Skip to content

ci: harden release workflows (SHA-pin actions, least-privilege token, TLS timestamper) #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
07souravkunda wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

ci: harden release workflows (SHA-pin actions, least-privilege token, TLS timestamper) #64

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
# Keeps the commit-SHA pins in .github/workflows/ maintained.
# Pinning actions to an immutable SHA (rather than a mutable tag) is what stops a
# compromised or re-pointed action tag from executing in the release job; Dependabot
# is what stops those pins from going stale.
version: 2
updates:
- package-ecosystem: "github-actions"

@07souravkunda 07souravkunda Aug 26, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nit] This config can't be scoped to cd.yml/ci.yml — worth knowing what its first run will actually produce.

The github-actions ecosystem only accepts directory: "/" and always scans everything under .github/workflows, so two consequences follow that the PR description doesn't anticipate:

1. It will propose the major bumps this PR deliberately left out. Dependabot offers the newest version, not the newest patch of the pinned major. Current latest upstream vs. what's pinned here:

action pinned latest
actions/checkout v2 v7.0.1
microsoft/setup-msbuild v1.0.2 v3
actions/setup-dotnet v3 v6.0.0
actions/setup-java v4 v6.0.0
actions/upload-artifact v4 v7.0.1

So the first weekly run opens major-version PRs (capped at the default 5 open), which is exactly the "functional change, belongs on its own merits" work the description defers. That may well be what you want — but if the intent was only "keep the pins fresh within the pinned major", add an ignore:

    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]

2. Two of those PRs will target Semgrep.yml, which the org-wide security-tools rollout owns (actions/checkout@v3.5.3 → v7, github/codeql-action/upload-sarif@v2.20.0 → v3+, since codeql-action v2 is retired). Bumping this repo's copy drifts it from the managed template and is liable to be reverted by the next rollout. There's no per-file scoping, so the options are an ignore on github/codeql-action or just closing those PRs knowingly.

Also worth recording so nobody assumes otherwise later: this won't refresh Semgrep.yml:30's image: returntocorp/semgrep:1.166.0 either. A job-level container: image: sits outside Dependabot's docker ecosystem (dependabot-core#5819), so the tag-not-digest residual noted on the chain ticket stays a manual item regardless of this file.

directory: "/"
schedule:
interval: "weekly"
commit-message:
prefix: "ci"
Comment on lines +7 to +12
16 changes: 11 additions & 5 deletions .github/workflows/cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,12 @@ name: .NET package CD

on: [workflow_dispatch]

# Least privilege: no step in this workflow writes to the repo,
# releases or packages via GITHUB_TOKEN (publishing uses NUGET_API_KEY,
# signing uses GCP_SA_KEY). Fail closed regardless of the org default.
permissions:
contents: read

defaults:
run:
working-directory: BrowserStackLocal
Expand All @@ -11,9 +17,9 @@ jobs:
runs-on: windows-latest

steps:
- uses: actions/checkout@v2
- uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
- name: Add msbuild to PATH
uses: microsoft/setup-msbuild@v1.0.2
uses: microsoft/setup-msbuild@c26a08ba26249b81327e26f6ef381897b6a8754d # v1.0.2
- name: Build BrowserStackLocal
run: |
msbuild BrowserStackLocal -t:restore -p:Configuration=Release
Expand All @@ -23,7 +29,7 @@ jobs:
msbuild BrowserStackLocalIntegrationTests -t:restore -p:Configuration=Release
msbuild BrowserStackLocalIntegrationTests -t:build -p:Configuration=Release
- name: Setup .NET Core
uses: actions/setup-dotnet@v3
uses: actions/setup-dotnet@55ec9447dda3d1cf6bd587150f3262f30ee10815 # v3
with:
dotnet-version: 6.0.x
- name: Setup GCP credentials
Expand All @@ -40,7 +46,7 @@ jobs:
run: python3 -m pip install google-auth requests
shell: bash
- name: Setup Java
uses: actions/setup-java@v4
uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
with:
distribution: 'temurin'
java-version: '17'
Expand All @@ -58,7 +64,7 @@ jobs:
./scripts/sign_nupkg.sh
shell: bash
- name: Save artifact
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: BrowserStackLocal.nupkg
path: .\BrowserStackLocal\BrowserStackLocal\bin\Release\*.nupkg
Expand Down
14 changes: 10 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,12 @@ name: .NET package CI

on: [workflow_dispatch]

# Least privilege: no step in this workflow writes to the repo,
# releases or packages via GITHUB_TOKEN (publishing uses NUGET_API_KEY,
# signing uses GCP_SA_KEY). Fail closed regardless of the org default.

@07souravkunda 07souravkunda Aug 26, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nit] This comment is copied verbatim from cd.yml, but ci.yml has no signing step and never references GCP_SA_KEY or NUGET_API_KEY — it stops at pack + upload-artifact. The permissions block is right; only the justification is borrowed. Something like "no step in this workflow uses GITHUB_TOKEN; fail closed regardless of the org default" would fit both files without naming secrets this one doesn't hold.

permissions:
contents: read

defaults:
run:
working-directory: BrowserStackLocal
Expand All @@ -11,9 +17,9 @@ jobs:
runs-on: windows-latest

steps:
- uses: actions/checkout@v2
- uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2

@07souravkunda 07souravkunda Aug 26, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[for-human] No workflow run has exercised this change — a human should decide whether to dispatch ci.yml on this branch before merge.

I re-verified independently everything that can be checked statically, and it all holds:

  • All five pins equal what their tags resolve to right now, in the correct upstream repos: actions/checkout@v2 → 0717577d, microsoft/setup-msbuild@v1.0.2 → c26a08ba, actions/setup-dotnet@v3 → 55ec9447, actions/setup-java@v4 → cf277c60, actions/upload-artifact@v4 → ea165f8d. No pin points at a fork or an unrelated commit, so the runner executes the same action code as before.
  • contents: read is sufficient: I read every step in both workflows and none of them consumes GITHUB_TOKEN — checkout needs contents: read; msbuild/dotnet/java setup make no API calls; sign_nupkg.sh uses GCP_SA_KEY; dotnet nuget push uses NUGET_API_KEY; upload-artifact@v4 uses the Actions runtime token. No job-level block widens it.
  • Nothing packaged changes: BrowserStackLocal.csproj:22 includes only MIT-LICENSE.txt as a non-code file, so nothing under .github/ or scripts/ reaches the nupkg.

What that leaves genuinely unverified: no step of either workflow has actually run. The reason given for not running one is right for cd.yml (it publishes to nuget.org), but ci.yml was dispatchable on this branch and is the one check that would confirm the pins resolve and the narrowed token is enough. Dispatching a workflow on a public repo is a human's call rather than the fix agent's, so it's surfaced here rather than blocked — but please treat it as the pre-merge step, not an optional extra:

gh workflow run ci.yml --repo browserstack/browserstack-local-csharp --ref locsec/WI-9a6a0fac

A failure in checkout / setup-msbuild / setup-dotnet / upload-artifact would mean a bad pin; a 403 or Resource not accessible by integration would mean contents: read is too narrow.

One thing ci.yml will not cover: it has no signing step, so --tsaurl https://timestamp.sectigo.com under jsign on the runner's JVM truststore is first exercised by the next real release. That is the right place to watch it (sign_nupkg.sh runs under set -e, so it fails closed rather than publishing an untimestamped package).

- name: Add msbuild to PATH
uses: microsoft/setup-msbuild@v1.0.2
uses: microsoft/setup-msbuild@c26a08ba26249b81327e26f6ef381897b6a8754d # v1.0.2
- name: Build BrowserStackLocal
run: |
msbuild BrowserStackLocal -t:restore -p:Configuration=Release
Expand All @@ -23,7 +29,7 @@ jobs:
msbuild BrowserStackLocalIntegrationTests -t:restore -p:Configuration=Release
msbuild BrowserStackLocalIntegrationTests -t:build -p:Configuration=Release
- name: Setup .NET Core
uses: actions/setup-dotnet@v3
uses: actions/setup-dotnet@55ec9447dda3d1cf6bd587150f3262f30ee10815 # v3
with:
dotnet-version: 6.0.x
- name: Run Integration Tests
Expand All @@ -34,7 +40,7 @@ jobs:
- name: Pack NuGet Package
run: msbuild BrowserStackLocal -t:pack -p:Configuration=Release
- name: Save artifact
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: BrowserStackLocal.nupkg
path: .\BrowserStackLocal\BrowserStackLocal\bin\Release\*.nupkg
2 changes: 1 addition & 1 deletion scripts/sign_nupkg.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ for NUPKG in BrowserStackLocal/BrowserStackLocal/bin/Release/*.nupkg; do
--keystore "projects/browserstack-production/locations/us-east1/keyRings/prod-comodo-win-cert-keyring" \
--alias "prod-comodo-win-cert-key/cryptoKeyVersions/1" \
--certfile comodo_signing_cert.crt \
--tsaurl http://timestamp.sectigo.com \
--tsaurl https://timestamp.sectigo.com \
"$NUPKG"
SIGNED_ANY=1
done
Expand Down
Loading