{"repo":"step-security/secure-repo","free":true,"listed":false,"github":"https://github.com/step-security/secure-repo","clone":"git clone https://github.com/step-security/secure-repo.git","description":"Orchestrate GitHub Actions Security","language":"Go","stars":329,"topics":["security","github-actions","workflow","actions","github","golang","supply-chain-security","security-tools"],"license":"AGPL-3.0","category":"workflow-automation","readme_excerpt":"Automatically apply security best practices in your GitHub repository Catalog of Fixes • Quickstart • Contributing Catalog of Fixes 1. Automatically set minimum GITHUB TOKEN permissions 2. Add Harden-Runner GitHub Action to each job 3. Pin Actions to a full length commit SHA 4. Pin image tags to digests in Dockerfiles 5. Add or update Dependabot configuration 6. Add CodeQL workflow (SAST) 7. Add Dependency review workflow 8. Add OpenSSF Scorecard workflow 1. Automatically set minimum GITHUB TOKEN permissions Why is this needed? - The GITHUB TOKEN is an automatically generated secret to make authenticated calls to the GitHub API - If the token is compromised, it can be abused to compromise your environment (e.g., to overwrite releases or source code). This compromise will also impact everyone using your software in their supply chain. - To limit the damage, GitHub recommends setting minimum token permissions for the GITHUB TOKEN. Before and After the fix Pull request example : https://github.com/nginxinc/kubernetes-ingress/pull/3134 In this pull request, minimum permissions are set automatically for the GITHUB TOKEN How does Secure-Repo fix this issue? - Secure-Repo stores the permissions needed by different GitHub Actions in a knowledge base - It looks up the permissions needed by each Action in your workflow and sums the permissions up to come up with a final recommendation - If you are the owner of a GitHub Action, please contribute to the knowledge base 2. Add Harden-Runne","default_branch":null,"files":null,"tree":[],"storefront":"/r/step-security","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/step-security/secure-repo/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}