUTPUT - name: Return to PR branch - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Set up Go - uses: actions/setup-go@v3 + uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1 with: go-version: 1.19