StepSecurity Bot
88ea855cff
fix(ci): Fixing StepSecurity Flagged Issues ( #11311 )
...
This pull request is created by
[StepSecurity](https://app.stepsecurity.io/securerepo ) at the request of
@areyou1or0.
## Summary
This pull request is created by
[StepSecurity](https://app.stepsecurity.io/securerepo ) at the request of
@areyou1or0. Please merge the Pull Request to incorporate the requested
changes. Please tag @areyou1or0 on your message if you have any
questions related to the PR.
## Summary
This pull request is created by
[StepSecurity](https://app.stepsecurity.io/securerepo ) at the request of
@areyou1or0. Please merge the Pull Request to incorporate the requested
changes. Please tag @areyou1or0 on your message if you have any
questions related to the PR.
## Security Fixes
### Least Privileged GitHub Actions Token Permissions
The GITHUB_TOKEN is an automatically generated secret to make
authenticated calls to the GitHub API. GitHub recommends setting minimum
token permissions for the GITHUB_TOKEN.
- [GitHub Security
Guide](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow )
- [The Open Source Security Foundation (OpenSSF) Security
Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions )
### Pinned Dependencies
GitHub Action tags and Docker tags are mutable. This poses a security
risk. GitHub's Security Hardening guide recommends pinning actions to
full length commit.
- [GitHub Security
Guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions )
- [The Open Source Security Foundation (OpenSSF) Security
Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies )
### Harden Runner
[Harden-Runner](https://github.com/step-security/harden-runner ) is an
open-source security agent for the GitHub-hosted runner to prevent
software supply chain attacks. It prevents exfiltration of credentials,
detects tampering of source code during build, and enables running jobs
without `sudo` access. See how popular open-source projects use
Harden-Runner
[here](https://docs.stepsecurity.io/whos-using-harden-runner ).
<details>
<summary>Harden runner usage</summary>
You can find link to view insights and policy recommendation in the
build log
<img
src="https://github.com/step-security/harden-runner/blob/main/images/buildlog1.png?raw=true "
width="60%" height="60%">
Please refer to
[documentation](https://docs.stepsecurity.io/harden-runner ) to find more
details.
</details>
will fix https://github.com/neondatabase/cloud/issues/26141
2025-03-19 16:44:22 +00:00
JC Grünhage
2dfff6a2a3
impr(ci): use ghcr.io as the default container registry ( #11210 )
...
## Problem
Docker Hub has new rate limits coming up, and to avoid problems coming
with those we're switching to GHCR.
## Summary of changes
- Push images to GHCR initially and distribute them from there
- Use images from GHCR in docker-compose
2025-03-18 11:30:49 +00:00
Alexander Bayandin
b6bc954c5d
CI: move check codestyle python to reusable workflow and run on a merge_group ( #9683 )
...
## Problem
To prevent breaking main after Python 3.11 PR get merged
we need to enable merge queue and run `check-codestyle-python`
job on it
## Summary of changes
- Move `check-codestyle-python` to a reusable workflow
- Run this workflow on `merge_group` event
2024-11-08 17:32:56 +00:00
