diff --git a/.github/workflows/ancient.yml b/.github/workflows/ancient.yml index a28c90cf..2afa7eb9 100644 --- a/.github/workflows/ancient.yml +++ b/.github/workflows/ancient.yml @@ -59,11 +59,16 @@ jobs: bundler: "2.3.27" steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & RubyGems - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.github/workflows/auto-assign.yml b/.github/workflows/auto-assign.yml index 6fcefcf9..6da6464d 100644 --- a/.github/workflows/auto-assign.yml +++ b/.github/workflows/auto-assign.yml @@ -4,6 +4,9 @@ on: types: [opened] pull_request: types: [opened] +permissions: + contents: read + jobs: run: runs-on: ubuntu-latest @@ -11,8 +14,13 @@ jobs: issues: write pull-requests: write steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: 'Auto-assign issue' - uses: pozil/auto-assign-issue@v3 + uses: pozil/auto-assign-issue@dda699c5656ae92f208b052fc91193a8423fffa6 # v3 with: repo-token: ${{ secrets.GITHUB_TOKEN }} assignees: pboling diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 22bdf509..6f01611a 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -20,6 +20,9 @@ on: schedule: - cron: '35 1 * * 5' +permissions: + contents: read + jobs: analyze: name: Analyze @@ -37,12 +40,17 @@ jobs: # Learn more about CodeQL language support at https://git.io/codeql-language-support steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -53,7 +61,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -67,4 +75,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 5b48e78c..16d20229 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -54,11 +54,16 @@ jobs: bundler: latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & RubyGems - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: "${{ matrix.ruby }}" rubygems: "${{ matrix.rubygems }}" @@ -78,14 +83,14 @@ jobs: # Do SaaS coverage uploads first - name: Upload coverage to Coveralls if: ${{ !env.ACT }} - uses: coverallsapp/github-action@master + uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master with: github-token: ${{ secrets.GITHUB_TOKEN }} continue-on-error: ${{ matrix.experimental != 'false' }} - name: Upload coverage to QLTY if: ${{ !env.ACT }} - uses: qltysh/qlty-action/coverage@main + uses: qltysh/qlty-action/coverage@141b881236146435192435eb7b0e06ea0b70b4d9 # main with: token: ${{secrets.QLTY_COVERAGE_TOKEN}} files: coverage/.resultset.json @@ -95,7 +100,7 @@ jobs: # which will hopefully be noticed for the lack of code coverage comments - name: Upload coverage to CodeCov if: ${{ !env.ACT }} - uses: codecov/codecov-action@v6 + uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1 with: use_oidc: true fail_ci_if_error: false # optional (default = false) @@ -105,7 +110,7 @@ jobs: # Then PR comments - name: Code Coverage Summary Report if: ${{ !env.ACT && github.event_name == 'pull_request' }} - uses: irongut/CodeCoverageSummary@v1.3.0 + uses: irongut/CodeCoverageSummary@51cc3a756ddcd398d447c044c02cb6aa83fdae95 # v1.3.0 with: filename: ./coverage/coverage.xml badge: true @@ -119,7 +124,7 @@ jobs: continue-on-error: ${{ matrix.experimental != 'false' }} - name: Add Coverage PR Comment - uses: marocchino/sticky-pull-request-comment@v3 + uses: marocchino/sticky-pull-request-comment@d4d6b0936434b21bc8345ad45a440c5f7d2c40ff # v3.0.3 if: ${{ !env.ACT && github.event_name == 'pull_request' }} with: recreate: true diff --git a/.github/workflows/current.yml b/.github/workflows/current.yml index 8a60c855..c5319630 100644 --- a/.github/workflows/current.yml +++ b/.github/workflows/current.yml @@ -62,13 +62,18 @@ jobs: bundler: default steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }} - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & RubyGems if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }} - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.github/workflows/dep-heads.yml b/.github/workflows/dep-heads.yml index d912f619..465f9106 100644 --- a/.github/workflows/dep-heads.yml +++ b/.github/workflows/dep-heads.yml @@ -64,13 +64,18 @@ jobs: bundler: default steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }} - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & RubyGems if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }} - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 222041e4..52f6fb0b 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -14,7 +14,12 @@ jobs: dependency-review: runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: 'Checkout Repository' - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: 'Dependency Review' - uses: actions/dependency-review-action@v5 + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 diff --git a/.github/workflows/heads.yml b/.github/workflows/heads.yml index dcf72ff4..4fd6f81e 100644 --- a/.github/workflows/heads.yml +++ b/.github/workflows/heads.yml @@ -63,13 +63,18 @@ jobs: bundler: default steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }} - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & RubyGems if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }} - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.github/workflows/jruby.yml b/.github/workflows/jruby.yml index 3ff8d8cf..c31f8b21 100644 --- a/.github/workflows/jruby.yml +++ b/.github/workflows/jruby.yml @@ -45,13 +45,18 @@ jobs: bundler: default steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout if: ${{ !env.ACT }} - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & RubyGems if: ${{ !env.ACT }} - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.github/workflows/legacy.yml b/.github/workflows/legacy.yml index 9fe3c7cb..32109f2a 100644 --- a/.github/workflows/legacy.yml +++ b/.github/workflows/legacy.yml @@ -54,11 +54,16 @@ jobs: bundler: '2.6.9' steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & RubyGems - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.github/workflows/license-eye.yml b/.github/workflows/license-eye.yml index 7c96fbeb..84503906 100644 --- a/.github/workflows/license-eye.yml +++ b/.github/workflows/license-eye.yml @@ -27,11 +27,16 @@ jobs: if: "!contains(github.event.commits[0].message, '[ci skip]') && !contains(github.event.commits[0].message, '[skip ci]')" runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Check Dependencies' License - uses: apache/skywalking-eyes/dependency@main + uses: apache/skywalking-eyes/dependency@e910f72bae86171d727742c25f8a4555b7b83893 # main with: config: .licenserc.yaml # Ruby packages declared as dependencies in gemspecs or Gemfiles are diff --git a/.github/workflows/locked_deps.yml b/.github/workflows/locked_deps.yml index 74d53348..e1f51023 100644 --- a/.github/workflows/locked_deps.yml +++ b/.github/workflows/locked_deps.yml @@ -70,11 +70,16 @@ jobs: experimental: false steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & RubyGems - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index ce0133e9..0c0f95a5 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -19,6 +19,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: test: name: Specs - Ruby ${{ matrix.ruby }} ${{matrix.gemfile}} ${{ matrix.name_extra || '' }} @@ -42,10 +45,15 @@ jobs: runs-on: macos-latest continue-on-error: ${{ matrix.experimental || endsWith(matrix.ruby, 'head') }} steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & Bundle - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.github/workflows/opencollective.yml b/.github/workflows/opencollective.yml index afe7453b..b81a956c 100644 --- a/.github/workflows/opencollective.yml +++ b/.github/workflows/opencollective.yml @@ -13,11 +13,16 @@ jobs: update-backers: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Setup Ruby & RubyGems - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ruby rubygems: default diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml new file mode 100644 index 00000000..5129d3da --- /dev/null +++ b/.github/workflows/scorecards.yml @@ -0,0 +1,81 @@ +# This workflow uses actions that are not certified by GitHub. They are provided +# by a third-party and are governed by separate terms of service, privacy +# policy, and support documentation. + +name: Scorecard supply-chain security +on: + # For Branch-Protection check. Only the default branch is supported. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection + branch_protection_rule: + # To guarantee Maintained check is occasionally updated. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained + schedule: + - cron: '20 7 * * 2' + push: + branches: ["main"] + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Needed to publish results and get a badge (see publish_results below). + id-token: write + contents: read + actions: read + # To allow GraphQL ListCommits to work + issues: read + pull-requests: read + # To detect SAST tools + checks: read + + steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + + - name: "Checkout code" + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 + with: + results_file: results.sarif + results_format: sarif + # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: + # - you want to enable the Branch-Protection check on a *public* repository, or + # - you are installing Scorecards on a *private* repository + # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. + # repo_token: ${{ secrets.SCORECARD_TOKEN }} + + # Public repositories: + # - Publish results to OpenSSF REST API for easy access by consumers + # - Allows the repository to include the Scorecard badge. + # - See https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories: + # - `publish_results` will always be set to `false`, regardless + # of the value entered here. + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard. + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@458d36d7d4f47d0dd16ca424c1d3cda0060f1360 # v3.35.5 + with: + sarif_file: results.sarif diff --git a/.github/workflows/style.yml b/.github/workflows/style.yml index b00e227b..de11de1e 100644 --- a/.github/workflows/style.yml +++ b/.github/workflows/style.yml @@ -43,11 +43,16 @@ jobs: bundler: latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & RubyGems - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.github/workflows/supported.yml b/.github/workflows/supported.yml index 7937fb11..bc3a5256 100644 --- a/.github/workflows/supported.yml +++ b/.github/workflows/supported.yml @@ -53,11 +53,16 @@ jobs: bundler: latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & RubyGems - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.github/workflows/truffle.yml b/.github/workflows/truffle.yml index 53ac8efc..c3a9b561 100644 --- a/.github/workflows/truffle.yml +++ b/.github/workflows/truffle.yml @@ -46,13 +46,18 @@ jobs: bundler: default steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }} - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & RubyGems if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }} - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.github/workflows/unlocked_deps.yml b/.github/workflows/unlocked_deps.yml index e800cd12..6941686b 100644 --- a/.github/workflows/unlocked_deps.yml +++ b/.github/workflows/unlocked_deps.yml @@ -62,11 +62,16 @@ jobs: bundler: latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & RubyGems - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.github/workflows/unsupported.yml b/.github/workflows/unsupported.yml index 4c938cba..8ccb2857 100644 --- a/.github/workflows/unsupported.yml +++ b/.github/workflows/unsupported.yml @@ -54,11 +54,16 @@ jobs: bundler: '2.4.22' steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & RubyGems - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 65e93f60..87dfc491 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -19,6 +19,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: test: name: Specs - Ruby ${{ matrix.ruby }} ${{matrix.gemfile}} ${{ matrix.name_extra || '' }} @@ -41,10 +44,15 @@ jobs: runs-on: windows-latest continue-on-error: ${{ matrix.experimental || endsWith(matrix.ruby, 'head') }} steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby & Bundle - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0 with: ruby-version: ${{ matrix.ruby }} rubygems: ${{ matrix.rubygems }} diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 00000000..c21d7bd9 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,15 @@ +repos: +- repo: https://github.com/gitleaks/gitleaks + rev: v8.16.3 + hooks: + - id: gitleaks +- repo: https://github.com/jumanjihouse/pre-commit-hooks + rev: 3.0.0 + hooks: + - id: RuboCop + - id: shellcheck +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.4.0 + hooks: + - id: end-of-file-fixer + - id: trailing-whitespace