The GitHub Actions job "Build and push docker images" on ofbiz-framework.git has failed. Run started by GitHub user JacquesLeRoux (triggered by JacquesLeRoux).
Head commit for run: 793609f3ec494a81c8051c267df4ca5c3acbdee8 / StepSecurity Bot <[email protected]> [StepSecurity] Apply security best practices (#737) Summary This pull request was created by StepSecurity at the request of @JacquesLeRoux. Please tag @JacquesLeRoux on your message if you have any questions related to the PR. Security Fixes Least Privileged GitHub Actions Token Permissions The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API. GitHub recommends setting minimum token permissions for the GITHUB_TOKEN. GitHub Security Guide The Open Source Security Foundation (OpenSSF) Security Guide Pinned Dependencies GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit. GitHub Security Guide The Open Source Security Foundation (OpenSSF) Security Guide Harden Runner Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without sudo access. Harden runner usage Keeping your actions up to date with Dependabot With Dependabot version updates, when Dependabot identifies an outdated dependency, it raises a pull request to update the manifest to the latest version of the dependency. This is recommended by GitHub as well as The Open Source Security Foundation (OpenSSF). GitHub Security Guide The Open Source Security Foundation (OpenSSF) Security Guide Secure Dockerfiles Pin image tags to digests in Dockerfiles. With the Docker v2 API release, it became possible to use digests in place of tags when pulling images or to use them in FROM lines in Dockerfiles. The Open Source Security Foundation (OpenSSF) Security Guide Add Dependency Review Workflow The Dependency Review Workflow enforces dependency reviews on your pull requests. The action scans for vulnerable versions of dependencies introduced by package version changes in pull requests, and warns you about the associated security vulnerabilities. This gives you better visibility of what's changing in a pull request, and helps prevent vulnerabilities being added to your repository. Github Guide about Dependency Review Github Guide for Configuring Dependency Review Action Maintain Code Quality with Pre-Commit Pre-commit is a framework for managing and maintaining multi-language pre-commit hooks. Hooks can be any scripts, code, or binaries that run at any stage of the git workflow. Pre-commit hooks are useful for enforcing code quality, code formatting, and detecting security vulnerabilities. Official Pre-commit documentation Getting Started guide Feedback For bug reports, feature requests, and general feedback; please email [email protected]. To create such PRs, please visit https://app.stepsecurity.io/securerepo. Signed-off-by: StepSecurity Bot [email protected] Report URL: https://github.com/apache/ofbiz-framework/actions/runs/8356721312 With regards, GitHub Actions via GitBox
