Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[StepSecurity] Apply security best practices #1365

Merged
merged 7 commits into from
May 20, 2024
Merged

[StepSecurity] Apply security best practices #1365

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
12d3c66
[StepSecurity] Apply security best practices
step-security-bot Apr 16, 2024
1995cf9
Merge branch 'dev' into stepsecurity_remediation_1713273502
egecetin Apr 17, 2024
e44b170
Update scorecards.yml
egecetin Apr 18, 2024
61c3da5
Remove dependency-review and add badge to README
egecetin Apr 23, 2024
7f5a970
point to existing PAT
egecetin Apr 26, 2024
ed0b71f
comment out shield for now
egecetin May 7, 2024
5b2b14b
reorder
egecetin May 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 9 additions & 6 deletions .github/workflows/auto_update.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,25 +4,28 @@ on:
schedule:
- cron: '10 10 15 * *'

permissions:
contents: read

jobs:
precommit-update:
runs-on: ubuntu-latest

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
with:
ref: dev
- name: Setup Python
uses: actions/setup-python@v5
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
with:
python-version: "3.8.x"
- name: Run update
run: |
pip install pre-commit
pre-commit autoupdate
- name: Create Pull Request
uses: peter-evans/create-pull-request@v6
uses: peter-evans/create-pull-request@c55203cfde3e5c11a452d352b4393e68b85b4533 # v6.0.3
with:
token: ${{ secrets.PAT }}
author: GitHub <noreply@github.com>
Expand All @@ -43,19 +46,19 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
with:
ref: dev
- name: Setup Python
uses: actions/setup-python@v5
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
with:
python-version: "3.9.x"
- name: Run update
run: |
python3 3rdParty/OUIDataset/create_oui_data.py
mv -f PCPP_OUIDataset.json 3rdParty/OUIDataset/PCPP_OUIDataset.json
- name: Create Pull Request
uses: peter-evans/create-pull-request@v6
uses: peter-evans/create-pull-request@c55203cfde3e5c11a452d352b4393e68b85b4533 # v6.0.3
with:
token: ${{ secrets.PAT }}
author: GitHub <noreply@github.com>
Expand Down
55 changes: 29 additions & 26 deletions .github/workflows/build_and_test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,16 @@ env:
BUILD_DIR: Dist
GCOVR_FLAGS: --gcov-ignore-parse-errors --exclude-throw-branches --filter Common --filter Pcap --filter Packet --xml

permissions:
contents: read

jobs:
pre-commit:
runs-on: ubuntu-latest
container: seladb/alpine317
steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
egecetin marked this conversation as resolved.
Show resolved Hide resolved

# Checkout is performed out of the container and doesn't match our user
- name: Fix checkout ownership
Expand All @@ -26,7 +29,7 @@ jobs:
apk update && apk add cppcheck python3-dev
python3 -m pip install cmake-format

- uses: pre-commit/action@v3.0.1
- uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

- name: CMake format
run: |
Expand Down Expand Up @@ -73,7 +76,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

# Checkout is performed out of the container and doesn't match our user
- name: Fix checkout ownership
Expand Down Expand Up @@ -124,7 +127,7 @@ jobs:
gcovr -v -r . ${{ matrix.additional-gcov-flags }} $GCOVR_FLAGS -o coverage.xml

- name: Upload Coverage Results
uses: codecov/codecov-action@v3.1.6
uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3.1.6
with:
files: ./coverage.xml
flags: ${{ matrix.image }},unittest
Expand All @@ -145,7 +148,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

- name: Configure PcapPlusPlus
run: cmake -DPCAPPP_USE_DPDK=ON ${{ matrix.additional-flags }} -S . -B "$BUILD_DIR"
Expand Down Expand Up @@ -190,7 +193,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

- name: Configure PcapPlusPlus
run: ${{ matrix.configure }}
Expand Down Expand Up @@ -238,9 +241,9 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

- uses: actions/setup-python@v5
- uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
with:
# support version: https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json
python-version: "3.12"
Expand Down Expand Up @@ -298,7 +301,7 @@ jobs:
gcovr -v -r . $GCOVR_FLAGS -o coverage.xml

- name: Upload Coverage Results
uses: codecov/codecov-action@v3.1.6
uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3.1.6
with:
files: ./coverage.xml
flags: ${{ matrix.os-version }},unittest
Expand All @@ -313,9 +316,9 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

- uses: actions/setup-python@v5
- uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
with:
# support version: https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json
python-version: "3.12"
Expand Down Expand Up @@ -371,7 +374,7 @@ jobs:
gcovr -v -r . $GCOVR_FLAGS -o coverage.xml

- name: Upload Coverage Results
uses: codecov/codecov-action@v3.1.6
uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3.1.6
with:
files: ./coverage.xml
flags: ${{ matrix.os-version }},unittest
Expand All @@ -390,10 +393,10 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

- name: Setup MSYS2
uses: msys2/setup-msys2@v2
uses: msys2/setup-msys2@cc11e9188b693c2b100158c3322424c4cc1dadea # v2.22.0
with:
msystem: ${{matrix.sys}}
install: >-
Expand All @@ -403,7 +406,7 @@ jobs:
mingw-w64-${{matrix.env}}-make

- name: Setup Python
uses: actions/setup-python@v5
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
with:
python-version: "3.8.x"

Expand Down Expand Up @@ -451,7 +454,7 @@ jobs:
run: gcovr -v -g -k -r . $env:GCOVR_FLAGS.split() -o coverage.xml

- name: Upload Coverage Results
uses: codecov/codecov-action@v3.1.6
uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3.1.6
with:
files: ./coverage.xml
flags: ${{ matrix.sys }},unittest
Expand Down Expand Up @@ -482,14 +485,14 @@ jobs:
runs-on: ${{ matrix.os }}
steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

- uses: actions/setup-python@v5
- uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
with:
python-version: "3.8.x"

- name: Add MSBuild to PATH
uses: microsoft/setup-msbuild@v2
uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2.0.0

- name: Setup OpenCppCoverage and add to PATH
run: |
Expand Down Expand Up @@ -539,7 +542,7 @@ jobs:
python -m pytest --root-path=../../Dist/examples_bin

- name: Upload Coverage Results
uses: codecov/codecov-action@v3.1.6
uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3.1.6
with:
files: ./Tests/Pcap++Test/Pcap++Coverage.xml,./Tests/Packet++Test/Packet++Coverage.xml
flags: ${{ matrix.os }},unittest,${{ matrix.pcap_lib }}
Expand Down Expand Up @@ -569,10 +572,10 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

- name: Checkout lipbcap for Android
uses: actions/checkout@main
uses: actions/checkout@cd7d8d697e10461458bc61a30d094dc601a8b017 # main
with:
repository: seladb/libpcap-android
path: ./libpcap-android
Expand All @@ -586,7 +589,7 @@ jobs:
run: cmake --build "$BUILD_DIR" -j

- name: Checkout ToyVpn-PcapPlusPlus
uses: actions/checkout@master
uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master
with:
repository: seladb/ToyVpn-PcapPlusPlus
path: ./ToyVpn-PcapPlusPlus
Expand Down Expand Up @@ -617,7 +620,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

- name: Install dependencies
run: |
Expand All @@ -641,7 +644,7 @@ jobs:
gcovr -v -r . $GCOVR_FLAGS -o coverage.xml

- name: Upload Coverage Results
uses: codecov/codecov-action@v3.1.6
uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3.1.6
with:
files: ./coverage.xml
flags: xdp,unittest
Expand All @@ -659,7 +662,7 @@ jobs:
container:
image: gcr.io/oss-fuzz-base/base-builder
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Install prerequisites
run: |
apt-get update && apt-get install -y cmake autoconf flex bison
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/check_dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,6 @@ jobs:
validate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: marocchino/validate-dependabot@v3
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
- uses: marocchino/validate-dependabot@d8ae5c0d03dd75fbd0ad5f8ab4ba8101ebbd4b37 # v3.0.0
id: validate
9 changes: 6 additions & 3 deletions .github/workflows/cifuzz.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ on:
pull_request:
branches: ["dev"]

permissions:
contents: read

jobs:
Fuzzing:
runs-on: ubuntu-latest
Expand All @@ -13,20 +16,20 @@ jobs:
steps:
- name: Build Fuzzers
id: build
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@c2c0632831767ff05c568e7b552cef2801d739ff # master
with:
oss-fuzz-project-name: 'pcapplusplus'
dry-run: false
sanitizer: ${{ matrix.sanitizer }}
- name: Run Fuzzers
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@c2c0632831767ff05c568e7b552cef2801d739ff # master
with:
oss-fuzz-project-name: 'pcapplusplus'
fuzz-seconds: 600
dry-run: false
sanitizer: ${{ matrix.sanitizer }}
- name: Upload Crash
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
if: failure() && steps.build.outcome == 'success'
with:
name: artifacts
Expand Down
9 changes: 6 additions & 3 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ on:
schedule:
- cron: '15 14 * * 1'

permissions:
contents: read
Copy link
Contributor

@sashashura sashashura May 5, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is one job and it already has permissions defined. This adds no value.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But if the scorecard tool is so stupid that it lowers the score without it... so be it.

Copy link
Collaborator

@egecetin egecetin May 6, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, unfortunately their automated check is not a very clever one but even if there is one job, defining a permission level is better to remove the possibility of misleading/unwanted results.


jobs:
analyze:
name: Analyze
Expand All @@ -22,11 +25,11 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
uses: github/codeql-action/init@df5a14dc28094dc936e103b37d749c6628682b60 # v3.25.0
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
Expand All @@ -41,4 +44,4 @@ jobs:
cmake --build build -j

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
uses: github/codeql-action/analyze@df5a14dc28094dc936e103b37d749c6628682b60 # v3.25.0
Loading
Loading