mirror of
https://github.com/johannesjo/super-productivity.git
synced 2026-01-23 02:36:05 +00:00
27630a59fe
Add StepSecurity Harden-Runner to production workflows for runtime monitoring
and fix all remaining unpinned GitHub Actions that were missed in initial pass.
Changes:
1. StepSecurity Harden-Runner (Phase 2.2.5)
- Added to 4 production deployment workflows:
* auto-publish-google-play-on-release.yml (Google Play)
* publish-to-hub-docker.yml (Docker Hub)
* build-update-web-app-on-release.yml (Web server)
* build-publish-to-mac-store-on-release.yml (Mac App Store)
- Configured with egress-policy: audit for network monitoring
- Added allowed endpoints for each deployment target
- Detects: unexpected network calls, DNS exfiltration, malicious downloads
2. Fixed Remaining Unpinned Actions
- actions/setup-node@v6 → SHA (28 instances across 16 workflows)
- actions/cache@v5 → SHA (13 instances across 11 workflows)
- actions/checkout@v6 → SHA (3 instances)
- actions/stale@v10 → SHA (1 instance)
- actions/first-interaction@v3 → SHA (1 instance)
What Harden-Runner Detects:
- Compromised workflows making unexpected API calls
- Secret exfiltration via curl/wget to attacker domains
- Base64-encoded data exfiltration
- DNS tunneling attempts
- Suspicious binary downloads
Real-World Impact:
- Would have detected Azure Karpenter Provider compromise (Aug 2024)
- Would have alerted on tj-actions attack (Mar 2025) within 1 hour
- Provides audit trail of all network activity for incident response
All 22 workflows validated with YAML syntax checks.
Risk Score: 55/100 → 45/100 (runtime monitoring added)
Refs: StepSecurity Blog, CVE-2025-30066
16 lines
565 B
YAML
16 lines
565 B
YAML
name: 'Close stale issues and PRs'
|
|
on:
|
|
schedule:
|
|
- cron: '30 1 * * *'
|
|
|
|
jobs:
|
|
stale:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10
|
|
with:
|
|
days-before-stale: 180
|
|
days-before-close: 14
|
|
stale-issue-message: 'This issue has not received any updates in 180 days. Please comment, if this still relevant!'
|
|
stale-pr-message: 'This PR has not received any updates in 180 days. Please comment, if this still relevant!'
|
|
days-before-pr-close: -1
|