[StepSecurity] Apply security best practices

step-security-bot · step-security-bot · commit bc0d8877d3f2 · 2024-11-05T15:37:53.000Z
Signed-off-by: StepSecurity Bot &lt;bot@stepsecurity.io&gt;
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
@@ -118,3 +118,58 @@ updates:
         update-types:
           - version-update:semver-major
     open-pull-requests-limit: 15
+
+  - package-ecosystem: docker
+    directory: /dogfood/contents
+    schedule:
+      interval: daily
+
+  - package-ecosystem: docker
+    directory: /examples/jfrog/docker/build
+    schedule:
+      interval: daily
+
+  - package-ecosystem: docker
+    directory: /examples/parameters/build
+    schedule:
+      interval: daily
+
+  - package-ecosystem: docker
+    directory: /examples/templates/docker/build
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /offlinedocs
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: daily
+
+  - package-ecosystem: docker
+    directory: /scaletest/templates/scaletest-runner
+    schedule:
+      interval: daily
+
+  - package-ecosystem: docker
+    directory: /scripts
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /scripts/apidocgen
+    schedule:
+      interval: daily
+
+  - package-ecosystem: docker
+    directory: /scripts/ironbank
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /site
+    schedule:
+      interval: daily
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -0,0 +1,27 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@4081bf99e2866ebe428fc0477b69eb4fcda7220a # v4.4.0
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -0,0 +1,22 @@
+repos:
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.16.3
+  hooks:
+  - id: gitleaks
+- repo: https://github.com/golangci/golangci-lint
+  rev: v1.52.2
+  hooks:
+  - id: golangci-lint
+- repo: https://github.com/jumanjihouse/pre-commit-hooks
+  rev: 3.0.0
+  hooks:
+  - id: shellcheck
+- repo: https://github.com/pre-commit/mirrors-eslint
+  rev: v8.38.0
+  hooks:
+  - id: eslint
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace
diff --git a/dogfood/contents/Dockerfile b/dogfood/contents/Dockerfile
@@ -87,7 +87,7 @@ RUN apt-get update && \
 	rm -rf /tmp/go/pkg && \
 	rm -rf /tmp/go/src
 
-FROM gcr.io/coder-dev-1/alpine:3.18 as proto
+FROM gcr.io/coder-dev-1/alpine:3.18@sha256:25fad2a32ad1f6f510e528448ae1ec69a28ef81916a004d3629874104f8a7f70 as proto
 WORKDIR /tmp
 RUN apk add curl unzip
 RUN curl -L -o protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v23.3/protoc-23.3-linux-x86_64.zip && \
