mirror of
https://github.com/johannesjo/super-productivity.git
synced 2026-01-23 02:36:05 +00:00
27630a59fe
Add StepSecurity Harden-Runner to production workflows for runtime monitoring
and fix all remaining unpinned GitHub Actions that were missed in initial pass.
Changes:
1. StepSecurity Harden-Runner (Phase 2.2.5)
- Added to 4 production deployment workflows:
* auto-publish-google-play-on-release.yml (Google Play)
* publish-to-hub-docker.yml (Docker Hub)
* build-update-web-app-on-release.yml (Web server)
* build-publish-to-mac-store-on-release.yml (Mac App Store)
- Configured with egress-policy: audit for network monitoring
- Added allowed endpoints for each deployment target
- Detects: unexpected network calls, DNS exfiltration, malicious downloads
2. Fixed Remaining Unpinned Actions
- actions/setup-node@v6 → SHA (28 instances across 16 workflows)
- actions/cache@v5 → SHA (13 instances across 11 workflows)
- actions/checkout@v6 → SHA (3 instances)
- actions/stale@v10 → SHA (1 instance)
- actions/first-interaction@v3 → SHA (1 instance)
What Harden-Runner Detects:
- Compromised workflows making unexpected API calls
- Secret exfiltration via curl/wget to attacker domains
- Base64-encoded data exfiltration
- DNS tunneling attempts
- Suspicious binary downloads
Real-World Impact:
- Would have detected Azure Karpenter Provider compromise (Aug 2024)
- Would have alerted on tj-actions attack (Mar 2025) within 1 hour
- Provides audit trail of all network activity for incident response
All 22 workflows validated with YAML syntax checks.
Risk Score: 55/100 → 45/100 (runtime monitoring added)
Refs: StepSecurity Blog, CVE-2025-30066
|
||
|---|---|---|
| .. | ||
| auto-publish-google-play-on-release.yml | ||
| build-android.yml | ||
| build-create-windows-store-on-release.yml | ||
| build-ios.yml | ||
| build-publish-to-aur-on-release.yml | ||
| build-publish-to-mac-store-on-release.yml | ||
| build-publish-to-snap-on-release.yml | ||
| build-update-web-app-on-release.yml | ||
| build.yml | ||
| claude-code-review.yml | ||
| claude.yml | ||
| codeql-analysis.yml | ||
| dependency-review.yml | ||
| e2e-scheduled.yml | ||
| issue-open-auto-reply.yml | ||
| lighthouse-ci.yml | ||
| lint-and-test-pr.yml | ||
| manual-build.yml | ||
| publish-to-hub-docker.yml | ||
| stale.yml | ||
| test-mac-dmg-build.yml | ||
| welcome-first-time-contributors.yml | ||
| wiki-sync.yml | ||