mirror of
https://github.com/johannesjo/super-productivity.git
synced 2026-01-23 02:36:05 +00:00
27630a59fe
Add StepSecurity Harden-Runner to production workflows for runtime monitoring
and fix all remaining unpinned GitHub Actions that were missed in initial pass.
Changes:
1. StepSecurity Harden-Runner (Phase 2.2.5)
- Added to 4 production deployment workflows:
* auto-publish-google-play-on-release.yml (Google Play)
* publish-to-hub-docker.yml (Docker Hub)
* build-update-web-app-on-release.yml (Web server)
* build-publish-to-mac-store-on-release.yml (Mac App Store)
- Configured with egress-policy: audit for network monitoring
- Added allowed endpoints for each deployment target
- Detects: unexpected network calls, DNS exfiltration, malicious downloads
2. Fixed Remaining Unpinned Actions
- actions/setup-node@v6 → SHA (28 instances across 16 workflows)
- actions/cache@v5 → SHA (13 instances across 11 workflows)
- actions/checkout@v6 → SHA (3 instances)
- actions/stale@v10 → SHA (1 instance)
- actions/first-interaction@v3 → SHA (1 instance)
What Harden-Runner Detects:
- Compromised workflows making unexpected API calls
- Secret exfiltration via curl/wget to attacker domains
- Base64-encoded data exfiltration
- DNS tunneling attempts
- Suspicious binary downloads
Real-World Impact:
- Would have detected Azure Karpenter Provider compromise (Aug 2024)
- Would have alerted on tj-actions attack (Mar 2025) within 1 hour
- Provides audit trail of all network activity for incident response
All 22 workflows validated with YAML syntax checks.
Risk Score: 55/100 → 45/100 (runtime monitoring added)
Refs: StepSecurity Blog, CVE-2025-30066
56 lines
1.7 KiB
YAML
56 lines
1.7 KiB
YAML
name: Lighthouse CI
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- master
|
|
- main
|
|
workflow_dispatch:
|
|
inputs: {}
|
|
release:
|
|
types: [published]
|
|
|
|
jobs:
|
|
lighthouse:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
UNSPLASH_KEY: ${{ secrets.UNSPLASH_KEY }}
|
|
UNSPLASH_CLIENT_ID: ${{ secrets.UNSPLASH_CLIENT_ID }}
|
|
steps:
|
|
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
|
|
|
|
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
|
|
with:
|
|
node-version: 20
|
|
cache: 'npm'
|
|
|
|
- name: Install dependencies
|
|
run: npm i
|
|
|
|
- run: npm run env # Generate env.generated.ts
|
|
|
|
- name: Build production web app
|
|
run: npm run buildFrontend:prodWeb
|
|
|
|
- name: Add swap space for Lighthouse
|
|
run: |
|
|
# Ensure Lighthouse/Chrome have enough memory on GitHub-hosted runners
|
|
sudo fallocate -l 4G /swapfile
|
|
sudo chmod 600 /swapfile
|
|
sudo mkswap /swapfile
|
|
sudo swapon /swapfile
|
|
|
|
- name: Strip service worker artifacts for Lighthouse
|
|
run: rm -f dist/browser/ngsw.json dist/browser/ngsw-worker.js dist/browser/safety-worker.js dist/browser/worker-basic.min.js
|
|
|
|
- name: Run Lighthouse CI
|
|
uses: treosh/lighthouse-ci-action@fcd65974f7c4c2bf0ee9d09b84d2489183c29726 # v12
|
|
with:
|
|
# Configure Lighthouse CI
|
|
configPath: './tools/lighthouse/.lighthouserc.json'
|
|
# Upload results to temporary storage
|
|
uploadArtifacts: true
|
|
temporaryPublicStorage: true
|
|
# Run once to avoid long Chrome sessions on CI
|
|
runs: 1
|
|
# Configure budgets
|
|
budgetPath: './tools/lighthouse/budget.json'
|