Skip to content

Commit 233d2f8

Browse files
step-security-botstep-security-bot
authored
[StepSecurity] Apply security best practices (#70)
Signed-off-by: StepSecurity Bot <[email protected]>
1 parent c6959ac commit 233d2f8

32 files changed

+425
-65
lines changed

‎.github/dependabot.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,48 @@ updates:
1616
llvm-docs-requirements:
1717
patterns:
1818
- "*"
19+
20+
- package-ecosystem: docker
21+
directory: /.github/workflows/containers/github-action-ci
22+
schedule:
23+
interval: daily
24+
25+
- package-ecosystem: docker
26+
directory: /bolt/utils/docker
27+
schedule:
28+
interval: daily
29+
30+
- package-ecosystem: nuget
31+
directory: /clang/tools/clang-format-vs/ClangFormat
32+
schedule:
33+
interval: daily
34+
35+
- package-ecosystem: docker
36+
directory: /clang/tools/clang-fuzzer
37+
schedule:
38+
interval: daily
39+
40+
- package-ecosystem: docker
41+
directory: /clang/utils/analyzer
42+
schedule:
43+
interval: daily
44+
45+
- package-ecosystem: pip
46+
directory: /clang/utils/analyzer
47+
schedule:
48+
interval: daily
49+
50+
- package-ecosystem: pip
51+
directory: /flang/examples/FlangOmpReport
52+
schedule:
53+
interval: daily
54+
55+
- package-ecosystem: docker
56+
directory: /libc/utils/buildbot
57+
schedule:
58+
interval: daily
59+
60+
- package-ecosystem: docker
61+
directory: /libcxx/utils/ci
62+
schedule:
63+
interval: daily

‎.github/workflows/build-ci-container.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ jobs:
2525
permissions:
2626
packages: write
2727
steps:
28+
- name: Harden Runner
29+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
30+
with:
31+
egress-policy: audit
32+
2833
- name: Write Variables
2934
id: vars
3035
run: |
@@ -34,7 +39,7 @@ jobs:
3439
echo "container-name-tag=$container_name:$tag" >> $GITHUB_OUTPUT
3540
3641
- name: Checkout LLVM
37-
uses: actions/[email protected]
42+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3843
with:
3944
sparse-checkout: .github/workflows/containers/github-action-ci/
4045

‎.github/workflows/codeql.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: ["npu/release/18.x"]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: ["npu/release/18.x"]
20+
schedule:
21+
- cron: "0 0 * * 1"
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
analyze:
28+
name: Analyze
29+
runs-on: ubuntu-latest
30+
permissions:
31+
actions: read
32+
contents: read
33+
security-events: write
34+
35+
strategy:
36+
fail-fast: false
37+
matrix:
38+
language: ["cpp", "csharp", "javascript", "python", "typescript"]
39+
# CodeQL supports [ $supported-codeql-languages ]
40+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
41+
42+
steps:
43+
- name: Harden Runner
44+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
45+
with:
46+
egress-policy: audit
47+
48+
- name: Checkout repository
49+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
50+
51+
# Initializes the CodeQL tools for scanning.
52+
- name: Initialize CodeQL
53+
uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
54+
with:
55+
languages: ${{ matrix.language }}
56+
# If you wish to specify custom queries, you can do so here or in a config file.
57+
# By default, queries listed here will override any specified in a config file.
58+
# Prefix the list here with "+" to use these queries and those in the config file.
59+
60+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
61+
# If this step fails, then you should remove it and run the build manually (see below)
62+
- name: Autobuild
63+
uses: github/codeql-action/autobuild@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
64+
65+
# ℹ️ Command-line programs to run using the OS shell.
66+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
67+
68+
# If the Autobuild fails above, remove it and uncomment the following three lines.
69+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
70+
71+
# - run: |
72+
# echo "Run, Build Application using script"
73+
# ./location_of_script_within_repo/buildscript.sh
74+
75+
- name: Perform CodeQL Analysis
76+
uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
77+
with:
78+
category: "/language:${{matrix.language}}"

‎.github/workflows/containers/github-action-ci/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM docker.io/library/ubuntu:22.04 as base
1+
FROM docker.io/library/ubuntu:22.04@sha256:0e5e4a57c2499249aafc3b40fcd541e9a456aab7296681a3994d631587203f97 as base
22
ENV LLVM_SYSROOT=/opt/llvm/
33

44
FROM base as toolchain

‎.github/workflows/dependency-review.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Harden Runner
20+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
21+
with:
22+
egress-policy: audit
23+
24+
- name: 'Checkout Repository'
25+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
26+
- name: 'Dependency Review'
27+
uses: actions/dependency-review-action@4081bf99e2866ebe428fc0477b69eb4fcda7220a # v4.4.0

‎.github/workflows/docs.yml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,14 +56,19 @@ jobs:
5656
# action to use the Github API in pull requests. If it's a push to a
5757
# branch we can't use the Github API to get the diff, so we need to have
5858
# a local checkout beforehand.
59+
- name: Harden Runner
60+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
61+
with:
62+
egress-policy: audit
63+
5964
- name: Fetch LLVM sources (Push)
6065
if: ${{ github.event_name == 'push' }}
61-
uses: actions/[email protected]
66+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6267
with:
6368
fetch-depth: 1
6469
- name: Get subprojects that have doc changes
6570
id: docs-changed-subprojects
66-
uses: tj-actions/changed-files@v45
71+
uses: tj-actions/changed-files@c3a1bb2c992d77180ae65be6ae6c166cf40f857c # v45.0.3
6772
with:
6873
files_yaml: |
6974
llvm:
@@ -94,11 +99,11 @@ jobs:
9499
- 'flang/include/flang/Optimizer/Dialect/FIROps.td'
95100
- name: Fetch LLVM sources (PR)
96101
if: ${{ github.event_name == 'pull_request' }}
97-
uses: actions/[email protected]
102+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
98103
with:
99104
fetch-depth: 1
100105
- name: Setup Python env
101-
uses: actions/setup-python@v5
106+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
102107
with:
103108
python-version: '3.11'
104109
cache: 'pip'

‎.github/workflows/issue-release-workflow.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,13 @@ jobs:
3838
!startswith(github.event.comment.body, '<!--IGNORE-->') &&
3939
contains(github.event.action == 'opened' && github.event.issue.body || github.event.comment.body, '/cherry-pick')
4040
steps:
41+
- name: Harden Runner
42+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
43+
with:
44+
egress-policy: audit
45+
4146
- name: Fetch LLVM sources
42-
uses: actions/[email protected]
47+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4348
with:
4449
repository: llvm/llvm-project
4550
# GitHub stores the token used for checkout and uses it for pushes
@@ -73,8 +78,13 @@ jobs:
7378
contains(github.event.comment.body, '/branch ')
7479
7580
steps:
81+
- name: Harden Runner
82+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
83+
with:
84+
egress-policy: audit
85+
7686
- name: Fetch LLVM sources
77-
uses: actions/[email protected]
87+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7888
with:
7989
persist-credentials: false
8090

‎.github/workflows/issue-subscriber.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,13 @@ jobs:
1313
runs-on: ubuntu-latest
1414
if: github.repository == 'llvm/llvm-project'
1515
steps:
16+
- name: Harden Runner
17+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
18+
with:
19+
egress-policy: audit
20+
1621
- name: Checkout Automation Script
17-
uses: actions/[email protected]
22+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1823
with:
1924
sparse-checkout: llvm/utils/git/
2025
ref: main

‎.github/workflows/libclang-abi-tests.yml‎

Lines changed: 23 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -37,14 +37,19 @@ jobs:
3737
LLVM_VERSION_MINOR: ${{ steps.version.outputs.LLVM_VERSION_MINOR }}
3838
LLVM_VERSION_PATCH: ${{ steps.version.outputs.LLVM_VERSION_PATCH }}
3939
steps:
40+
- name: Harden Runner
41+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
42+
with:
43+
egress-policy: audit
44+
4045
- name: Checkout source
41-
uses: actions/[email protected]
46+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4247
with:
4348
fetch-depth: 250
4449

4550
- name: Get LLVM version
4651
id: version
47-
uses: llvm/actions/get-llvm-version@main
52+
uses: llvm/actions/get-llvm-version@a1ea791b03c8e61f53a0e66f2f73db283aa0f01e # main
4853

4954
- name: Setup Variables
5055
id: vars
@@ -99,8 +104,13 @@ jobs:
99104
ref: ${{ github.sha }}
100105
repo: ${{ github.repository }}
101106
steps:
107+
- name: Harden Runner
108+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
109+
with:
110+
egress-policy: audit
111+
102112
- name: Install Ninja
103-
uses: llvm/actions/install-ninja@main
113+
uses: llvm/actions/install-ninja@a1ea791b03c8e61f53a0e66f2f73db283aa0f01e # main
104114
- name: Install abi-compliance-checker
105115
run: |
106116
sudo apt-get install abi-dumper autoconf pkg-config
@@ -112,7 +122,7 @@ jobs:
112122
./configure
113123
sudo make install
114124
- name: Download source code
115-
uses: llvm/actions/get-llvm-project-src@main
125+
uses: llvm/actions/get-llvm-project-src@a1ea791b03c8e61f53a0e66f2f73db283aa0f01e # main
116126
with:
117127
ref: ${{ matrix.ref }}
118128
repo: ${{ matrix.repo }}
@@ -130,7 +140,7 @@ jobs:
130140
sed -i 's/LLVM_[0-9]\+/LLVM_NOVERSION/' $lib-${{ matrix.ref }}.abi
131141
done
132142
- name: Upload ABI file
133-
uses: actions/upload-artifact@v4
143+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
134144
with:
135145
name: ${{ matrix.name }}
136146
path: '*${{ matrix.ref }}.abi'
@@ -142,13 +152,18 @@ jobs:
142152
- abi-dump-setup
143153
- abi-dump
144154
steps:
155+
- name: Harden Runner
156+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
157+
with:
158+
egress-policy: audit
159+
145160
- name: Download baseline
146-
uses: actions/download-artifact@v4
161+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
147162
with:
148163
name: build-baseline
149164
path: build-baseline
150165
- name: Download latest
151-
uses: actions/download-artifact@v4
166+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
152167
with:
153168
name: build-latest
154169
path: build-latest
@@ -162,7 +177,7 @@ jobs:
162177
done
163178
- name: Upload ABI Comparison
164179
if: always()
165-
uses: actions/upload-artifact@v4
180+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
166181
with:
167182
name: compat-report-${{ github.sha }}
168183
path: compat_reports/

0 commit comments

Comments
 (0)