Skip to content

Apply security best practices for GitHub Repo Supply Chain #1180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
+199 −84
Open

Apply security best practices for GitHub Repo Supply Chain #1180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5d9b003
[StepSecurity] Apply security best practices
step-security-bot Jun 19, 2025
71f6239
Protect against Supply Chain Attacks
Nick2bad4u Jun 19, 2025
d98f483
switch daily to monthly, add groups and pull request limit to new npm…
Nick2bad4u Jun 22, 2025
75b84ae
format: pre-order list so npm is under the same header. add comment a…
Nick2bad4u Jun 23, 2025
3d538b8
format: remove blank line
Nick2bad4u Jun 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,3 +41,23 @@ updates:
patch:
update-types:
- "patch"

- package-ecosystem: npm
directory: /npm/git-cliff
schedule:
interval: monthly
open-pull-requests-limit: 10
groups:
minor:
update-types:
- "minor"
patch:
update-types:
- "patch"

# Maintain dependencies for Docker
- package-ecosystem: docker
directory: /
schedule:
interval: monthly
open-pull-requests-limit: 10
56 changes: 28 additions & 28 deletions .github/workflows/cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,11 @@ jobs:
release_body: ${{ steps.git-cliff.outputs.content }}
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
- name: Generate a changelog
uses: orhun/git-cliff-action@main
uses: orhun/git-cliff-action@104a6cf3c9aa0fdfe4eab129f9c1900e1eb8f7fd # main
id: git-cliff
with:
config: cliff.toml
Expand Down Expand Up @@ -129,7 +129,7 @@ jobs:
}
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set the release version
shell: bash
run: echo "RELEASE_VERSION=${GITHUB_REF:11}" >> $GITHUB_ENV
Expand All @@ -142,21 +142,21 @@ jobs:
--allow-unauthenticated musl-tools
fi
- name: Install Rust toolchain
uses: actions-rs/toolchain@v1
uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
with:
toolchain: ${{ matrix.build.TOOLCHAIN }}
target: ${{ matrix.build.TARGET }}
override: true
- name: Build (linux/macos)
if: matrix.build.OS != 'windows-2022'
uses: actions-rs/cargo@v1
uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
with:
use-cross: true
command: build
args: --release --locked --target ${{ matrix.build.TARGET }}
- name: Build (windows)
if: matrix.build.OS == 'windows-2022'
uses: actions-rs/cargo@v1
uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
with:
command: build
args: --release --locked --target ${{ matrix.build.TARGET }} # --no-default-features
Expand Down Expand Up @@ -197,7 +197,7 @@ jobs:
git-cliff-${{ env.RELEASE_VERSION }}-${{ matrix.build.TARGET }}.tar.gz
- name: Publish to GitHub
if: ${{ !contains(github.ref, '-') }}
uses: svenstaro/upload-release-action@v2
uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # v2
with:
repo_token: ${{ secrets.GITHUB_TOKEN }}
file: git-cliff-${{ env.RELEASE_VERSION }}-${{ matrix.build.TARGET }}*
Expand All @@ -208,7 +208,7 @@ jobs:
body: "${{ needs.generate-changelog.outputs.release_body }}"
- name: Publish to GitHub (pre-release)
if: ${{ contains(github.ref, '-') }}
uses: svenstaro/upload-release-action@v2
uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # v2
with:
repo_token: ${{ secrets.GITHUB_TOKEN }}
file: git-cliff-${{ env.RELEASE_VERSION }}-${{ matrix.build.TARGET }}*
Expand All @@ -219,7 +219,7 @@ jobs:
prerelease: true
- name: Install node
if: matrix.build.NPM_PUBLISH == true
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 18
registry-url: "https://registry.npmjs.org"
Expand Down Expand Up @@ -252,7 +252,7 @@ jobs:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
- name: Build Python wheels (linux)
if: matrix.build.PYPI_PUBLISH == true && startsWith(matrix.build.NAME, 'linux')
uses: PyO3/maturin-action@v1
uses: PyO3/maturin-action@35be3186fc8e037e329f06b68dcd807d83dcc6dc # v1.49.2
with:
working-directory: pypi
target: ${{ matrix.build.TARGET }}
Expand All @@ -265,7 +265,7 @@ jobs:
if: |
matrix.build.PYPI_PUBLISH == true &&
(startsWith(matrix.build.OS, 'macos') || startsWith(matrix.build.OS, 'windows'))
uses: PyO3/maturin-action@v1
uses: PyO3/maturin-action@35be3186fc8e037e329f06b68dcd807d83dcc6dc # v1.49.2
with:
working-directory: pypi
target: ${{ matrix.build.TARGET }}
Expand All @@ -274,7 +274,7 @@ jobs:
sccache: "false"
- name: Build Python wheels (musl)
if: matrix.build.PYPI_PUBLISH == true && endsWith(matrix.build.OS, 'musl')
uses: PyO3/maturin-action@v1
uses: PyO3/maturin-action@35be3186fc8e037e329f06b68dcd807d83dcc6dc # v1.49.2
with:
working-directory: pypi
target: ${{ matrix.build.TARGET }}
Expand All @@ -283,7 +283,7 @@ jobs:
sccache: "false"
manylinux: musllinux_1_2
- name: Upload Python wheels
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: "wheels-${{ matrix.build.TARGET }}"
working-directory: pypi
Expand All @@ -295,9 +295,9 @@ jobs:
runs-on: ubuntu-22.04
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Install node
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 18
registry-url: "https://registry.npmjs.org"
Expand Down Expand Up @@ -325,13 +325,13 @@ jobs:
runs-on: ubuntu-22.04
needs: publish-binaries
steps:
- uses: actions/download-artifact@v4
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
path: pypi/wheels
pattern: wheels-*
merge-multiple: true
- name: Publish to PyPI
uses: PyO3/maturin-action@v1
uses: PyO3/maturin-action@35be3186fc8e037e329f06b68dcd807d83dcc6dc # v1.49.2
env:
MATURIN_PYPI_TOKEN: ${{ vars.USE_TESTPYPI == 'true' && secrets.TESTPYPI_API_TOKEN || secrets.PYPI_API_TOKEN }}
MATURIN_REPOSITORY: ${{ vars.USE_TESTPYPI == 'true' && 'testpypi' || 'pypi' }}
Expand All @@ -345,12 +345,12 @@ jobs:
runs-on: ubuntu-22.04
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set the release version
shell: bash
run: echo "RELEASE_VERSION=${GITHUB_REF:11}" >> $GITHUB_ENV
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
uses: dtolnay/rust-toolchain@4305c38b25d97ef35a8ad1f985ccf2d2242004f2 # stable
with:
targets: x86_64-unknown-linux-gnu
- name: Install cargo-deb
Expand All @@ -375,7 +375,7 @@ jobs:
git-cliff-${{ env.RELEASE_VERSION }}.deb
- name: Upload the release
if: ${{ !contains(github.ref, '-') }}
uses: svenstaro/upload-release-action@v2
uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # v2
with:
repo_token: ${{ secrets.GITHUB_TOKEN }}
file: git-cliff-${{ env.RELEASE_VERSION }}.deb
Expand All @@ -384,7 +384,7 @@ jobs:
body: "${{ needs.generate-changelog.outputs.release_body }}"
- name: Upload the pre-release
if: ${{ contains(github.ref, '-') }}
uses: svenstaro/upload-release-action@v2
uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # v2
with:
repo_token: ${{ secrets.GITHUB_TOKEN }}
file: git-cliff-${{ env.RELEASE_VERSION }}.deb
Expand All @@ -398,12 +398,12 @@ jobs:
runs-on: ubuntu-22.04
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set the release version
shell: bash
run: echo "RELEASE_VERSION=${GITHUB_REF:11}" >> $GITHUB_ENV
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
uses: dtolnay/rust-toolchain@4305c38b25d97ef35a8ad1f985ccf2d2242004f2 # stable
with:
targets: x86_64-unknown-linux-gnu
- name: Install cargo-generate-rpm
Expand All @@ -426,7 +426,7 @@ jobs:
git-cliff-${{ env.RELEASE_VERSION }}.x86_64.rpm
- name: Upload the release
if: ${{ !contains(github.ref, '-') }}
uses: svenstaro/upload-release-action@v2
uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # v2
with:
repo_token: ${{ secrets.GITHUB_TOKEN }}
file: git-cliff-${{ env.RELEASE_VERSION }}.x86_64.rpm
Expand All @@ -435,7 +435,7 @@ jobs:
body: "${{ needs.generate-changelog.outputs.release_body }}"
- name: Upload the pre-release
if: ${{ contains(github.ref, '-') }}
uses: svenstaro/upload-release-action@v2
uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # v2
with:
repo_token: ${{ secrets.GITHUB_TOKEN }}
file: git-cliff-${{ env.RELEASE_VERSION }}.x86_64.rpm
Expand All @@ -448,11 +448,11 @@ jobs:
runs-on: ubuntu-22.04
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set the release version
run: echo "RELEASE_VERSION=${GITHUB_REF:11}" >> $GITHUB_ENV
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
uses: dtolnay/rust-toolchain@4305c38b25d97ef35a8ad1f985ccf2d2242004f2 # stable
with:
targets: x86_64-unknown-linux-gnu
- name: Prepare for the crates.io release
Expand Down Expand Up @@ -485,7 +485,7 @@ jobs:
contents: read
steps:
- name: Bump formula
uses: mislav/[email protected]
uses: mislav/bump-homebrew-formula-action@8e2baa47daaa8db10fcdeb04105dfa6850eb0d68 # v3.4
with:
formula-name: git-cliff
formula-path: Formula/g/git-cliff.rb
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/check-semver.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,11 @@ jobs:
error_message: ${{ steps.check_semver.outputs.error_message }}
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Run cargo-semver-checks
id: check_semver
uses: orhun/cargo-semver-checks-action@feat/add_action_output
uses: orhun/cargo-semver-checks-action@cc19b888f2062f8cc964c1d52f7f29d910becb31 # feat/add_action_output

comment-on-pr:
name: Comment on pull request
Expand All @@ -31,7 +31,7 @@ jobs:
steps:
- name: Comment
if: ${{ needs.check-semver.outputs.error_message != null }}
uses: marocchino/sticky-pull-request-comment@v2
uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 # v2.9.1
with:
header: pr-semver-check-error
message: |
Expand All @@ -47,7 +47,7 @@ jobs:

- name: Delete comment
if: ${{ needs.check-semver.outputs.error_message == null }}
uses: marocchino/sticky-pull-request-comment@v2
uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 # v2.9.1
with:
header: pr-semver-check-error
delete: true
Loading
Loading