This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 793609f3ec [StepSecurity] Apply security best practices (#737)
793609f3ec is described below
commit 793609f3ec494a81c8051c267df4ca5c3acbdee8
Author: StepSecurity Bot <b...@stepsecurity.io>
AuthorDate: Wed Mar 20 02:38:49 2024 -0700
[StepSecurity] Apply security best practices (#737)
Summary
This pull request was created by StepSecurity at the request of
@JacquesLeRoux. Please tag @JacquesLeRoux on your message if you have any
questions related to the PR.
Security Fixes
Least Privileged GitHub Actions Token Permissions
The GITHUB_TOKEN is an automatically generated secret to make authenticated
calls to the GitHub API. GitHub recommends setting minimum token permissions
for the GITHUB_TOKEN.
GitHub Security Guide
The Open Source Security Foundation (OpenSSF) Security Guide
Pinned Dependencies
GitHub Action tags and Docker tags are mutable. This poses a security risk.
GitHub's Security Hardening guide recommends pinning actions to full length
commit.
GitHub Security Guide
The Open Source Security Foundation (OpenSSF) Security Guide
Harden Runner
Harden-Runner is an open-source security agent for the GitHub-hosted runner
to prevent software supply chain attacks. It prevents exfiltration of
credentials, detects tampering of source code during build, and enables running
jobs without sudo access.
Harden runner usage
Keeping your actions up to date with Dependabot
With Dependabot version updates, when Dependabot identifies an outdated
dependency, it raises a pull request to update the manifest to the latest
version of the dependency. This is recommended by GitHub as well as The Open
Source Security Foundation (OpenSSF).
GitHub Security Guide
The Open Source Security Foundation (OpenSSF) Security Guide
Secure Dockerfiles
Pin image tags to digests in Dockerfiles. With the Docker v2 API release,
it became possible to use digests in place of tags when pulling images or to
use them in FROM lines in Dockerfiles.
The Open Source Security Foundation (OpenSSF) Security Guide
Add Dependency Review Workflow
The Dependency Review Workflow enforces dependency reviews on your pull
requests. The action scans for vulnerable versions of dependencies introduced
by package version changes in pull requests, and warns you about the associated
security vulnerabilities. This gives you better visibility of what's changing
in a pull request, and helps prevent vulnerabilities being added to your
repository.
Github Guide about Dependency Review
Github Guide for Configuring Dependency Review Action
Maintain Code Quality with Pre-Commit
Pre-commit is a framework for managing and maintaining multi-language
pre-commit hooks. Hooks can be any scripts, code, or binaries that run at any
stage of the git workflow. Pre-commit hooks are useful for enforcing code
quality, code formatting, and detecting security vulnerabilities.
Official Pre-commit documentation
Getting Started guide
Feedback
For bug reports, feature requests, and general feedback; please email
supp...@stepsecurity.io. To create such PRs, please visit
https://app.stepsecurity.io/securerepo.
Signed-off-by: StepSecurity Bot b...@stepsecurity.io
---
.github/dependabot.yml | 15 +++++++++++++++
.github/workflows/codeql-analysis.yml | 11 ++++++++---
.github/workflows/dependency-review.yml | 27 +++++++++++++++++++++++++++
.github/workflows/docker-image.yaml | 8 ++++++++
.github/workflows/gradle.yaml | 5 +++++
.github/workflows/scorecard.yml | 5 +++++
.pre-commit-config.yaml | 23 +++++++++++++++++++++++
Dockerfile | 4 ++--
8 files changed, 93 insertions(+), 5 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b0053f91ef..b6e9dc16d9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -24,3 +24,18 @@ updates:
directory: "themes/common-theme/webapp/common-theme/js" # Location of
package manifests
schedule:
interval: "daily"
+
+ - package-ecosystem: github-actions
+ directory: /
+ schedule:
+ interval: daily
+
+ - package-ecosystem: docker
+ directory: /
+ schedule:
+ interval: daily
+
+ - package-ecosystem: npm
+ directory: /themes/common-theme/webapp/common-theme/js
+ schedule:
+ interval: daily
diff --git a/.github/workflows/codeql-analysis.yml
b/.github/workflows/codeql-analysis.yml
index 102df1c83f..91ed8e5982 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -55,12 +55,17 @@ jobs:
#
https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
steps:
+ - name: Harden Runner
+ uses:
step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+ with:
+ egress-policy: audit
+
- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@v3
+ uses: github/codeql-action/init@05963f47d870e2cb19a537396c1f668a348c7d8f
# v3.24.8
with:
languages: ${{ matrix.language }}
debug: true
@@ -72,7 +77,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually
(see below)
- name: Autobuild
- uses: github/codeql-action/autobuild@v3
+ uses:
github/codeql-action/autobuild@05963f47d870e2cb19a537396c1f668a348c7d8f #
v3.24.8
# âšī¸ Command-line programs to run using the OS shell.
# đ https://git.io/JvXDl
@@ -86,4 +91,4 @@ jobs:
# make release
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v3
+ uses:
github/codeql-action/analyze@05963f47d870e2cb19a537396c1f668a348c7d8f # v3.24.8
diff --git a/.github/workflows/dependency-review.yml
b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000000..3f3456223b
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,27 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a
Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in
the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+ contents: read
+
+jobs:
+ dependency-review:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Harden Runner
+ uses:
step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+ with:
+ egress-policy: audit
+
+ - name: 'Checkout Repository'
+ uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 #
v3.6.0
+ - name: 'Dependency Review'
+ uses:
actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c #
v2.5.1
diff --git a/.github/workflows/docker-image.yaml
b/.github/workflows/docker-image.yaml
index 1cff4a790e..98400ba6e7 100644
--- a/.github/workflows/docker-image.yaml
+++ b/.github/workflows/docker-image.yaml
@@ -44,11 +44,19 @@ on:
tags:
- '**'
+permissions:
+ contents: read
+
jobs:
docker_build:
name: Build and push OFBiz docker container images
runs-on: ubuntu-latest
steps:
+ - name: Harden Runner
+ uses:
step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+ with:
+ egress-policy: audit
+
- name: Check out OFBiz sources
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #
v4.1.1
diff --git a/.github/workflows/gradle.yaml b/.github/workflows/gradle.yaml
index 54166666ec..b569472151 100644
--- a/.github/workflows/gradle.yaml
+++ b/.github/workflows/gradle.yaml
@@ -37,6 +37,11 @@ jobs:
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
steps:
+ - name: Harden Runner
+ uses:
step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+ with:
+ egress-policy: audit
+
- name: Check out OFBiz sources
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 2f0b19e741..b6c47f80c5 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -64,6 +64,11 @@ jobs:
# actions: read
steps:
+ - name: Harden Runner
+ uses:
step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+ with:
+ egress-policy: audit
+
- name: "Checkout code"
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #
v4.1.1
with:
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000000..431282f336
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,23 @@
+repos:
+- repo: https://github.com/gherynos/pre-commit-java
+ rev: v0.2.4
+ hooks:
+ - id: Checkstyle
+- repo: https://github.com/gitleaks/gitleaks
+ rev: v8.16.3
+ hooks:
+ - id: gitleaks
+- repo: https://github.com/jumanjihouse/pre-commit-hooks
+ rev: 3.0.0
+ hooks:
+ - id: RuboCop
+ - id: shellcheck
+- repo: https://github.com/pre-commit/mirrors-eslint
+ rev: v8.38.0
+ hooks:
+ - id: eslint
+- repo: https://github.com/pre-commit/pre-commit-hooks
+ rev: v4.4.0
+ hooks:
+ - id: end-of-file-fixer
+ - id: trailing-whitespace
diff --git a/Dockerfile b/Dockerfile
index e36cf20481..65687b8e33 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,7 +18,7 @@
# under the License.
#####################################################################
-FROM eclipse-temurin:17 AS builder
+FROM
eclipse-temurin:17@sha256:e8d451f3b5aa6422c2b00bb913cb8d37a55a61934259109d945605c5651de9a6
AS builder
# Git is used for various OFBiz build tasks.
RUN apt-get update \
@@ -56,7 +56,7 @@ RUN
--mount=type=cache,id=gradle-cache,sharing=locked,target=/root/.gradle \
###################################################################################
-FROM eclipse-temurin:17 AS runtimebase
+FROM
eclipse-temurin:17@sha256:e8d451f3b5aa6422c2b00bb913cb8d37a55a61934259109d945605c5651de9a6
AS runtimebase
# xsltproc is used to disable OFBiz components during first run.
RUN apt-get update \
