[StepSecurity] Apply security best practices (#172)

This commit is contained in:
StepSecurity Bot 2024-09-11 11:50:00 -07:00 коммит произвёл GitHub
Родитель 7d6ec8875c
Коммит 0e2641d9f9
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: B5690EEEBB952194
8 изменённых файлов: 28 добавлений и 23 удалений

9
.github/dependabot.yml поставляемый
Просмотреть файл

@ -1,8 +1,13 @@
version: 2
updates:
- package-ecosystem: "nuget"
- package-ecosystem: nuget
directory: "/UVAtlasTool"
schedule:
interval: "weekly"
interval: weekly
commit-message:
prefix: "[nuget] "
- package-ecosystem: github-actions
directory: /
schedule:
interval: daily

8
.github/workflows/codeql.yml поставляемый
Просмотреть файл

@ -37,15 +37,15 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: 'Install Ninja'
run: choco install ninja
- uses: ilammy/msvc-dev-cmd@v1
- uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
with:
languages: c-cpp
build-mode: manual
@ -59,6 +59,6 @@ jobs:
run: cmake --build out\build\x64-Debug
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
uses: github/codeql-action/analyze@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
with:
category: "/language:c-cpp"

4
.github/workflows/main.yml поставляемый
Просмотреть файл

@ -72,12 +72,12 @@ jobs:
arch: amd64_arm64
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: 'Install Ninja'
run: choco install ninja
- uses: ilammy/msvc-dev-cmd@v1
- uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
with:
arch: ${{ matrix.arch }}

4
.github/workflows/msbuild.yml поставляемый
Просмотреть файл

@ -32,10 +32,10 @@ jobs:
platform: [x86, x64, ARM64]
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Add MSBuild to PATH
uses: microsoft/setup-msbuild@v2
uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2.0.0
- if: matrix.platform != 'ARM64'
name: Restore NuGet packages

6
.github/workflows/msvc.yml поставляемый
Просмотреть файл

@ -35,14 +35,14 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Configure CMake
working-directory: ${{ github.workspace }}
run: cmake -B out -DCMAKE_DISABLE_PRECOMPILE_HEADERS=ON
- name: Initialize MSVC Code Analysis
uses: microsoft/msvc-code-analysis-action@v0.1.1
uses: microsoft/msvc-code-analysis-action@24c285ab36952c9e9182f4b78dfafbac38a7e5ee # v0.1.1
id: run-analysis
with:
cmakeBuildDirectory: ./out
@ -51,6 +51,6 @@ jobs:
# Upload SARIF file to GitHub Code Scanning Alerts
- name: Upload SARIF to GitHub
uses: github/codeql-action/upload-sarif@v3
uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
with:
sarif_file: ${{ steps.run-analysis.outputs.sarif }}

8
.github/workflows/test.yml поставляемый
Просмотреть файл

@ -85,10 +85,10 @@ jobs:
arch: amd64
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Clone test repository
uses: actions/checkout@v4
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
with:
repository: walbourn/uvatlastest
path: Tests
@ -97,7 +97,7 @@ jobs:
- name: 'Install Ninja'
run: choco install ninja
- uses: ilammy/msvc-dev-cmd@v1
- uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
with:
arch: ${{ matrix.arch }}
@ -128,7 +128,7 @@ jobs:
echo "::error Unknown architecture/build-type triplet mapping"
}
- uses: lukka/run-vcpkg@v11
- uses: lukka/run-vcpkg@7d259227a1fb6471a0253dd5ab7419835228f7d7 # v11
with:
runVcpkgInstall: true
vcpkgJsonGlob: '**/build/vcpkg.json'

6
.github/workflows/vcpkg.yml поставляемый
Просмотреть файл

@ -43,12 +43,12 @@ jobs:
arch: amd64
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: 'Install Ninja'
run: choco install ninja
- uses: ilammy/msvc-dev-cmd@v1
- uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
with:
arch: ${{ matrix.arch }}
@ -79,7 +79,7 @@ jobs:
echo "::error Unknown architecture/build-type triplet mapping"
}
- uses: lukka/run-vcpkg@v11
- uses: lukka/run-vcpkg@7d259227a1fb6471a0253dd5ab7419835228f7d7 # v11
with:
runVcpkgInstall: true
vcpkgJsonGlob: '**/build/vcpkg.json'

6
.github/workflows/wsl.yml поставляемый
Просмотреть файл

@ -31,11 +31,11 @@ jobs:
gcc: [10, 11, 12]
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- uses: seanmiddleditch/gha-setup-ninja@v5
- uses: seanmiddleditch/gha-setup-ninja@96bed6edff20d1dd61ecff9b75cc519d516e6401 # v5
- uses: lukka/run-vcpkg@v11
- uses: lukka/run-vcpkg@7d259227a1fb6471a0253dd5ab7419835228f7d7 # v11
with:
runVcpkgInstall: true
vcpkgJsonGlob: '**/build/vcpkg.json'