Add Plumber security scan and harden workflow actions - #86
Open
thomasboni wants to merge 5 commits into
Open
Conversation
Add an independent workflow that runs Plumber to scan the GitHub Actions workflows for CI/CD security issues on every push and pull request to main. The report is uploaded to the Security tab as SARIF. The check fails only when the Plumber Score drops below C. Publishing the score to the hosted badge service is left disabled. Signed-off-by: Thomas Boni <thomas@getplumber.io>
Add an explicit least-privilege permissions block to the linter, test and release workflows so the GITHUB_TOKEN no longer inherits the repository default scope. linter keeps contents: read plus statuses: write for super-linter, test keeps contents: read, and release keeps contents: write for the version bump, push and release steps. Signed-off-by: Thomas Boni <thomas@getplumber.io>
Add .plumber.yaml based on Plumber's github defaults, with every control kept enabled so none is silently turned off. Code owner approval is not part of this project's branch protection policy, so branchMustBeProtected. codeOwnerApprovalRequired is set to false. Signed-off-by: Thomas Boni <thomas@getplumber.io>
Turn on score-push and grant id-token: write so the workflow publishes this repository's Plumber Score to the hosted score service. This keeps the README badge current; the badge displays the score of the default branch. It makes the repository name and score public. Signed-off-by: Thomas Boni <thomas@getplumber.io>
Show the repository's Plumber Score at the top of the README. The badge is served by the hosted score service and displays the score of the default branch. Signed-off-by: Thomas Boni <thomas@getplumber.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
This PR adds a workflow (
.github/workflows/plumber.yml) that runs Plumber on every push and pull request to main. Plumber scans the repository's GitHub Actions workflows for CI/CD security issues and reports them to the Security tab.Running the scan surfaced a couple of pre-existing findings, so the PR also hardens the current workflows. It is split into five commits:
Local scan result
With these changes the local run reports:
The baseline before this PR was score B: the linter, test and release workflows had no explicit permissions: block (ISSUE-801, medium), and the branch protection policy did not match (ISSUE-505). Both are handled here.
Question: trusted action sources
The config keeps Plumber's
githubActionMustComeFromAuthorizedSourcescontrol enabled. It passes today because every action used here comes from actions/* or github/*.Does this repository (or the org) already maintain an allowlist of authorized action sources, for example through the GitHub Actions settings ("Allow select actions and reusable workflows")? If it does, I would rather disable this Plumber control than keep the same allowlist in two places. Let me know and I will adjust the config.
The last two commits enable
score-pushand add a Plumber Score badge to theREADME.md. When the workflow runs, it publishes this repository's result to the hosted service atscore.getplumber.ioover OIDC (no secret required).This makes the repository name and its A to E score publicly visible. The README badge displays the score of the default branch.
If you would rather not publish it: just tell me and I will remove the 2 last commits from the PR. The scan and the hardening keep working either way.