From 3ca5cecb07c01886a3ab02488c0ff151cdfb59a9 Mon Sep 17 00:00:00 2001 From: StepSecurity Bot Date: Wed, 11 Sep 2024 11:51:25 -0700 Subject: [PATCH] [StepSecurity] Apply security best practices (#155) Signed-off-by: StepSecurity Bot --- .github/dependabot.yml | 6 ++++++ .github/workflows/codeql.yml | 8 ++++---- .github/workflows/main.yml | 4 ++-- .github/workflows/msbuild.yml | 4 ++-- .github/workflows/msvc.yml | 6 +++--- .github/workflows/test.yml | 6 +++--- .github/workflows/vcpkg.yml | 6 +++--- .github/workflows/wsl.yml | 6 +++--- 8 files changed, 26 insertions(+), 20 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..253bcb7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: daily diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 71f231b..e6dca73 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,15 +38,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 - name: 'Install Ninja' run: choco install ninja - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0 - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6 with: languages: c-cpp build-mode: manual @@ -60,6 +60,6 @@ jobs: run: cmake --build out\build\x64-Debug - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6 with: category: "/language:c-cpp" diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 415a53f..93b24c9 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -73,12 +73,12 @@ jobs: arch: amd64_arm64 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 - name: 'Install Ninja' run: choco install ninja - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0 with: arch: ${{ matrix.arch }} diff --git a/.github/workflows/msbuild.yml b/.github/workflows/msbuild.yml index d4f62a6..1df0bae 100644 --- a/.github/workflows/msbuild.yml +++ b/.github/workflows/msbuild.yml @@ -32,10 +32,10 @@ jobs: platform: [x86, x64, ARM64] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 - name: Add MSBuild to PATH - uses: microsoft/setup-msbuild@v2 + uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2.0.0 - if: matrix.platform != 'ARM64' name: Build diff --git a/.github/workflows/msvc.yml b/.github/workflows/msvc.yml index 4dccb91..648d583 100644 --- a/.github/workflows/msvc.yml +++ b/.github/workflows/msvc.yml @@ -36,14 +36,14 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 - name: Configure CMake working-directory: ${{ github.workspace }} run: cmake -B out -DCMAKE_DISABLE_PRECOMPILE_HEADERS=ON - name: Initialize MSVC Code Analysis - uses: microsoft/msvc-code-analysis-action@v0.1.1 + uses: microsoft/msvc-code-analysis-action@24c285ab36952c9e9182f4b78dfafbac38a7e5ee # v0.1.1 id: run-analysis with: cmakeBuildDirectory: ./out @@ -52,6 +52,6 @@ jobs: # Upload SARIF file to GitHub Code Scanning Alerts - name: Upload SARIF to GitHub - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6 with: sarif_file: ${{ steps.run-analysis.outputs.sarif }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 475b2af..dff6f60 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -77,10 +77,10 @@ jobs: arch: amd64_arm64 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 - name: Clone test repository - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: repository: walbourn/directxmeshtest path: Tests @@ -89,7 +89,7 @@ jobs: - name: 'Install Ninja' run: choco install ninja - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0 with: arch: ${{ matrix.arch }} diff --git a/.github/workflows/vcpkg.yml b/.github/workflows/vcpkg.yml index 2445175..276eed6 100644 --- a/.github/workflows/vcpkg.yml +++ b/.github/workflows/vcpkg.yml @@ -41,12 +41,12 @@ jobs: arch: amd64_arm64 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 - name: 'Install Ninja' run: choco install ninja - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0 with: arch: ${{ matrix.arch }} @@ -77,7 +77,7 @@ jobs: echo "::error Unknown architecture/build-type triplet mapping" } - - uses: lukka/run-vcpkg@v11 + - uses: lukka/run-vcpkg@7d259227a1fb6471a0253dd5ab7419835228f7d7 # v11 with: runVcpkgInstall: true vcpkgJsonGlob: '**/build/vcpkg.json' diff --git a/.github/workflows/wsl.yml b/.github/workflows/wsl.yml index 91c8e5b..4c85a1b 100644 --- a/.github/workflows/wsl.yml +++ b/.github/workflows/wsl.yml @@ -32,11 +32,11 @@ jobs: gcc: [10, 11, 12] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 - - uses: seanmiddleditch/gha-setup-ninja@v5 + - uses: seanmiddleditch/gha-setup-ninja@96bed6edff20d1dd61ecff9b75cc519d516e6401 # v5 - - uses: lukka/run-vcpkg@v11 + - uses: lukka/run-vcpkg@7d259227a1fb6471a0253dd5ab7419835228f7d7 # v11 with: runVcpkgInstall: true vcpkgJsonGlob: '**/build/vcpkg.json'