From 0bb5472e50e158ee1885aab02a2ce93adf538656 Mon Sep 17 00:00:00 2001 From: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> Date: Thu, 14 May 2026 14:59:07 +0100 Subject: [PATCH] [StepSecurity] Apply security best practices (#2378) Signed-off-by: StepSecurity Bot Co-authored-by: StepSecurity Bot --- .github/dependabot.yml | 8 ++++++++ .github/workflows/master.yml | 6 +++--- .github/workflows/pull_requests.yml | 12 ++++++------ .github/workflows/releases.yml | 20 ++++++++++---------- Dockerfile | 4 ++-- 5 files changed, 29 insertions(+), 21 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e1b854f3..f5e52ed9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -68,3 +68,11 @@ updates: timezone: Europe/London commit-message: prefix: 'chore (deps): ' + + - package-ecosystem: docker + directory: / + schedule: + interval: 'weekly' + day: 'friday' + time: '03:00' + timezone: Europe/London diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index 59f3d2cd..da4d6caa 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -16,10 +16,10 @@ jobs: pages: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set node version - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 registry-url: "https://registry.npmjs.org" @@ -56,7 +56,7 @@ jobs: - name: Deploy to GitHub Pages if: success() && github.ref == 'refs/heads/master' - uses: crazy-max/ghaction-github-pages@v5 + uses: crazy-max/ghaction-github-pages@1d6ee9b181a81033a16bd707a1401afa978daab4 # v5.0.0 with: target_branch: gh-pages build_dir: ./build/prod diff --git a/.github/workflows/pull_requests.yml b/.github/workflows/pull_requests.yml index 9c738ef3..d8b80871 100644 --- a/.github/workflows/pull_requests.yml +++ b/.github/workflows/pull_requests.yml @@ -12,10 +12,10 @@ jobs: main: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set node version - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 registry-url: "https://registry.npmjs.org" @@ -39,7 +39,7 @@ jobs: - name: Upload Build Artefact if: success() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: zipped-build path: build/prod/*.zip @@ -53,14 +53,14 @@ jobs: - name: Set up Docker Buildx if: success() - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 - name: Production Image Build if: success() id: build-image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 with: platforms: linux/amd64,linux/arm64,linux/arm/v7 diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml index 53989113..ab9cf670 100644 --- a/.github/workflows/releases.yml +++ b/.github/workflows/releases.yml @@ -22,10 +22,10 @@ jobs: contents: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set node version - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 registry-url: "https://registry.npmjs.org" @@ -52,14 +52,14 @@ jobs: xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 - name: Image Metadata id: image-metadata - uses: docker/metadata-action@v6 + uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | @@ -68,14 +68,14 @@ jobs: type=semver,pattern={{version}} - name: Log in to GHCR - uses: docker/login-action@v4 + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 with: registry: ${{ env.REGISTRY }} username: ${{ env.REGISTRY_USER }} password: ${{ env.REGISTRY_PASSWORD }} - name: Publish to GHCR - uses: docker/build-push-action@v6 + uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 with: context: . push: true @@ -85,7 +85,7 @@ jobs: - name: Upload Release Assets id: upload-release-assets - uses: svenstaro/upload-release-action@v2 + uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # v2 with: repo_token: ${{ secrets.GITHUB_TOKEN }} file: build/prod/*.zip @@ -101,10 +101,10 @@ jobs: needs: main runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set node version - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 registry-url: "https://registry.npmjs.org" diff --git a/Dockerfile b/Dockerfile index feb130ba..c8d40424 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # Modifier --platform=$BUILDPLATFORM limits the platform to "BUILDPLATFORM" during buildx multi-platform builds # This is because npm "chromedriver" package is not compatiable with all platforms # For more info see: https://docs.docker.com/build/building/multi-platform/#cross-compilation -FROM --platform=$BUILDPLATFORM node:24-alpine AS builder +FROM --platform=$BUILDPLATFORM node:24-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS builder WORKDIR /app @@ -27,7 +27,7 @@ RUN npm run build ######################################### # Package static build files into nginx # ######################################### -FROM nginxinc/nginx-unprivileged:stable-alpine AS cyberchef +FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:808f7846d21a9c94cf53833e8807a00a33fd0b65cc47fb05b79efe366c2d201f AS cyberchef LABEL maintainer="GCHQ "