Skip to content

Commit c71a5a1

Browse files
author
Tyler Titsworth
authored
OSSF Best Practices (#226)
* update action * udpate pre-commit * add venv to gitignore * return action * update based on public * keep internal functionality * remove dependency review * add dep review for public * update on-push * verify scorecard * lint actions * update cron * test non-standard cron * revert
1 parent 89ee838 commit c71a5a1

14 files changed

+210
-185
lines changed

‎.github/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ runs:
6969
REGISTRY=${{ inputs.registry }} \
7070
REPO=${{ inputs.repo }} \
7171
COMPOSE_PROJECT_NAME=${{ env.random-number }} \
72-
${{ inputs.env_overrides }} docker compose -p ${{ env.random-number }} images --format json | jq '.[] | "\(.Repository):\(.Tag)"' >> $GITHUB_STEP_SUMMARY
72+
${{ inputs.env_overrides }} docker compose -p ${{ env.random-number }} images --format json | jq --arg registry "${{ secrets.registry }}" '.[] | select(.Repository | contains($registry)) | "\(.Repository):\(.Tag)"' | jq -s '.' >> $GITHUB_STEP_SUMMARY
7373
working-directory: ${{ inputs.group_dir }}
7474
- name: Un-Tag Containers
7575
if: ${{ always() }}

‎.github/dependabot.yml

+10-6
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,15 @@
1919

2020
version: 2
2121
updates:
22-
- package-ecosystem: "pip" # See documentation for possible values
23-
directory: "test-runner/" # Location of package manifests
22+
- package-ecosystem: pip
23+
directory: /test-runner
2424
schedule:
25-
interval: "weekly"
26-
- package-ecosystem: "github-actions" # See documentation for possible values
27-
directory: ".github/workflows" # Location of package manifests
25+
interval: weekly
26+
- package-ecosystem: github-actions
27+
directory: /
2828
schedule:
29-
interval: "weekly"
29+
interval: weekly
30+
- package-ecosystem: pip
31+
directory: /pytorch/serving
32+
schedule:
33+
interval: weekly

‎.github/workflows/bandit.yaml

-34
This file was deleted.

‎.github/workflows/container-pipeline-tester.yaml

+18-6
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,9 @@ jobs:
5757
matrix: ${{ steps.matrix.outputs.matrix }}
5858
runs-on: [ k8-runners ]
5959
steps:
60+
- uses: step-security/harden-runner@v2
61+
with:
62+
egress-policy: audit
6063
- uses: actions/checkout@v4
6164
- name: Set Matrix
6265
id: matrix
@@ -83,11 +86,14 @@ jobs:
8386
matrix: ${{ fromJson(needs.setup-build-matrix.outputs.matrix) }}
8487
fail-fast: false
8588
steps:
89+
- uses: step-security/harden-runner@v2
90+
with:
91+
egress-policy: audit
8692
- uses: actions/checkout@v4
8793
if: ${{ !inputs.no-build }}
8894
- uses: docker/login-action@v3
8995
with:
90-
registry: ${{ vars.REGISTRY }}
96+
registry: ${{ secrets.REGISTRY }}
9197
username: ${{ secrets.REGISTRY_USER }}
9298
password: ${{ secrets.REGISTRY_TOKEN }}
9399
if: ${{ !inputs.no-build }}
@@ -99,15 +105,18 @@ jobs:
99105
with:
100106
group_dir: ${{ inputs.group_dir }}
101107
env_overrides: ${{ inputs.env_overrides }}
102-
registry: ${{ vars.REGISTRY }}
103-
repo: ${{ vars.REPO }}
108+
registry: ${{ secrets.REGISTRY }}
109+
repo: ${{ secrets.REPO }}
104110
no-push: false
105111
setup-test:
106112
needs: [ build-containers ]
107113
runs-on: [ k8-runners ]
108114
outputs:
109115
recipes: ${{ steps.recipes.outputs.RECIPES }}
110116
steps:
117+
- uses: step-security/harden-runner@v2
118+
with:
119+
egress-policy: audit
111120
- uses: actions/checkout@v4
112121
- name: Get Recipes
113122
id: recipes
@@ -122,18 +131,21 @@ jobs:
122131
experimental: [true]
123132
fail-fast: false
124133
steps:
134+
- uses: step-security/harden-runner@v2
135+
with:
136+
egress-policy: audit
125137
- uses: actions/checkout@v4
126138
- uses: docker/login-action@v3
127139
with:
128-
registry: ${{ vars.REGISTRY }}
140+
registry: ${{ secrets.REGISTRY }}
129141
username: ${{ secrets.REGISTRY_USER }}
130142
password: ${{ secrets.REGISTRY_TOKEN }}
131143
- name: Test Container Group
132144
uses: ./test-runner
133145
with:
134-
mlops_repo: ${{ vars.MLOPS_REPO }}
146+
mlops_repo: ${{ secrets.MLOPS_REPO }}
135147
mlops_ref: ${{ github.ref }}
136148
recipe_dir: ${{ inputs.group_dir }}
137-
registry: ${{ vars.REGISTRY }}
149+
registry: ${{ secrets.REGISTRY }}
138150
test_dir: ${{ matrix.recipe }}
139151
token: ${{ github.token }}

‎.github/workflows/dependency-review.yaml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Copyright (c) 2024 Intel Corporation
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# Dependency Review Action
16+
#
17+
# This Action will scan dependency manifest files that change as part of a Pull Request,
18+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
19+
# Once installed, if the workflow run is marked as required,
20+
# PRs introducing known-vulnerable packages will be blocked from merging.
21+
#
22+
# Source repository: https://github.com/actions/dependency-review-action
23+
name: 'Dependency Review'
24+
on: [pull_request]
25+
permissions:
26+
contents: read
27+
concurrency:
28+
group: ${{ github.workflow }}-${{ github.ref }}
29+
cancel-in-progress: true
30+
jobs:
31+
dependency-review:
32+
runs-on: ubuntu-latest
33+
steps:
34+
- uses: step-security/harden-runner@v2
35+
with:
36+
egress-policy: audit
37+
- name: 'Checkout Repository'
38+
uses: actions/checkout@v4
39+
- name: 'Dependency Review'
40+
uses: actions/dependency-review-action@v4

‎.github/workflows/lint.yaml

+4-6
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,11 @@ concurrency:
2727
jobs:
2828
build:
2929
name: Lint
30-
runs-on: [k8-runners]
31-
permissions:
32-
contents: read
33-
packages: read
34-
# To report GitHub Actions status checks
35-
statuses: write
30+
runs-on: k8-runners # ubuntu-latest
3631
steps:
32+
- uses: step-security/harden-runner@v2
33+
with:
34+
egress-policy: audit
3735
- name: Checkout code
3836
uses: actions/checkout@v4
3937
with:

‎.github/workflows/ossf.yaml

-86
This file was deleted.

‎.github/workflows/review-trigger.yml

+6
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,9 @@ jobs:
3131
runner_label: ${{ steps.comment-inputs.outputs.runner_label }}
3232
no-build: ${{ steps.comment-inputs.outputs.no-build || false }}
3333
steps:
34+
- uses: step-security/harden-runner@v2
35+
with:
36+
egress-policy: audit
3437
- uses: actions/checkout@v4
3538
- name: Get Inputs
3639
id: comment-inputs
@@ -89,6 +92,9 @@ jobs:
8992
pull-requests: write
9093
runs-on: [ k8-runners ]
9194
steps:
95+
- uses: step-security/harden-runner@v2
96+
with:
97+
egress-policy: audit
9298
- name: Unlock
9399
if: ${{ needs.check-review.result != 'skipped' }}
94100
uses: actions/github-script@v7

‎.github/workflows/scorecard.yaml

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# Copyright (c) 2024 Intel Corporation
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# This workflow uses actions that are not certified by GitHub. They are provided
16+
# by a third-party and are governed by separate terms of service, privacy
17+
# policy, and support documentation.
18+
19+
name: Scorecard supply-chain security
20+
on:
21+
branch_protection_rule:
22+
schedule:
23+
- cron: '0 6 * * 0'
24+
push:
25+
branches: [ "main" ]
26+
workflow_dispatch:
27+
permissions: read-all
28+
jobs:
29+
analysis:
30+
name: Scorecard analysis
31+
runs-on: ubuntu-latest
32+
permissions:
33+
security-events: write
34+
id-token: write
35+
contents: read
36+
actions: read
37+
steps:
38+
- uses: step-security/harden-runner@v2
39+
with:
40+
egress-policy: audit
41+
- uses: actions/checkout@v4
42+
with:
43+
persist-credentials: false
44+
- uses: ossf/scorecard-action@v2.3.1
45+
with:
46+
results_file: results.sarif
47+
results_format: sarif
48+
repo_token: ${{ secrets.ACTION_TOKEN }}
49+
publish_results: true
50+
- uses: actions/upload-artifact@v3
51+
with:
52+
name: SARIF file
53+
path: results.sarif
54+
retention-days: 5
55+
- uses: github/codeql-action/upload-sarif@v3.24.10
56+
with:
57+
sarif_file: results.sarif

‎.github/workflows/unit-test.yaml

+9-4
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,28 @@
1515
---
1616
name: Test Runner Unit Tests
1717
on:
18-
pull_request:
18+
push: null
1919
permissions: read-all
2020
concurrency:
2121
group: ${{ github.workflow }}-${{ github.ref }}
2222
cancel-in-progress: true
2323
jobs:
2424
unit-test:
25-
runs-on: [ test-runner ]
25+
runs-on: [ k8-runners ]
2626
steps:
27+
- uses: step-security/harden-runner@v2
28+
with:
29+
egress-policy: audit
2730
- uses: actions/checkout@v4
2831
- uses: docker/login-action@v3
2932
with:
30-
registry: ${{ vars.REGISTRY }}
33+
registry: ${{ secrets.REGISTRY }}
3134
username: ${{ secrets.REGISTRY_USER }}
3235
password: ${{ secrets.REGISTRY_TOKEN }}
3336
- name: Install requirements
3437
run: |
38+
sudo apt-get update -y
39+
sudo apt-get install python3.8-venv -y
3540
python -m venv venv
3641
source venv/bin/activate
3742
venv/bin/python -m pip install pytest hypothesis
@@ -41,4 +46,4 @@ jobs:
4146
run: venv/bin/python -m pytest tests/utest.py -W ignore::UserWarning
4247
working-directory: ${{ github.workspace }}/test-runner
4348
env:
44-
REGISTRY: ${{ vars.REGISTRY }}
49+
REGISTRY: ${{ secrets.REGISTRY }}

0 commit comments

Comments
 (0)