Workflow Hardening - Step 2 (#1578)

### What kind of change does this PR introduce? * This updates audited workflows to restrict the URLs that they can pull from * `gitleaks` has been added as a pre-commit hook (prevents accidental committing of secrets) * Some permissions adjustments have been made ### Does this PR introduce a breaking change? No. ### Other information: https://github.com/gitleaks/gitleaks https://securityscorecards.dev/viewer/?uri=github.com%2FOuranosinc%2Fxclim https://github.com/step-security/harden-runner
Ouranosinc · Jan 10, 2024 · fc178bc · fc178bc
2 parents fb29b8a + d5d7023
commit fc178bc
Show file tree

Hide file tree

Showing 16 changed files with 245 additions and 134 deletions.
diff --git a/.github/labeler.yml b/.github/labeler.yml
@@ -5,40 +5,51 @@
 #   we refer here to CI as the 'meta' configuration files for managing the code and integrations with the repository,
 #   not configurations related to the deployment process itself.
 
-API:
-  - xclim/cli.py
+'API':
+  - changed-files:
+    - any-glob-to-any-file:
+      - 'xclim/cli.py'
 
-CI:
-  - .editorconfig
-  - .pre-commit-config.yaml
-  - .readthedocs.yml
-  - .yamllint.yml
-  - .github/workflows/*
-  - docs/Makefile
-  - pylintrc
-  - tox.ini
-  - Makefile
+'CI':
+  - changed-files:
+    - any-glob-to-any-file:
+      - '.editorconfig'
+      - '.pre-commit-config.yaml'
+      - '.readthedocs.yml'
+      - '.yamllint.yml'
+      - '.github/workflows/*'
+      - 'docs/Makefile'
+      - 'pylintrc'
+      - 'tox.ini'
+      - 'Makefile'
 
-docs:
-  - .readthedocs.yml
-  - docs/**/*
-  - AUTHORS.rst
-  - CONTRIBUTING.rst
-  - ISSUE_TEMPLATE/**/*
-  - ISSUE_TEMPLATE.md
-  - PULL_REQUEST_TEMPLATE.md
-  - README.rst
+'docs':
+  - changed-files:
+    - any-glob-to-any-file:
+      - '.readthedocs.yml'
+      - 'docs/**/*'
+      - 'AUTHORS.rst'
+      - 'CONTRIBUTING.rst'
+      - 'ISSUE_TEMPLATE/**/*'
+      - 'ISSUE_TEMPLATE.md'
+      - 'PULL_REQUEST_TEMPLATE.md'
+      - 'README.rst'
 
-indicators:
-  - xclim/indicators/**/*
-  - xclim/indicators/**/*
-  - xclim/indices/**/_*.py
-  - xclim/data/**/*.json
-  - xclim/data/**/*.yml
+'indicators':
+  - changed-files:
+    - any-glob-to-any-file:
+      - 'xclim/indicators/**/*'
+      - 'xclim/indices/**/_*.py'
+      - 'xclim/data/**/*.json'
+      - 'xclim/data/**/*.yml'
 
-information:
-  - CONTRIBUTING.rst
+'information':
+  - changed-files:
+    - any-glob-to-any-file:
+      - 'CONTRIBUTING.rst'
 
-sdba:
-  - xclim/sdba/**/*
-  - tests/test_sdba/*.py
+'sdba':
+  - changed-files:
+    - any-glob-to-any-file:
+      - 'xclim/sdba/**/*'
+      - 'tests/test_sdba/*.py'
diff --git a/.github/workflows/actions-versions-updater.yml b/.github/workflows/actions-versions-updater.yml
@@ -12,12 +12,19 @@ permissions:  # added using https://github.com/step-security/secure-repo
 jobs:
   build:
     runs-on: ubuntu-latest
-
+    permissions:
+      actions: write
+      contents: write
+      pull-requests: write
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
 
       - name: Checkout
         uses: actions/checkout@v4.1.1

diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml
@@ -12,7 +12,14 @@ jobs:
   add-to-project:
     name: Add Issue to xclim Project
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      repository-projects: write
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        with:
+          egress-policy: audit
       - uses: actions/add-to-project@v0.5.0
         with:
           project-url: https://github.com/orgs/Ouranosinc/projects/6

diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
@@ -29,6 +29,9 @@ jobs:
   bump_patch_version:
     name: Bumpversion Patch
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: write
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1

diff --git a/.github/workflows/cache-cleaner.yml b/.github/workflows/cache-cleaner.yml
@@ -15,7 +15,12 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            objects.githubusercontent.com:443
 
       - name: Check out code
         uses: actions/checkout@v4.1.1

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -15,6 +15,14 @@ jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
       - name: 'Checkout Repository'
         uses: actions/checkout@v4.1.1
       - name: 'Dependency Review'

diff --git a/.github/workflows/first_pull_request.yml b/.github/workflows/first_pull_request.yml
@@ -5,10 +5,16 @@ on:
     types:
       - opened
 
+permissions:  # added using https://github.com/step-security/secure-repo
+  contents: read
+
 jobs:
   welcome:
     name: Welcome
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1

diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
@@ -12,14 +12,24 @@ on: [pull_request_target]
   # See: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
 
 permissions:
-  checks: write
   contents: read
-  pull-requests: write
 
 jobs:
   label:
+    name: Label
     runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      contents: read
+      pull-requests: write
     steps:
-    - uses: actions/labeler@v5.0.0
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Harden Runner
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+      - uses: actions/labeler@v5.0.0
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/label_on_approval.yml b/.github/workflows/label_on_approval.yml
@@ -10,19 +10,25 @@ on:
       - review_requested
 
 permissions:
-  checks: write
   contents: read
-  pull-requests: write
 
 jobs:
   label_approved:
     name: Label on Approval
+    runs-on: ubuntu-latest
     if: |
       (!contains(github.event.pull_request.labels.*.name, 'approved')) &&
       (github.event.review.state == 'approved') &&
       (github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name)
-    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      contents: read
+      pull-requests: write
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        with:
+          egress-policy: audit
       - name: Label Approved
         uses: actions/github-script@v7.0.1
         with:
@@ -36,11 +42,19 @@ jobs:
 
   comment_approved:
     name: Comment Concerning Approved Tag
+    runs-on: ubuntu-latest
     if: |
       (github.event_name == 'pull_request_target') &&
       (github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name)
-    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      contents: read
+      pull-requests: write
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        with:
+          egress-policy: audit
       - name: Find comment
         uses: peter-evans/find-comment@v2.4.0
         id: fc

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -76,7 +76,13 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            files.pythonhosted.org:443
+            github.com:443
+            pypi.org:443
+            raw.githubusercontent.com:443
       - uses: actions/checkout@v4.1.1
       - name: Set up Python${{ matrix.python-version }}
         uses: actions/setup-python@v5.0.0
@@ -124,7 +130,18 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
         with:
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            azure.archive.ubuntu.com:80
+            coveralls.io:443
+            esm.ubuntu.com:443
+            files.pythonhosted.org:443
+            github.com:443
+            motd.ubuntu.com:443
+            packages.microsoft.com:443
+            ppa.launchpadcontent.net:443
+            pypi.org:443
+            raw.githubusercontent.com:443
       - uses: actions/checkout@v4.1.1
       - name: Install Eigen3
         if: contains(matrix.tox-env, 'sbck')
@@ -167,7 +184,16 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            coveralls.io:443
+            files.pythonhosted.org:443
+            github.com:443
+            objects.githubusercontent.com:443
+            pypi.org:443
+            raw.githubusercontent.com:443
       - uses: actions/checkout@v4.1.1
       - name: Setup Conda (Micromamba) with Python${{ matrix.python-version }}
         uses: mamba-org/setup-micromamba@v1.7.3

diff --git a/.github/workflows/publish-mastodon.yml b/.github/workflows/publish-mastodon.yml
@@ -15,6 +15,9 @@ on:
         default: true
         type: boolean
 
+permissions:  # added using https://github.com/step-security/secure-repo
+  contents: read
+
 jobs:
   toot:
     name: Generate Mastodon Toot

diff --git a/.github/workflows/testdata_version.yml b/.github/workflows/testdata_version.yml
@@ -20,6 +20,14 @@ jobs:
       contents: read
       pull-requests: write
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
       - uses: actions/checkout@v4.1.1
       - name: Find xclim-testdata Tag and CI Testing Branch
         run: |

diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml
@@ -42,7 +42,15 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            files.pythonhosted.org:443
+            github.com:443
+            objects.githubusercontent.com:443
+            pypi.org:443
+            raw.githubusercontent.com:443
       - uses: actions/checkout@v4.1.1
         with:
           fetch-depth: 0 # Fetch all history for all branches and tags.