Harden GitHub Actions Workflow - ethicalcheck.yml

[stepsecurity-app]

Summary

This issue is created by StepSecurity related to security issues in ethicalcheck.yml . The platform has identified 2 vulnerabilities (1 critical, 0 high, 0 medium, 1 low).

Remediation Overview

The platform can generate remediations for a few vulnerabilities. For such vulnerabilities, you can find the fixed workflow file in the Suggested Fix For Auto-Remediable Issues section. You can manually deploy these changes or create a pull request by commenting @stepsecurity-app pull-request create on this issue.

If you’d like an automated pull request with the fixed workflow file, comment:

@stepsecurity-app pull-request create

Other issues require manual investigation and changes.

Once a vulnerability has been remediated, ✅ will appear in the title. Note that it may take up to 24 hours for these issues to be updated.

Please review the individual vulnerability section below and follow the recommended resolution steps.

Security Checks Details

❌ Actions should be pinned to a full-length commit SHA

• Severity: Critical

• Description: GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.

• Resolution: Pin Actions to a full-length commit SHA..

• Automated Remediation Available ?: true

• References:

  • GitHub Security Guide

  • The Open Source Security Foundation (OpenSSF) Security Guide

❌ Network and runtime security monitoring should be enabled for GitHub-hosted runners

• Severity: Low

• Description: This check passes if the step-security/harden-runner GitHub Action is used in a job that runs on a GitHub-hosted runner. Harden-Runner prevents exfiltration of code and CI/CD credentials, and detects tampering of files during build.

• Resolution: Add the step-security/harden-runner GitHub Action to the job.

• Automated Remediation Available ?: true

• References:

  • GitHub Security Guide

  • The Open Source Security Foundation (OpenSSF) Security Guide

Suggested Fix For Auto-Remediable Issues

Below is the updated workflow, which fixes the following security vulnerabilities:

• Actions should be pinned to a full-length commit SHA

• Network and runtime security monitoring should be enabled for GitHub-hosted runners

  # This workflow uses actions that are not certified by GitHub.
  # They are provided by a third-party and are governed by
  # separate terms of service, privacy policy, and support
  # documentation.
  # EthicalCheck addresses the critical need to continuously security test APIs in development and in production.
  # EthicalCheck provides the industry’s only free & automated API security testing service that uncovers security vulnerabilities using OWASP API list.
  # Developers relies on EthicalCheck to evaluate every update and release, ensuring that no APIs go to production with exploitable vulnerabilities.
  # You develop the application and API, we bring complete and continuous security testing to you, accelerating development.
  # Know your API and Applications are secure with EthicalCheck – our free & automated API security testing service.
  # How EthicalCheck works?
  # EthicalCheck functions in the following simple steps.
  # 1. Security Testing.
  # Provide your OpenAPI specification or start with a public Postman collection URL.
  # EthicalCheck instantly instrospects your API and creates a map of API endpoints for security testing.
  # It then automatically creates hundreds of security tests that are non-intrusive to comprehensively and completely test for authentication, authorizations, and OWASP bugs your API. The tests addresses the OWASP API Security categories including OAuth 2.0, JWT, Rate Limit etc.
  # 2. Reporting.
  # EthicalCheck generates security test report that includes all the tested endpoints, coverage graph, exceptions, and vulnerabilities.
  # Vulnerabilities are fully triaged, it contains CVSS score, severity, endpoint information, and OWASP tagging.
  # This is a starter workflow to help you get started with EthicalCheck Actions
  name: EthicalCheck-Workflow
  # Controls when the workflow will run
  on:
    # Triggers the workflow on push or pull request events but only for the "master" branch
    # Customize trigger events based on your DevSecOps processes.
    push:
      branches: [ "master", "opent" ]
    pull_request:
      branches: [ "master" ]
    schedule:
      - cron: '17 0 * * 0'
    # Allows you to run this workflow manually from the Actions tab
    workflow_dispatch:
  permissions:
    contents: read
  jobs:
    Trigger_EthicalCheck:
      permissions:
        security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
        actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
      runs-on: ubuntu-latest
      steps:
         - name: 
+ Harden the runner (Audit all outbound calls)
+          uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+          with:
+            egress-policy: audit
+        - name: 
  EthicalCheck  Free & Automated API Security Testing Service
           uses: apisec-inc/ethicalcheck-action@005fac321dd843682b1af6b72f30caaf9952c641
           with:
            # The OpenAPI Specification URL or Swagger Path or Public Postman collection URL.
            oas-url: "http://netbanking.apisec.ai:8080/v2/api-docs"
            # The email address to which the penetration test report will be sent.
            email: "xxx@apisec.ai"
            sarif-result-file: "ethicalcheck-results.sarif"
         - name: Upload sarif file to repository
           uses: github/codeql-action/upload-sarif@
+ 4187e74d05793876e9989daffde9c3e66b4acd07 # 
  v
+ 3.37.
  3
           with:
            sarif_file: ./ethicalcheck-results.sarif

Additional Information

For more information, refer to the documentation page here.
Please don't make any changes in the description as the platform makes automated updates in description. Please use the comment section below to provide input.

Automated remediation commands and options

• Create a pull request with automated security fixes

@stepsecurity-app pull-request create

• Close this issue and prevent it from being reopened

@stepsecurity-app issue close <REASON>

• Update issue description with latest security check status

@stepsecurity-app issue force-update

• View all available commands and their usage

@stepsecurity-app help

Which GitHub Actions security best practices were evaluated?

The workflow was evaluated for the following GitHub Actions security best practices:

• Network & runtime security monitoring
• Token permissions
• Third‐party GitHub Actions usage & pinning