From 2ec1eb9d8d436782e6b65709b131d16314b223d3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timo=20K=C3=B6ssler?= Date: Sat, 23 May 2026 17:23:35 +0200 Subject: [PATCH 1/2] chore: Add security scanning and harden GH actions --- .github/dependabot.yml | 8 ++++-- .github/workflows/codeql.yml | 46 ++++++++++++++++++++++++++++++++++ .github/workflows/docker.yml | 2 ++ .github/workflows/quality.yml | 2 ++ .github/workflows/security.yml | 22 ++++++++++++++++ .github/zizmor.yml | 4 +++ 6 files changed, 82 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/security.yml create mode 100644 .github/zizmor.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index be23cc8..6a33a87 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,21 +10,25 @@ multi-ecosystem-groups: labels: - "dependencies" open-pull-requests-limit: 5 - cooldown: - default-days: 2 updates: - package-ecosystem: "github-actions" directory: "/" multi-ecosystem-group: "dependencies" patterns: ["*"] + cooldown: + default-days: 3 - package-ecosystem: "docker" directory: "/" multi-ecosystem-group: "dependencies" patterns: ["*"] + cooldown: + default-days: 3 - package-ecosystem: "npm" directory: "/" multi-ecosystem-group: "dependencies" patterns: ["*"] + cooldown: + default-days: 3 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..d785cb2 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,46 @@ +name: "CodeQL" + +on: + push: + branches: + - "main" + pull_request: + schedule: + - cron: '42 4 * * 3' # Every Wednesday at 4:42am + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: 'ubuntu-latest' + permissions: + security-events: write + packages: read + actions: read + contents: read + + strategy: + fail-fast: false + matrix: + include: + - language: actions + build-mode: none + - language: javascript-typescript + build-mode: none + + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Initialize CodeQL + uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + queries: security-and-quality + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 + with: + category: "/language:${{matrix.language}}" diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 311a9e0..6a7554d 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -22,6 +22,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Set up QEMU uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index f8696aa..cb1a6b1 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -13,6 +13,8 @@ jobs: steps: - name: Checkout repository ⬇️ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Set up pnpm uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6 diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..c743e7d --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,22 @@ +name: Security + +on: + push: + +permissions: {} + +jobs: + zizmor: + name: Check GitHub Actions + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + security-events: write # Required to upload results as security events + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3 diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..f5f330c --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,4 @@ +rules: + dependabot-cooldown: + config: + days: 3 # Reduce default cooldown period for Dependabot PRs from 7 to 3 days \ No newline at end of file From 21e5eb6aac6991d8a81a6323010e13484cfb2f7e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timo=20K=C3=B6ssler?= Date: Sat, 23 May 2026 17:25:43 +0200 Subject: [PATCH 2/2] fix: Format --- .github/workflows/codeql.yml | 40 ++++++++++++++++++------------------ .github/workflows/docker.yml | 2 +- .github/zizmor.yml | 2 +- 3 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d785cb2..ab34d74 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -3,15 +3,15 @@ name: "CodeQL" on: push: branches: - - "main" + - "main" pull_request: schedule: - - cron: '42 4 * * 3' # Every Wednesday at 4:42am + - cron: "42 4 * * 3" # Every Wednesday at 4:42am jobs: analyze: name: Analyze (${{ matrix.language }}) - runs-on: 'ubuntu-latest' + runs-on: "ubuntu-latest" permissions: security-events: write packages: read @@ -22,25 +22,25 @@ jobs: fail-fast: false matrix: include: - - language: actions - build-mode: none - - language: javascript-typescript - build-mode: none + - language: actions + build-mode: none + - language: javascript-typescript + build-mode: none steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: persist-credentials: false - - name: Initialize CodeQL - uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 - with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - queries: security-and-quality + - name: Initialize CodeQL + uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + queries: security-and-quality - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 - with: - category: "/language:${{matrix.language}}" + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 + with: + category: "/language:${{matrix.language}}" diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 6a7554d..3765930 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -23,7 +23,7 @@ jobs: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - persist-credentials: false + persist-credentials: false - name: Set up QEMU uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 diff --git a/.github/zizmor.yml b/.github/zizmor.yml index f5f330c..3c0ceef 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -1,4 +1,4 @@ rules: dependabot-cooldown: config: - days: 3 # Reduce default cooldown period for Dependabot PRs from 7 to 3 days \ No newline at end of file + days: 3 # Reduce default cooldown period for Dependabot PRs from 7 to 3 days