mirror of
https://github.com/johannesjo/super-productivity.git
synced 2026-01-23 02:36:05 +00:00
27630a59fe
Add StepSecurity Harden-Runner to production workflows for runtime monitoring
and fix all remaining unpinned GitHub Actions that were missed in initial pass.
Changes:
1. StepSecurity Harden-Runner (Phase 2.2.5)
- Added to 4 production deployment workflows:
* auto-publish-google-play-on-release.yml (Google Play)
* publish-to-hub-docker.yml (Docker Hub)
* build-update-web-app-on-release.yml (Web server)
* build-publish-to-mac-store-on-release.yml (Mac App Store)
- Configured with egress-policy: audit for network monitoring
- Added allowed endpoints for each deployment target
- Detects: unexpected network calls, DNS exfiltration, malicious downloads
2. Fixed Remaining Unpinned Actions
- actions/setup-node@v6 → SHA (28 instances across 16 workflows)
- actions/cache@v5 → SHA (13 instances across 11 workflows)
- actions/checkout@v6 → SHA (3 instances)
- actions/stale@v10 → SHA (1 instance)
- actions/first-interaction@v3 → SHA (1 instance)
What Harden-Runner Detects:
- Compromised workflows making unexpected API calls
- Secret exfiltration via curl/wget to attacker domains
- Base64-encoded data exfiltration
- DNS tunneling attempts
- Suspicious binary downloads
Real-World Impact:
- Would have detected Azure Karpenter Provider compromise (Aug 2024)
- Would have alerted on tj-actions attack (Mar 2025) within 1 hour
- Provides audit trail of all network activity for incident response
All 22 workflows validated with YAML syntax checks.
Risk Score: 55/100 → 45/100 (runtime monitoring added)
Refs: StepSecurity Blog, CVE-2025-30066
|
||
|---|---|---|
| .. | ||
| annotations | ||
| ISSUE_TEMPLATE | ||
| workflows | ||
| CODE_OF_CONDUCT.md | ||
| CODEOWNERS | ||
| CONTRIBUTING.md | ||
| dependabot.yml | ||
| FUNDING.yml | ||
| PULL_REQUEST_TEMPLATE.md | ||
| SECURITY-SETUP.md | ||