Harden GitHub Actions Workflow - codacy.yml

[stepsecurity-app]

Summary

This issue is created by StepSecurity related to security issues in codacy.yml . The platform has identified 2 vulnerabilities (1 critical, 0 high, 0 medium, 1 low).

Remediation Overview

The platform can generate remediations for a few vulnerabilities. For such vulnerabilities, you can find the fixed workflow file in the Suggested Fix For Auto-Remediable Issues section. You can manually deploy these changes or create a pull request by commenting @stepsecurity-app pull-request create on this issue.

If you’d like an automated pull request with the fixed workflow file, comment:

@stepsecurity-app pull-request create

Other issues require manual investigation and changes.

Once a vulnerability has been remediated, ✅ will appear in the title. Note that it may take up to 24 hours for these issues to be updated.

Please review the individual vulnerability section below and follow the recommended resolution steps.

Security Checks Details

❌ Actions should be pinned to a full-length commit SHA

• Severity: Critical

• Description: GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.

• Resolution: Pin Actions to a full-length commit SHA..

• Automated Remediation Available ?: true

• References:

  • GitHub Security Guide

  • The Open Source Security Foundation (OpenSSF) Security Guide

❌ Network and runtime security monitoring should be enabled for GitHub-hosted runners

• Severity: Low

• Description: This check passes if the step-security/harden-runner GitHub Action is used in a job that runs on a GitHub-hosted runner. Harden-Runner prevents exfiltration of code and CI/CD credentials, and detects tampering of files during build.

• Resolution: Add the step-security/harden-runner GitHub Action to the job.

• Automated Remediation Available ?: true

• References:

  • GitHub Security Guide

  • The Open Source Security Foundation (OpenSSF) Security Guide

Suggested Fix For Auto-Remediable Issues

Below is the updated workflow, which fixes the following security vulnerabilities:

• Actions should be pinned to a full-length commit SHA

• Network and runtime security monitoring should be enabled for GitHub-hosted runners

  # This workflow uses actions that are not certified by GitHub.
  # They are provided by a third-party and are governed by
  # separate terms of service, privacy policy, and support
  # documentation.
  # This workflow checks out code, performs a Codacy security scan
  # and integrates the results with the
  # GitHub Advanced Security code scanning feature.  For more information on
  # the Codacy security scan action usage and parameters, see
  # https://github.com/codacy/codacy-analysis-cli-action.
  # For more information on Codacy Analysis CLI in general, see
  # https://github.com/codacy/codacy-analysis-cli.
  name: Codacy Security Scan
  on:
    push:
      branches: [ "main" ]
    pull_request:
      # The branches below must be a subset of the branches above
      branches: [ "main" ]
    schedule:
      - cron: '34 5 * * 0'
  permissions:
    contents: read
  jobs:
    codacy-security-scan:
      permissions:
        contents: read # for actions/checkout to fetch code
        security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
        actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
      name: Codacy Security Scan
      runs-on: ubuntu-latest
      steps:
        # Checkout the repository to the GitHub Actions runner
        - name: 
+ Harden the runner (Audit all outbound calls)
+         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+         with:
+           egress-policy: audit
+       - name: 
  Checkout code
          uses: actions/checkout@
+ 11d5960a326750d5838078e36cf38b85af677262 # 
  v4
+ .4.0
        # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
        - name: Run Codacy Analysis CLI
          uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b
          with:
            # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository
            # You can also omit the token and run the tools that support default configurations
            project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
            verbose: true
            output: results.sarif
            format: sarif
            # Adjust severity of non-security issues
            gh-code-scanning-compat: true
            # Force 0 exit code to allow SARIF file generation
            # This will handover control about PR rejection to the GitHub side
            max-allowed-issues: 2147483647
        # Upload the SARIF file generated in the previous step
        - name: Upload SARIF results file
          uses: github/codeql-action/upload-sarif@
+ 4187e74d05793876e9989daffde9c3e66b4acd07 # 
  v
+ 3.37.
  3
          with:
            sarif_file: results.sarif

Additional Information

For more information, refer to the documentation page here.
Please don't make any changes in the description as the platform makes automated updates in description. Please use the comment section below to provide input.

Automated remediation commands and options

• Create a pull request with automated security fixes

@stepsecurity-app pull-request create

• Close this issue and prevent it from being reopened

@stepsecurity-app issue close <REASON>

• Update issue description with latest security check status

@stepsecurity-app issue force-update

• View all available commands and their usage

@stepsecurity-app help

Which GitHub Actions security best practices were evaluated?

The workflow was evaluated for the following GitHub Actions security best practices:

• Network & runtime security monitoring
• Token permissions
• Third‐party GitHub Actions usage & pinning