Skip to content

Commit 1794bd0

Browse files
thomasbonithomasboni
authored
Add Plumber security scan and harden workflow actions (#86)
* ci: add plumber security scan workflow Add an independent workflow that runs Plumber to scan the GitHub Actions workflows for CI/CD security issues on every push and pull request to main. The report is uploaded to the Security tab as SARIF. The check fails only when the Plumber Score drops below C. Publishing the score to the hosted badge service is left disabled. Signed-off-by: Thomas Boni <thomas@getplumber.io> * ci: declare workflow permissions Add an explicit least-privilege permissions block to the linter, test and release workflows so the GITHUB_TOKEN no longer inherits the repository default scope. linter keeps contents: read plus statuses: write for super-linter, test keeps contents: read, and release keeps contents: write for the version bump, push and release steps. Signed-off-by: Thomas Boni <thomas@getplumber.io> * ci: add plumber configuration Add .plumber.yaml based on Plumber's github defaults, with every control kept enabled so none is silently turned off. Code owner approval is not part of this project's branch protection policy, so branchMustBeProtected. codeOwnerApprovalRequired is set to false. Signed-off-by: Thomas Boni <thomas@getplumber.io> * ci: enable plumber score push Turn on score-push and grant id-token: write so the workflow publishes this repository's Plumber Score to the hosted score service. This keeps the README badge current; the badge displays the score of the default branch. It makes the repository name and score public. Signed-off-by: Thomas Boni <thomas@getplumber.io> * docs: add plumber score badge to readme Show the repository's Plumber Score at the top of the README. The badge is served by the hosted score service and displays the score of the default branch. Signed-off-by: Thomas Boni <thomas@getplumber.io> --------- Signed-off-by: Thomas Boni <thomas@getplumber.io>
1 parent 206bff7 commit 1794bd0

6 files changed

Lines changed: 204 additions & 0 deletions

File tree

‎.github/workflows/linter.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ name: Linter
33
on:
44
pull_request:
55
branches: [main]
6+
permissions:
7+
contents: read
8+
# super-linter reports the outcome of each linter as a commit status
9+
statuses: write
610
jobs:
711
build:
812
name: Lint Code Base

‎.github/workflows/plumber.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
name: plumber
3+
4+
on:
5+
push:
6+
branches: [main]
7+
pull_request:
8+
branches: [main]
9+
workflow_dispatch:
10+
11+
permissions: {}
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
15+
cancel-in-progress: true
16+
17+
jobs:
18+
scan:
19+
name: Scan CI/CD workflows
20+
runs-on: ubuntu-latest
21+
permissions:
22+
# To upload the SARIF report to the Security tab
23+
security-events: write
24+
contents: read
25+
# To publish the Plumber Score via OIDC (score-push, see below)
26+
id-token: write
27+
steps:
28+
- name: Checkout repository
29+
uses: actions/checkout@v4
30+
- name: Run Plumber
31+
uses: getplumber/plumber@87ca135cc4566ba8e9065ea95b5d897232cdb208 # v0.4.16
32+
with:
33+
# Fail the check only when the Plumber Score drops below C.
34+
min-score: "C"
35+
# Publish this repository's Plumber Score to the hosted score
36+
# service so the README badge stays up to date. This makes the
37+
# repository name and its score public. The badge displays the
38+
# score of the default branch.
39+
score-push: true

‎.github/workflows/release.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ on:
88
description: 'Release version'
99
required: true
1010

11+
# The job commits the version bump, pushes it and publishes the release.
12+
permissions:
13+
contents: write
14+
1115
env:
1216
JAVA_VERSION: '11'
1317
JAVA_DISTRO: 'zulu'

‎.github/workflows/test.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ on:
44
pull_request:
55
branches: [main]
66

7+
permissions:
8+
contents: read
9+
710
env:
811
JAVA_VERSION: '11'
912
JAVA_DISTRO: 'zulu'

‎.plumber.yaml‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# Plumber configuration for the sdk-java repository.
2+
# Based on Plumber's built-in defaults (github provider only); every control
3+
# is listed explicitly so none is silently disabled. The only customization is
4+
# the branch protection policy below.
5+
version: "2.0"
6+
github:
7+
controls:
8+
containerImageMustNotUseForbiddenTags:
9+
enabled: true
10+
tags:
11+
- latest
12+
- dev
13+
- development
14+
- staging
15+
- main
16+
- master
17+
containerImagesMustBePinnedByDigest: true
18+
branchMustBeProtected:
19+
enabled: true
20+
namePatterns:
21+
- main
22+
- master
23+
- release/*
24+
- production
25+
- dev
26+
defaultMustBeProtected: true
27+
allowForcePush: false
28+
# This project does not use a CODEOWNERS-based review process, so
29+
# code owner approval is not part of its branch protection policy.
30+
codeOwnerApprovalRequired: false
31+
externalRefsMustNotCollide:
32+
enabled: true
33+
pipelineMustNotEnableDebugTrace:
34+
enabled: true
35+
forbiddenVariables:
36+
- ACTIONS_STEP_DEBUG
37+
- ACTIONS_RUNNER_DEBUG
38+
securityJobsMustNotBeWeakened:
39+
enabled: true
40+
securityJobPatterns:
41+
- '*codeql*'
42+
- '*dependency-review*'
43+
- '*trufflehog*'
44+
- '*gitleaks*'
45+
- '*osv-scanner*'
46+
- '*-sast'
47+
- '*-sast-*'
48+
- '*-scan'
49+
- '*scan*'
50+
- '*-security'
51+
- '*-security-*'
52+
- '*-audit'
53+
- '*-audit-*'
54+
allowFailureMustBeFalse:
55+
enabled: true
56+
rulesMustNotBeRedefined:
57+
enabled: true
58+
whenMustNotBeManual:
59+
enabled: true
60+
pipelineMustNotExecuteUnverifiedScripts:
61+
enabled: true
62+
pipelineMustNotUseDockerInDocker:
63+
enabled: true
64+
detectInsecureDaemon: true
65+
actionsMustBePinnedByCommitSha:
66+
enabled: true
67+
trustedOwners:
68+
- actions
69+
- github
70+
githubActionMustComeFromAuthorizedSources:
71+
enabled: true
72+
trustGithubOfficialActions: true
73+
trustSameOrgActions: true
74+
trustedGithubActions:
75+
- getplumber/plumber
76+
workflowMustNotInjectUserInputInScripts:
77+
enabled: true
78+
workflowMustNotWriteUntrustedContentToGitHubEnv:
79+
enabled: true
80+
workflowMustNotUseDangerousTriggers:
81+
enabled: true
82+
pullRequestTargetMustNotCheckoutHead:
83+
enabled: true
84+
workflowsMustDeclarePermissions:
85+
enabled: true
86+
reusableWorkflowsMustNotInheritSecrets:
87+
enabled: true
88+
workflowMustNotExportEntireSecretsContext:
89+
enabled: true
90+
workflowMustNotGrantPermissionsWriteAll:
91+
enabled: true
92+
actionsMustNotBeArchived:
93+
enabled: true
94+
actionRefsMustExistUpstream:
95+
enabled: true
96+
actionsMustNotCarryKnownCVEs:
97+
enabled: true
98+
actionsMustNotExecuteMutableRemoteCode:
99+
enabled: true
100+
releaseWorkflowsMustNotRestoreUntrustedCache:
101+
enabled: true
102+
publishActions:
103+
- gradle/publish-plugin
104+
cacheActions:
105+
- action: actions/cache
106+
mode: always
107+
- action: actions/cache/restore
108+
mode: always
109+
- action: Swatinem/rust-cache
110+
mode: always
111+
- action: actions/setup-go
112+
mode: default
113+
disableInput: cache
114+
disableValue: false
115+
- action: gradle/actions/setup-gradle
116+
mode: default
117+
disableInput: cache-disabled
118+
disableValue: true
119+
- action: actions/setup-node
120+
mode: opt-in
121+
enableInput: cache
122+
- action: actions/setup-python
123+
mode: opt-in
124+
enableInput: cache
125+
- action: actions/setup-java
126+
mode: opt-in
127+
enableInput: cache
128+
- action: pnpm/action-setup
129+
mode: opt-in
130+
enableInput: cache
131+
- action: docker/build-push-action
132+
mode: opt-in
133+
enableInput: cache-from
134+
enableContains: type=gha
135+
publishScriptPatterns:
136+
- (?i)(npm|pnpm|yarn|bun)\s+publish
137+
- (?i)cargo\s+publish
138+
- (?i)twine\s+upload
139+
- (?i)poetry\s+publish
140+
- (?i)gh\s+release\s+create
141+
- (?i)goreleaser\s+release
142+
- (?i)semantic-release
143+
- (?i)gradlew?\b[^\n]*\bpublish
144+
- (?i)\bmvnw?\b[^\n]*\bdeploy\b
145+
- (?i)dotnet\s+nuget\s+push
146+
- (?i)gem\s+push
147+
- (?i)docker\s+push
148+
publishScriptExcludePatterns:
149+
- (?i)--dry-run
150+
- (?i)publishToMavenLocal
151+
workflowMustIncludeRequiredActions:
152+
enabled: false

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
# CDEvents Java SDK
22

3+
[![Plumber Score](https://score.getplumber.io/github.com/cdevents/sdk-java.svg)](https://score.getplumber.io/github.com/cdevents/sdk-java)
4+
35
Java SDK to produce [CDEvents](https://cdevents.dev).
46

57
The SDK can be used to create CDEvents and render as CloudEvents to send them to a specific CloudEvents broker

0 commit comments

Comments
 (0)