code/avo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: github actions hardening (#190)

Browse Source 
Restrict permissions of github token. Pin action versions.

Following advice in briansmith/untrusted#50.
This commit is contained in:
Michael McLoughlin
2021-04-27 21:42:09 -07:00
committed by GitHub
parent ec9535c905
commit 3a219c8d3a
1 changed files with 19 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
.github/workflows/ci.yml vendored
View File

@@ -1,3 +1,8 @@
name: ci
permissions:
contents: read
on: on:
push: push:
branches: branches:
@@ -6,7 +11,6 @@ on:
schedule: schedule:
- cron: '17 12 * * 6' - cron: '17 12 * * 6'
name: ci
jobs: jobs:
test: test:
strategy: strategy:
@@ -16,7 +20,7 @@ jobs:
runs-on: ${{ matrix.platform }} runs-on: ${{ matrix.platform }}
steps: steps:
- name: Install Go - name: Install Go
uses: actions/setup-go@v1 uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8 # v2.1.3
with: with:
go-version: ${{ matrix.go-version }} go-version: ${{ matrix.go-version }}
- name: Configure Go Environment - name: Configure Go Environment
@@ -26,7 +30,9 @@ jobs:
- name: Go Environment - name: Go Environment
run: go env run: go env
- name: Checkout code - name: Checkout code
uses: actions/checkout@v1 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
with:
persist-credentials: false
- name: Bootstrap - name: Bootstrap
run: ./script/bootstrap run: ./script/bootstrap
@@ -38,13 +44,13 @@ jobs:
run: ./script/coverage run: ./script/coverage
- name: Upload Unit Test Coverage - name: Upload Unit Test Coverage
uses: codecov/codecov-action@v1.0.5 uses: codecov/codecov-action@967e2b38a85a62bd61be5529ada27ebc109948c2 #v1.4.1
with: with:
token: ${{ secrets.CODECOV_TOKEN }} token: ${{ secrets.CODECOV_TOKEN }}
file: unittests.coverprofile file: unittests.coverprofile
flags: unittests flags: unittests
- name: Upload Integration Test Coverage - name: Upload Integration Test Coverage
uses: codecov/codecov-action@v1.0.5 uses: codecov/codecov-action@967e2b38a85a62bd61be5529ada27ebc109948c2 #v1.4.1
with: with:
token: ${{ secrets.CODECOV_TOKEN }} token: ${{ secrets.CODECOV_TOKEN }}
file: integration.coverprofile file: integration.coverprofile
@@ -58,7 +64,7 @@ jobs:
runs-on: ${{ matrix.platform }} runs-on: ${{ matrix.platform }}
steps: steps:
- name: Install Go - name: Install Go
uses: actions/setup-go@v1 uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8 # v2.1.3
with: with:
go-version: ${{ matrix.go-version }} go-version: ${{ matrix.go-version }}
- name: Configure Go Environment - name: Configure Go Environment
@@ -68,7 +74,9 @@ jobs:
- name: Go Environment - name: Go Environment
run: go env run: go env
- name: Checkout code - name: Checkout code
uses: actions/checkout@v1 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
with:
persist-credentials: false
- name: Bootstrap - name: Bootstrap
run: ./script/bootstrap run: ./script/bootstrap
- name: Lint - name: Lint
@@ -82,11 +90,13 @@ jobs:
runs-on: ${{ matrix.platform }} runs-on: ${{ matrix.platform }}
steps: steps:
- name: Install Go - name: Install Go
uses: actions/setup-go@v1 uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8 # v2.1.3
with: with:
go-version: ${{ matrix.go-version }} go-version: ${{ matrix.go-version }}
- name: Checkout code - name: Checkout code
uses: actions/checkout@v1 uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
with:
persist-credentials: false
- name: Run Third-Party Tests - name: Run Third-Party Tests
working-directory: ./tests/thirdparty working-directory: ./tests/thirdparty
run: go test -pkgs packages.json run: go test -pkgs packages.json