exlim/cyberchef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[StepSecurity] Apply security best practices (#2378)

Browse Source 
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Co-authored-by: StepSecurity Bot <bot@stepsecurity.io>
This commit is contained in:
GCHQDeveloper581 2026-05-14 14:59:07 +01:00 committed by GitHub
parent 3471731aaf
commit 0bb5472e50
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 29 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.github/dependabot.yml vendored
View File

@ -68,3 +68,11 @@ updates:
timezone: Europe/London timezone: Europe/London
commit-message: commit-message:
prefix: 'chore (deps): ' prefix: 'chore (deps): '
- package-ecosystem: docker
directory: /
schedule:
interval: 'weekly'
day: 'friday'
time: '03:00'
timezone: Europe/London

6
.github/workflows/master.yml vendored
View File

@ -16,10 +16,10 @@ jobs:
pages: write pages: write
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v6 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set node version - name: Set node version
uses: actions/setup-node@v6 uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with: with:
node-version: 24 node-version: 24
registry-url: "https://registry.npmjs.org" registry-url: "https://registry.npmjs.org"
@ -56,7 +56,7 @@ jobs:
- name: Deploy to GitHub Pages - name: Deploy to GitHub Pages
if: success() && github.ref == 'refs/heads/master' if: success() && github.ref == 'refs/heads/master'
uses: crazy-max/ghaction-github-pages@v5 uses: crazy-max/ghaction-github-pages@1d6ee9b181a81033a16bd707a1401afa978daab4 # v5.0.0
with: with:
target_branch: gh-pages target_branch: gh-pages
build_dir: ./build/prod build_dir: ./build/prod

12
.github/workflows/pull_requests.yml vendored
View File

@ -12,10 +12,10 @@ jobs:
main: main:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v6 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set node version - name: Set node version
uses: actions/setup-node@v6 uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with: with:
node-version: 24 node-version: 24
registry-url: "https://registry.npmjs.org" registry-url: "https://registry.npmjs.org"
@ -39,7 +39,7 @@ jobs:
- name: Upload Build Artefact - name: Upload Build Artefact
if: success() if: success()
uses: actions/upload-artifact@v7 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with: with:
name: zipped-build name: zipped-build
path: build/prod/*.zip path: build/prod/*.zip
@ -53,14 +53,14 @@ jobs:
- name: Set up Docker Buildx - name: Set up Docker Buildx
if: success() if: success()
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- name: Set up QEMU - name: Set up QEMU
uses: docker/setup-qemu-action@v4 uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Production Image Build - name: Production Image Build
if: success() if: success()
id: build-image id: build-image
uses: docker/build-push-action@v6 uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with: with:
platforms: linux/amd64,linux/arm64,linux/arm/v7 platforms: linux/amd64,linux/arm64,linux/arm/v7

20
.github/workflows/releases.yml vendored
View File

@ -22,10 +22,10 @@ jobs:
contents: write contents: write
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v6 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set node version - name: Set node version
uses: actions/setup-node@v6 uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with: with:
node-version: 24 node-version: 24
registry-url: "https://registry.npmjs.org" registry-url: "https://registry.npmjs.org"
@ -52,14 +52,14 @@ jobs:
xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui
- name: Set up Docker Buildx - name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- name: Set up QEMU - name: Set up QEMU
uses: docker/setup-qemu-action@v4 uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Image Metadata - name: Image Metadata
id: image-metadata id: image-metadata
uses: docker/metadata-action@v6 uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
with: with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: | tags: |
@ -68,14 +68,14 @@ jobs:
type=semver,pattern={{version}} type=semver,pattern={{version}}
- name: Log in to GHCR - name: Log in to GHCR
uses: docker/login-action@v4 uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with: with:
registry: ${{ env.REGISTRY }} registry: ${{ env.REGISTRY }}
username: ${{ env.REGISTRY_USER }} username: ${{ env.REGISTRY_USER }}
password: ${{ env.REGISTRY_PASSWORD }} password: ${{ env.REGISTRY_PASSWORD }}
- name: Publish to GHCR - name: Publish to GHCR
uses: docker/build-push-action@v6 uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with: with:
context: . context: .
push: true push: true
@ -85,7 +85,7 @@ jobs:
- name: Upload Release Assets - name: Upload Release Assets
id: upload-release-assets id: upload-release-assets
uses: svenstaro/upload-release-action@v2 uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # v2
with: with:
repo_token: ${{ secrets.GITHUB_TOKEN }} repo_token: ${{ secrets.GITHUB_TOKEN }}
file: build/prod/*.zip file: build/prod/*.zip
@ -101,10 +101,10 @@ jobs:
needs: main needs: main
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v6 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set node version - name: Set node version
uses: actions/setup-node@v6 uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with: with:
node-version: 24 node-version: 24
registry-url: "https://registry.npmjs.org" registry-url: "https://registry.npmjs.org"

4
Dockerfile
View File

@ -4,7 +4,7 @@
# Modifier --platform=$BUILDPLATFORM limits the platform to "BUILDPLATFORM" during buildx multi-platform builds # Modifier --platform=$BUILDPLATFORM limits the platform to "BUILDPLATFORM" during buildx multi-platform builds
# This is because npm "chromedriver" package is not compatiable with all platforms # This is because npm "chromedriver" package is not compatiable with all platforms
# For more info see: https://docs.docker.com/build/building/multi-platform/#cross-compilation # For more info see: https://docs.docker.com/build/building/multi-platform/#cross-compilation
FROM --platform=$BUILDPLATFORM node:24-alpine AS builder FROM --platform=$BUILDPLATFORM node:24-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS builder
WORKDIR /app WORKDIR /app
@ -27,7 +27,7 @@ RUN npm run build
######################################### #########################################
# Package static build files into nginx # # Package static build files into nginx #
######################################### #########################################
FROM nginxinc/nginx-unprivileged:stable-alpine AS cyberchef FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:808f7846d21a9c94cf53833e8807a00a33fd0b65cc47fb05b79efe366c2d201f AS cyberchef
LABEL maintainer="GCHQ <oss@gchq.gov.uk>" LABEL maintainer="GCHQ <oss@gchq.gov.uk>"