From 6f91094402d1b9b16cdabd2583544f893f38154c Mon Sep 17 00:00:00 2001 From: Varun Sharma Date: Fri, 6 Sep 2024 05:27:00 -0700 Subject: [PATCH] Update KB and action tags --- .github/workflows/automatePR.yml | 4 ++-- .github/workflows/codeql.yml | 4 ++-- .github/workflows/int.yml | 4 ++-- .github/workflows/kb-test.yml | 4 ++-- .github/workflows/kbanalysis.yml | 4 ++-- .github/workflows/release.yml | 6 +++--- .github/workflows/scorecards.yml | 4 ++-- .github/workflows/test.yml | 4 ++-- .../github-actions/lock-closed/action-security.yml | 2 -- .../actions/devbotsxyz/xcode-notarize/action-security.yml | 2 -- .../actions/devbotsxyz/xcode-staple/action-security.yml | 2 -- .../actions/remove-disabled-formulae/action-security.yml | 2 -- 12 files changed, 17 insertions(+), 25 deletions(-) delete mode 100644 knowledge-base/actions/angular/dev-infra/github-actions/lock-closed/action-security.yml delete mode 100644 knowledge-base/actions/devbotsxyz/xcode-notarize/action-security.yml delete mode 100644 knowledge-base/actions/devbotsxyz/xcode-staple/action-security.yml delete mode 100644 knowledge-base/actions/homebrew/actions/remove-disabled-formulae/action-security.yml diff --git a/.github/workflows/automatePR.yml b/.github/workflows/automatePR.yml index ab9e287f..3f7d2b00 100644 --- a/.github/workflows/automatePR.yml +++ b/.github/workflows/automatePR.yml @@ -17,11 +17,11 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845 # v2.4.1 + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 with: egress-policy: audit - - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 with: repository: step-security/secure-repo diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 62d466be..dc85a5fa 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -41,12 +41,12 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde with: egress-policy: audit - name: Checkout repository - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/int.yml b/.github/workflows/int.yml index 5fc4494f..a2464971 100644 --- a/.github/workflows/int.yml +++ b/.github/workflows/int.yml @@ -15,11 +15,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde with: egress-policy: audit - name: Checkout - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 with: fetch-depth: 0 - name: Set up Go diff --git a/.github/workflows/kb-test.yml b/.github/workflows/kb-test.yml index c129faa6..ae9546aa 100644 --- a/.github/workflows/kb-test.yml +++ b/.github/workflows/kb-test.yml @@ -14,7 +14,7 @@ jobs: contents: read runs-on: ubuntu-latest steps: - - uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v1 + - uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 with: allowed-endpoints: > api.github.com:443 @@ -25,7 +25,7 @@ jobs: objects.githubusercontent.com:443 golang.org:443 - name: Checkout - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v2 with: ref: ${{ github.event.pull_request.head.sha }} - name: Set up Go diff --git a/.github/workflows/kbanalysis.yml b/.github/workflows/kbanalysis.yml index 6d846e15..7fcbd622 100644 --- a/.github/workflows/kbanalysis.yml +++ b/.github/workflows/kbanalysis.yml @@ -22,11 +22,11 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde with: egress-policy: audit - - uses: actions/checkout@d0651293c4a5a52e711f25b41b05b2212f385d28 + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 with: repository: step-security/secure-repo diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2ec3f2b4..cf6fefaa 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,11 +17,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde with: egress-policy: audit - name: Checkout - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 with: fetch-depth: 0 - name: Set up Go @@ -33,7 +33,7 @@ jobs: env: PAT: ${{ secrets.PAT }} - - uses: step-security/wait-for-secrets@1204ba02d7a707c4ef2e906d2ea1e36eebd9bbd2 + - uses: step-security/wait-for-secrets@5809f7d044804a5a1d43217fa8f3e855939fc9ef id: wait-for-secrets with: slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }} diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 54e09afb..2563ab38 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -32,12 +32,12 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845 # v2.4.1 + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 with: egress-policy: audit - name: "Checkout code" - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 with: persist-credentials: false diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 869959f5..15f2147d 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -17,7 +17,7 @@ jobs: contents: read runs-on: ubuntu-latest steps: - - uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v1 + - uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 with: allowed-endpoints: > api.github.com:443 @@ -30,7 +30,7 @@ jobs: objects.githubusercontent.com:443 golang.org:443 - name: Checkout - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 with: ref: ${{ github.event.pull_request.head.sha }} - name: Set up Go diff --git a/knowledge-base/actions/angular/dev-infra/github-actions/lock-closed/action-security.yml b/knowledge-base/actions/angular/dev-infra/github-actions/lock-closed/action-security.yml deleted file mode 100644 index 051053cd..00000000 --- a/knowledge-base/actions/angular/dev-infra/github-actions/lock-closed/action-security.yml +++ /dev/null @@ -1,2 +0,0 @@ -name: 'Lock Closed Issues' # angular/dev-infra/github-actions/lock-closed -# GITHUB_TOKEN not used diff --git a/knowledge-base/actions/devbotsxyz/xcode-notarize/action-security.yml b/knowledge-base/actions/devbotsxyz/xcode-notarize/action-security.yml deleted file mode 100644 index 08a07874..00000000 --- a/knowledge-base/actions/devbotsxyz/xcode-notarize/action-security.yml +++ /dev/null @@ -1,2 +0,0 @@ -name: 'Xcode Notarize' # devbotsxyz/xcode-notarize -# GITHUB_TOKEN not used diff --git a/knowledge-base/actions/devbotsxyz/xcode-staple/action-security.yml b/knowledge-base/actions/devbotsxyz/xcode-staple/action-security.yml deleted file mode 100644 index 62790b12..00000000 --- a/knowledge-base/actions/devbotsxyz/xcode-staple/action-security.yml +++ /dev/null @@ -1,2 +0,0 @@ -name: 'Xcode Staple' # devbotsxyz/xcode-staple -# GITHUB_TOKEN not used diff --git a/knowledge-base/actions/homebrew/actions/remove-disabled-formulae/action-security.yml b/knowledge-base/actions/homebrew/actions/remove-disabled-formulae/action-security.yml deleted file mode 100644 index 2ffad340..00000000 --- a/knowledge-base/actions/homebrew/actions/remove-disabled-formulae/action-security.yml +++ /dev/null @@ -1,2 +0,0 @@ -name: Remove disabled formulae # Homebrew/actions/remove-disabled-formulae -# GITHUB_TOKEN not used \ No newline at end of file