Add Plumber security scan and harden workflow actions

.github/workflows/linter.yml

@@ -3,6 +3,10 @@ name: Linter
 on:
   pull_request:
     branches: [main]
+permissions:
+  contents: read
+  # super-linter reports the outcome of each linter as a commit status
+  statuses: write
 jobs:
   build:
     name: Lint Code Base

.github/workflows/plumber.yml

@@ -0,0 +1,39 @@
+---
+name: plumber
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: Scan CI/CD workflows
+    runs-on: ubuntu-latest
+    permissions:
+      # To upload the SARIF report to the Security tab
+      security-events: write
+      contents: read
+      # To publish the Plumber Score via OIDC (score-push, see below)
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Run Plumber
+        uses: getplumber/plumber@87ca135cc4566ba8e9065ea95b5d897232cdb208 # v0.4.16
+        with:
+          # Fail the check only when the Plumber Score drops below C.
+          min-score: "C"
+          # Publish this repository's Plumber Score to the hosted score
+          # service so the README badge stays up to date. This makes the
+          # repository name and its score public. The badge displays the
+          # score of the default branch.
+          score-push: true

.github/workflows/release.yml

@@ -8,6 +8,10 @@ on:
         description: 'Release version'
         required: true
 
+# The job commits the version bump, pushes it and publishes the release.
+permissions:
+  contents: write
+
 env:
   JAVA_VERSION: '11'
   JAVA_DISTRO: 'zulu'

.github/workflows/test.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 env:
   JAVA_VERSION: '11'
   JAVA_DISTRO: 'zulu'

.plumber.yaml

@@ -0,0 +1,152 @@
+# Plumber configuration for the sdk-java repository.
+# Based on Plumber's built-in defaults (github provider only); every control
+# is listed explicitly so none is silently disabled. The only customization is
+# the branch protection policy below.
+version: "2.0"
+github:
+  controls:
+    containerImageMustNotUseForbiddenTags:
+      enabled: true
+      tags:
+      - latest
+      - dev
+      - development
+      - staging
+      - main
+      - master
+      containerImagesMustBePinnedByDigest: true
+    branchMustBeProtected:
+      enabled: true
+      namePatterns:
+      - main
+      - master
+      - release/*
+      - production
+      - dev
+      defaultMustBeProtected: true
+      allowForcePush: false
+      # This project does not use a CODEOWNERS-based review process, so
+      # code owner approval is not part of its branch protection policy.
+      codeOwnerApprovalRequired: false
+    externalRefsMustNotCollide:
+      enabled: true
+    pipelineMustNotEnableDebugTrace:
+      enabled: true
+      forbiddenVariables:
+      - ACTIONS_STEP_DEBUG
+      - ACTIONS_RUNNER_DEBUG
+    securityJobsMustNotBeWeakened:
+      enabled: true
+      securityJobPatterns:
+      - '*codeql*'
+      - '*dependency-review*'
+      - '*trufflehog*'
+      - '*gitleaks*'
+      - '*osv-scanner*'
+      - '*-sast'
+      - '*-sast-*'
+      - '*-scan'
+      - '*scan*'
+      - '*-security'
+      - '*-security-*'
+      - '*-audit'
+      - '*-audit-*'
+      allowFailureMustBeFalse:
+        enabled: true
+      rulesMustNotBeRedefined:
+        enabled: true
+      whenMustNotBeManual:
+        enabled: true
+    pipelineMustNotExecuteUnverifiedScripts:
+      enabled: true
+    pipelineMustNotUseDockerInDocker:
+      enabled: true
+      detectInsecureDaemon: true
+    actionsMustBePinnedByCommitSha:
+      enabled: true
+      trustedOwners:
+      - actions
+      - github
+    githubActionMustComeFromAuthorizedSources:
+      enabled: true
+      trustGithubOfficialActions: true
+      trustSameOrgActions: true
+      trustedGithubActions:
+      - getplumber/plumber
+    workflowMustNotInjectUserInputInScripts:
+      enabled: true
+    workflowMustNotWriteUntrustedContentToGitHubEnv:
+      enabled: true
+    workflowMustNotUseDangerousTriggers:
+      enabled: true
+    pullRequestTargetMustNotCheckoutHead:
+      enabled: true
+    workflowsMustDeclarePermissions:
+      enabled: true
+    reusableWorkflowsMustNotInheritSecrets:
+      enabled: true
+    workflowMustNotExportEntireSecretsContext:
+      enabled: true
+    workflowMustNotGrantPermissionsWriteAll:
+      enabled: true
+    actionsMustNotBeArchived:
+      enabled: true
+    actionRefsMustExistUpstream:
+      enabled: true
+    actionsMustNotCarryKnownCVEs:
+      enabled: true
+    actionsMustNotExecuteMutableRemoteCode:
+      enabled: true
+    releaseWorkflowsMustNotRestoreUntrustedCache:
+      enabled: true
+      publishActions:
+      - gradle/publish-plugin
+      cacheActions:
+      - action: actions/cache
+        mode: always
+      - action: actions/cache/restore
+        mode: always
+      - action: Swatinem/rust-cache
+        mode: always
+      - action: actions/setup-go
+        mode: default
+        disableInput: cache
+        disableValue: false
+      - action: gradle/actions/setup-gradle
+        mode: default
+        disableInput: cache-disabled
+        disableValue: true
+      - action: actions/setup-node
+        mode: opt-in
+        enableInput: cache
+      - action: actions/setup-python
+        mode: opt-in
+        enableInput: cache
+      - action: actions/setup-java
+        mode: opt-in
+        enableInput: cache
+      - action: pnpm/action-setup
+        mode: opt-in
+        enableInput: cache
+      - action: docker/build-push-action
+        mode: opt-in
+        enableInput: cache-from
+        enableContains: type=gha
+      publishScriptPatterns:
+      - (?i)(npm|pnpm|yarn|bun)\s+publish
+      - (?i)cargo\s+publish
+      - (?i)twine\s+upload
+      - (?i)poetry\s+publish
+      - (?i)gh\s+release\s+create
+      - (?i)goreleaser\s+release
+      - (?i)semantic-release
+      - (?i)gradlew?\b[^\n]*\bpublish
+      - (?i)\bmvnw?\b[^\n]*\bdeploy\b
+      - (?i)dotnet\s+nuget\s+push
+      - (?i)gem\s+push
+      - (?i)docker\s+push
+      publishScriptExcludePatterns:
+      - (?i)--dry-run
+      - (?i)publishToMavenLocal
+    workflowMustIncludeRequiredActions:
+      enabled: false

README.md

@@ -1,5 +1,7 @@
 # CDEvents Java SDK
 
+[![Plumber Score](https://score.getplumber.io/github.com/cdevents/sdk-java.svg)](https://score.getplumber.io/github.com/cdevents/sdk-java)
+
 Java SDK to produce [CDEvents](https://cdevents.dev).
 
 The SDK can be used to create CDEvents and render as CloudEvents to send them to a specific CloudEvents broker