Skip to content

Commit df75caa

Browse files
muhlba91muhlba91
committed
chore: introduce repository and project security scanning
1 parent 53c6944 commit df75caa

File tree

6 files changed

+131
-28
lines changed

6 files changed

+131
-28
lines changed

‎.github/workflows/dependency_review.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
name: Dependency Review
3+
4+
on:
5+
pull_request:
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
dependency-review:
12+
runs-on: ubuntu-latest
13+
name: Dependency Review
14+
15+
steps:
16+
- uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
17+
with:
18+
egress-policy: audit
19+
20+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2.2.2
21+
22+
- uses: actions/dependency-review-action@a6993e2c61fd5dc440b409aa1d6904921c5e1894 # v4.3.5

‎.github/workflows/release.yml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ on:
88

99
permissions:
1010
contents: read
11-
pull-requests: read
1211

1312
jobs:
1413
release:
@@ -22,7 +21,11 @@ jobs:
2221
pull-requests: write
2322

2423
steps:
25-
- uses: google-github-actions/release-please-action@v4
24+
- uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
25+
with:
26+
egress-policy: audit
27+
28+
- uses: google-github-actions/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee # v4.1.1
2629
id: release
2730

2831
container:
@@ -36,19 +39,19 @@ jobs:
3639
packages: write
3740

3841
steps:
39-
- name: Checkout repository
40-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
42+
- uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
43+
with:
44+
egress-policy: audit
45+
46+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
4147
with:
4248
fetch-depth: 0
4349
token: ${{ secrets.GITHUB_TOKEN }}
4450

45-
- name: Setup QEMU
46-
uses: docker/setup-qemu-action@v3
47-
- name: Setup Docker Buildx
48-
uses: docker/setup-buildx-action@v3
51+
- uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
52+
- uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
4953

50-
- name: Login to ghcr.io
51-
uses: docker/login-action@v3
54+
- uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
5255
with:
5356
registry: ghcr.io
5457
username: ${{ github.actor }}
@@ -64,8 +67,7 @@ jobs:
6467
PGVECTO_FROM_TAG=$(echo $PGVECTO_IMAGE | cut -d'-' -f4)
6568
echo "pgvecto=${PGVECTO_FROM_TAG}" >> "$GITHUB_OUTPUT"
6669
67-
- name: Build and Push Image
68-
uses: docker/build-push-action@v6
70+
- uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
6971
with:
7072
context: .
7173
platforms: linux/amd64,linux/arm64

‎.github/workflows/scorecard.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
---
2+
name: Scorecard Security
3+
4+
on:
5+
# For Branch-Protection check. Only the default branch is supported. See
6+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
7+
branch_protection_rule:
8+
# To guarantee Maintained check is occasionally updated. See
9+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
10+
schedule:
11+
- cron: '20 7 * * 2'
12+
push:
13+
branches:
14+
- main
15+
workflow_dispatch:
16+
17+
permissions: read-all
18+
19+
jobs:
20+
analysis:
21+
runs-on: ubuntu-latest
22+
name: Scorecard Analysis
23+
permissions:
24+
# Needed to upload the results to code-scanning dashboard.
25+
security-events: write
26+
# Needed to publish results and get a badge (see publish_results below).
27+
id-token: write
28+
contents: read
29+
actions: read
30+
# To allow GraphQL ListCommits to work
31+
issues: read
32+
pull-requests: read
33+
# To detect SAST tools
34+
checks: read
35+
36+
steps:
37+
- uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
38+
with:
39+
egress-policy: audit
40+
41+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2.2.2
42+
with:
43+
persist-credentials: false
44+
45+
- uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
46+
with:
47+
results_file: results.sarif
48+
results_format: sarif
49+
publish_results: true
50+
51+
- uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
52+
with:
53+
name: Scorecard Analysis
54+
path: results.sarif
55+
retention-days: 5
56+
57+
- uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
58+
with:
59+
sarif_file: results.sarif

‎.github/workflows/verify.yml‎

Lines changed: 23 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,24 @@ on:
88
pull_request:
99
workflow_dispatch:
1010

11+
permissions:
12+
contents: read
13+
1114
jobs:
1215
conform:
1316
runs-on: ubuntu-latest
1417
name: Conform
1518

1619
steps:
17-
- uses: actions/checkout@v4
20+
- uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
21+
with:
22+
egress-policy: audit
23+
24+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
1825
with:
1926
fetch-depth: 0
2027

21-
- uses: siderolabs/conform@v0.1.0-alpha.27
28+
- uses: siderolabs/conform@6380738b7fdfc68b208ce0674c4ac1ba314ba600 # v0.1.0-alpha.27
2229
with:
2330
token: ${{ secrets.GITHUB_TOKEN }}
2431

@@ -27,13 +34,15 @@ jobs:
2734
name: Lint Dockerfile
2835

2936
steps:
30-
- name: Checkout repository
31-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
37+
- uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
38+
with:
39+
egress-policy: audit
40+
41+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
3242
with:
3343
fetch-depth: 0
3444

35-
- name: Lint Dockerfile
36-
uses: hadolint/hadolint-action@v3.1.0
45+
- uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
3746
with:
3847
dockerfile: Dockerfile
3948

@@ -42,16 +51,17 @@ jobs:
4251
name: Build Container Image
4352

4453
steps:
45-
- name: Checkout repository
46-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
54+
- uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
55+
with:
56+
egress-policy: audit
57+
58+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
4759
with:
4860
fetch-depth: 0
4961
token: ${{ secrets.GITHUB_TOKEN }}
5062

51-
- name: Setup QEMU
52-
uses: docker/setup-qemu-action@v3
53-
- name: Setup Docker Buildx
54-
uses: docker/setup-buildx-action@v3
63+
- uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
64+
- uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
5565

5666
- name: Get Upstream Tags
5767
id: from_tag
@@ -63,8 +73,7 @@ jobs:
6373
PGVECTO_FROM_TAG=$(echo $PGVECTO_IMAGE | cut -d'-' -f4)
6474
echo "pgvecto=${PGVECTO_FROM_TAG}" >> "$GITHUB_OUTPUT"
6575
66-
- name: Build Image
67-
uses: docker/build-push-action@v6
76+
- uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
6877
with:
6978
context: .
7079
platforms: linux/amd64,linux/arm64

‎.pre-commit-config.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,14 @@ repos:
77
stages:
88
- commit-msg
99
- repo: https://github.com/hadolint/hadolint
10-
rev: v2.13.0-beta
10+
rev: v2.13.1-beta
1111
hooks:
1212
- id: hadolint
1313
- repo: https://github.com/pre-commit/pre-commit-hooks
14-
rev: v4.6.0
14+
rev: v5.0.0
1515
hooks:
16+
- id: end-of-file-fixer
17+
- id: trailing-whitespace
1618
- id: check-json
1719
- id: check-merge-conflict
1820
- id: check-symlinks
@@ -34,3 +36,11 @@ repos:
3436
# "--branch",
3537
# "next"
3638
# ]
39+
- repo: https://github.com/gitleaks/gitleaks
40+
rev: v8.21.1
41+
hooks:
42+
- id: gitleaks
43+
- repo: https://github.com/jumanjihouse/pre-commit-hooks
44+
rev: 3.0.0
45+
hooks:
46+
- id: shellcheck

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
[![](https://img.shields.io/github/license/muhlba91/postgresql-pgvecto-container?style=for-the-badge)](LICENSE)
44
[![](https://img.shields.io/github/actions/workflow/status/muhlba91/postgresql-pgvecto-container/release.yml?style=for-the-badge)](https://github.com/muhlba91/postgresql-pgvecto-container/actions/workflows/release.yml)
5+
[![](https://api.scorecard.dev/projects/github.com/muhlba91/postgresql-pgvecto-container/badge?style=for-the-badge)](https://scorecard.dev/viewer/?uri=github.com/muhlba91/postgresql-pgvecto-container)
56
[![](https://img.shields.io/github/v/tag/muhlba91/postgresql-pgvecto-container?style=for-the-badge)](https://github.com/muhlba91/postgresql-pgvecto-container/releases)
67
[![](https://img.shields.io/github/release-date/muhlba91/postgresql-pgvecto-container?style=for-the-badge)](https://github.com/muhlba91/postgresql-pgvecto-container/releases)
78
<a href="https://www.buymeacoffee.com/muhlba91" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/default-orange.png" alt="Buy Me A Coffee" height="28" width="150"></a>

0 commit comments

Comments
 (0)