Harden GitHub Actions Workflow - azure-webapps-node.yml

[stepsecurity-app]

Summary

This issue is created by StepSecurity related to security issues in azure-webapps-node.yml . The platform has identified 2 vulnerabilities (1 critical, 0 high, 0 medium, 1 low).

Remediation Overview

The platform can generate remediations for a few vulnerabilities. For such vulnerabilities, you can find the fixed workflow file in the Suggested Fix For Auto-Remediable Issues section. You can manually deploy these changes or create a pull request by commenting @stepsecurity-app pull-request create on this issue.

If you’d like an automated pull request with the fixed workflow file, comment:

@stepsecurity-app pull-request create

Other issues require manual investigation and changes.

Once a vulnerability has been remediated, ✅ will appear in the title. Note that it may take up to 24 hours for these issues to be updated.

Please review the individual vulnerability section below and follow the recommended resolution steps.

Security Checks Details

❌ Actions should be pinned to a full-length commit SHA

• Severity: Critical

• Description: GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.

• Resolution: Pin Actions to a full-length commit SHA..

• Automated Remediation Available ?: true

• References:

  • GitHub Security Guide

  • The Open Source Security Foundation (OpenSSF) Security Guide

❌ Network and runtime security monitoring should be enabled for GitHub-hosted runners

• Severity: Low

• Description: This check passes if the step-security/harden-runner GitHub Action is used in a job that runs on a GitHub-hosted runner. Harden-Runner prevents exfiltration of code and CI/CD credentials, and detects tampering of files during build.

• Resolution: Add the step-security/harden-runner GitHub Action to the job.

• Automated Remediation Available ?: true

• References:

  • GitHub Security Guide

  • The Open Source Security Foundation (OpenSSF) Security Guide

Suggested Fix For Auto-Remediable Issues

Below is the updated workflow, which fixes the following security vulnerabilities:

• Actions should be pinned to a full-length commit SHA

• Network and runtime security monitoring should be enabled for GitHub-hosted runners

  # This workflow will build and push a node.js application to an Azure Web App when a commit is pushed to your default branch.
  #
  # This workflow assumes you have already created the target Azure App Service web app.
  # For instructions see https://docs.microsoft.com/en-us/azure/app-service/quickstart-nodejs?tabs=linux&pivots=development-environment-cli
  #
  # To configure this workflow:
  #
  # 1. Download the Publish Profile for your Azure Web App. You can download this file from the Overview page of your Web App in the Azure Portal.
  #    For more information: https://docs.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=applevel#generate-deployment-credentials
  #
  # 2. Create a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE, paste the publish profile contents as the value of the secret.
  #    For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret
  #
  # 3. Change the value for the AZURE_WEBAPP_NAME. Optionally, change the AZURE_WEBAPP_PACKAGE_PATH and NODE_VERSION environment variables below.
  #
  # For more information on GitHub Actions for Azure: https://github.com/Azure/Actions
  # For more information on the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy
  # For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples
  on:
    push:
      branches: [ "main" ]
    workflow_dispatch:
  env:
    AZURE_WEBAPP_NAME: your-app-name    # set this to your application's name
    AZURE_WEBAPP_PACKAGE_PATH: '.'      # set this to the path to your web app project, defaults to the repository root
    NODE_VERSION: '20.x'                # set this to the node version to use
  permissions:
    contents: read
  jobs:
    build:
      runs-on: ubuntu-latest
      steps:
      - 
+ name: Harden the runner (Audit all outbound calls)
+       uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+       with:
+         egress-policy: audit
+     - 
  uses: actions/checkout@
+ 11d5960a326750d5838078e36cf38b85af677262 # 
  v4
+ .4.0
      - name: Set up Node.js
        uses: actions/setup-node@
+ 49933ea5288caeca8642d1e84afbd3f7d6820020 # 
  v4
+ .4.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - name: npm install, build, and test
        run: |
          npm install
          npm run build --if-present
          npm run test --if-present
      - name: Upload artifact for deployment job
        uses: actions/upload-artifact@
+ ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # 
  v3
+ .2.1
        with:
          name: node-app
          path: .
    deploy:
      permissions:
        contents: none
      runs-on: ubuntu-latest
      needs: build
      environment:
        name: 'Development'
        url: ${{ steps.deploy-to-webapp.outputs.webapp-url }}
      steps:
      - name: 
+ Harden the runner (Audit all outbound calls)
+       uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+       with:
+         egress-policy: audit
+     - name: 
  Download artifact from build job
        uses: actions/download-artifact@
+ 9bc31d5ccc31df68ecc42ccf4149144866c47d8a # 
  v3
+ .0.2
        with:
          name: node-app
      - name: 'Deploy to Azure WebApp'
        id: deploy-to-webapp
        uses: azure/webapps-deploy@
+ 5cfb776471c748b351e1ebf5770e208a54ace016 # 
  v2
+ .2.19
        with:
          app-name: ${{ env.AZURE_WEBAPP_NAME }}
          publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }}
          package: ${{ env.AZURE_WEBAPP_PACKAGE_PATH }}

Additional Information

For more information, refer to the documentation page here.
Please don't make any changes in the description as the platform makes automated updates in description. Please use the comment section below to provide input.

Automated remediation commands and options

• Create a pull request with automated security fixes

@stepsecurity-app pull-request create

• Close this issue and prevent it from being reopened

@stepsecurity-app issue close <REASON>

• Update issue description with latest security check status

@stepsecurity-app issue force-update

• View all available commands and their usage

@stepsecurity-app help

Which GitHub Actions security best practices were evaluated?

The workflow was evaluated for the following GitHub Actions security best practices:

• Network & runtime security monitoring
• Token permissions
• Third‐party GitHub Actions usage & pinning