[StepSecurity] Apply security best practices#2
[StepSecurity] Apply security best practices#2stepsecurity-app[bot] wants to merge 1 commit intomasterfrom
Conversation
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Security Policy Alert: Actions Policy ViolationThis workflow run has been blocked by StepSecurity's actions policy because it uses actions that are not allowed by your organization's policy. Disallowed Actions:
To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed. For more information, see StepSecurity's Actions Policy documentation. |
Security Policy Alert: Actions Policy ViolationThis workflow run has been blocked by StepSecurity's actions policy because it uses actions that are not allowed by your organization's policy. Disallowed Actions:
To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed. For more information, see StepSecurity's Actions Policy documentation. |
Security Policy Alert: Actions Policy ViolationThis workflow run has been blocked by StepSecurity's actions policy because it uses actions that are not allowed by your organization's policy. Disallowed Actions:
To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed. For more information, see StepSecurity's Actions Policy documentation. |
Security Policy Alert: Actions Policy ViolationThis workflow run has been blocked by StepSecurity's actions policy because it uses actions that are not allowed by your organization's policy. Disallowed Actions:
To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed. For more information, see StepSecurity's Actions Policy documentation. |
Security Policy Alert: Actions Policy ViolationThis workflow run has been blocked by StepSecurity's actions policy because it uses actions that are not allowed by your organization's policy. Disallowed Actions:
To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed. For more information, see StepSecurity's Actions Policy documentation. |
Security Policy Alert: Actions Policy ViolationThis workflow run has been blocked by StepSecurity's actions policy because it uses actions that are not allowed by your organization's policy. Disallowed Actions:
To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed. For more information, see StepSecurity's Actions Policy documentation. |
Security Policy Alert: Actions Policy ViolationThis workflow run has been blocked by StepSecurity's actions policy because it uses actions that are not allowed by your organization's policy. Disallowed Actions:
To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed. For more information, see StepSecurity's Actions Policy documentation. |
Security Policy Alert: Actions Policy ViolationThis workflow run has been blocked by StepSecurity's actions policy because it uses actions that are not allowed by your organization's policy. Disallowed Actions:
To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed. For more information, see StepSecurity's Actions Policy documentation. |
Lawrence Lucas Large (LukeLarge)
left a comment
Lawrence Lucas Large (LukeLarge)
left a comment
There was a problem hiding this comment.
[StepSecurity] Apply security best practices
#2
1 participant
Summary
This pull request has been generated by StepSecurity as part of your enterprise subscription to ensure compliance with recommended security best practices. Please review and merge the pull request to apply these security enhancements.
Security Fixes
Harden Runner
Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without sudo access.
Least Privileged GitHub Actions Token Permissions
The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API. GitHub recommends setting minimum token permissions for the GITHUB_TOKEN.
Pinned Dependencies
Pinning GitHub Actions to specific versions or commit SHAs ensures that your workflows remain consistent and secure.
Unpinned actions can lead to unexpected changes or vulnerabilities caused by upstream updates.
Feedback
For bug reports, feature requests, and general feedback; please create an issue in step-security/secure-repo or contact us via our website.