mirror of
https://github.com/PowerShell/PowerShell
synced 2026-06-08 12:12:50 +00:00
[StepSecurity] Apply security best practices (#21480)
* [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> * Update dependabot.yml * Delete tools/releaseBuild/Images/microsoft_powershell_centos7 directory * Delete tools/releaseBuild/Images/microsoft_powershell_ubuntu16.04 directory * Delete tools/releaseBuild/Images/microsoft_powershell_ubuntu18.04 directory * Delete tools/releaseBuild/Images/microsoft_powershell_windowsservercore/Dockerfile --------- Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: Travis Plunk <travis.plunk@microsoft.com>
This commit is contained in:
StepSecurity Bot
committed by
Aditya Patwardhan
Aditya Patwardhan
co-authored by
Travis Plunk
Travis Plunk
parent
7c5e3da9e6
commit
f570b03d09
@@ -3,7 +3,7 @@
|
||||
# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
|
||||
#-------------------------------------------------------------------------------------------------------------
|
||||
|
||||
FROM mcr.microsoft.com/powershell/test-deps:ubuntu-18.04
|
||||
FROM mcr.microsoft.com/powershell/test-deps:ubuntu-18.04@sha256:20154a16708d4a92ebe81393361f27c7567e6553869e89dd6abdd198cc8ba309
|
||||
|
||||
# Avoid warnings by switching to noninteractive
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
|
||||
#-------------------------------------------------------------------------------------------------------------
|
||||
|
||||
FROM mcr.microsoft.com/powershell:preview-fedora-30
|
||||
FROM mcr.microsoft.com/powershell:preview-fedora-30@sha256:f405d4d60f8d196532da75038c76c052084ef02121f8e2d3852080ff4a230a5a
|
||||
|
||||
# Configure apt and install packages
|
||||
RUN dnf install -y git procps wget findutils \
|
||||
|
||||
@@ -51,3 +51,17 @@ updates:
|
||||
interval: "daily"
|
||||
labels:
|
||||
- "CL-BuildPackaging"
|
||||
|
||||
- package-ecosystem: "github-actions"
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
labels:
|
||||
- "CL-BuildPackaging"
|
||||
|
||||
- package-ecosystem: docker
|
||||
directory: /
|
||||
schedule:
|
||||
interval: daily
|
||||
labels:
|
||||
- "CL-BuildPackaging"
|
||||
|
||||
@@ -30,13 +30,13 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v2
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
with:
|
||||
fetch-depth: '0'
|
||||
|
||||
# Initializes the CodeQL tools for scanning.
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@v1
|
||||
uses: github/codeql-action/init@df5a14dc28094dc936e103b37d749c6628682b60 # v3.25.0
|
||||
with:
|
||||
languages: ${{ matrix.language }}
|
||||
# If you wish to specify custom queries, you can do so here or in a config file.
|
||||
@@ -59,4 +59,4 @@ jobs:
|
||||
name: Build
|
||||
|
||||
- name: Perform CodeQL Analysis
|
||||
uses: github/codeql-action/analyze@v1
|
||||
uses: github/codeql-action/analyze@df5a14dc28094dc936e103b37d749c6628682b60 # v3.25.0
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
# Dependency Review Action
|
||||
#
|
||||
# This Action will scan dependency manifest files that change as part of a Pull Request,
|
||||
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
|
||||
# Once installed, if the workflow run is marked as required,
|
||||
# PRs introducing known-vulnerable packages will be blocked from merging.
|
||||
#
|
||||
# Source repository: https://github.com/actions/dependency-review-action
|
||||
name: 'Dependency Review'
|
||||
on: [pull_request]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
dependency-review:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: 'Checkout Repository'
|
||||
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
|
||||
- name: 'Dependency Review'
|
||||
uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1
|
||||
@@ -14,8 +14,8 @@ jobs:
|
||||
markdown-link-check:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@master
|
||||
- uses: gaurav-nelson/github-action-markdown-link-check@v1
|
||||
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1
|
||||
with:
|
||||
use-quiet-mode: 'yes'
|
||||
use-verbose-mode: 'yes'
|
||||
@@ -28,13 +28,13 @@ jobs:
|
||||
statuses: write
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
with:
|
||||
# Full git history is needed to get a proper
|
||||
# list of changed files within `super-linter`
|
||||
fetch-depth: 0
|
||||
- name: Lint Markdown
|
||||
uses: super-linter/super-linter@v5
|
||||
uses: super-linter/super-linter@a8150b40c89574adb5f68bf9502b890a236a06b3 # v5.7.2
|
||||
env:
|
||||
VALIDATE_ALL_CODEBASE: false
|
||||
DEFAULT_BRANCH: master
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# This cannot rebase workflow changes into a PR
|
||||
# It also only works if the GITHUB_TOKEN has permission to push to the branch
|
||||
# see: https://github.com/cirrus-actions/rebase/issues/12#issuecomment-632594995
|
||||
on:
|
||||
on:
|
||||
issue_comment:
|
||||
types: [created]
|
||||
name: Automatic Rebase
|
||||
@@ -12,10 +12,22 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout the latest code
|
||||
uses: actions/checkout@v2
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Post rebase started comment to pull request
|
||||
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
|
||||
continue-on-error: true
|
||||
with:
|
||||
script: |
|
||||
const backport_start_body = `Started rebase: https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${process.env.GITHUB_RUN_ID}`;
|
||||
await github.issues.createComment({
|
||||
issue_number: context.issue.number,
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
body: backport_start_body
|
||||
});
|
||||
- name: Automatic Rebase
|
||||
uses: cirrus-actions/rebase@1.4
|
||||
uses: cirrus-actions/rebase@b87d48154a87a85666003575337e27b8cd65f691 # 1.8
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
@@ -0,0 +1,71 @@
|
||||
# This workflow uses actions that are not certified by GitHub. They are provided
|
||||
# by a third-party and are governed by separate terms of service, privacy
|
||||
# policy, and support documentation.
|
||||
|
||||
name: Scorecard supply-chain security
|
||||
on:
|
||||
# For Branch-Protection check. Only the default branch is supported. See
|
||||
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
|
||||
branch_protection_rule:
|
||||
# To guarantee Maintained check is occasionally updated. See
|
||||
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
|
||||
schedule:
|
||||
- cron: '20 7 * * 2'
|
||||
push:
|
||||
branches: ["master"]
|
||||
|
||||
# Declare default permissions as read only.
|
||||
permissions: read-all
|
||||
|
||||
jobs:
|
||||
analysis:
|
||||
name: Scorecard analysis
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
# Needed to upload the results to code-scanning dashboard.
|
||||
security-events: write
|
||||
# Needed to publish results and get a badge (see publish_results below).
|
||||
id-token: write
|
||||
contents: read
|
||||
actions: read
|
||||
|
||||
steps:
|
||||
- name: "Checkout code"
|
||||
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: "Run analysis"
|
||||
uses: ossf/scorecard-action@99c53751e09b9529366343771cc321ec74e9bd3d # v2.0.6
|
||||
with:
|
||||
results_file: results.sarif
|
||||
results_format: sarif
|
||||
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
|
||||
# - you want to enable the Branch-Protection check on a *public* repository, or
|
||||
# - you are installing Scorecards on a *private* repository
|
||||
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
|
||||
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
|
||||
|
||||
# Public repositories:
|
||||
# - Publish results to OpenSSF REST API for easy access by consumers
|
||||
# - Allows the repository to include the Scorecard badge.
|
||||
# - See https://github.com/ossf/scorecard-action#publishing-results.
|
||||
# For private repositories:
|
||||
# - `publish_results` will always be set to `false`, regardless
|
||||
# of the value entered here.
|
||||
publish_results: true
|
||||
|
||||
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
|
||||
# format to the repository Actions tab.
|
||||
- name: "Upload artifact"
|
||||
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
|
||||
with:
|
||||
name: SARIF file
|
||||
path: results.sarif
|
||||
retention-days: 5
|
||||
|
||||
# Upload the results to GitHub's code scanning dashboard.
|
||||
- name: "Upload to code-scanning"
|
||||
uses: github/codeql-action/upload-sarif@f72882a05ba58122a44b17f2fce8fb50e5c79a59 # v2.25.0
|
||||
with:
|
||||
sarif_file: results.sarif
|
||||
@@ -1,5 +1,5 @@
|
||||
# escape=`
|
||||
FROM mcr.microsoft.com/windows/servercore:ltsc2022
|
||||
FROM mcr.microsoft.com/windows/servercore:ltsc2022@sha256:5d09ffa90d91a46e2fe7652b0a37cbf5217f34a819c3d71cbe635dae8226061b
|
||||
|
||||
SHELL ["pwsh.exe","-command"]
|
||||
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
# Docker image file that describes an Centos7 image with PowerShell installed from Microsoft YUM Repo
|
||||
|
||||
FROM mcr.microsoft.com/powershell:centos-7
|
||||
LABEL maintainer="PowerShell Team <powershellteam@hotmail.com>"
|
||||
|
||||
# Install dependencies and clean up
|
||||
RUN yum install -y \
|
||||
glibc \
|
||||
libcurl \
|
||||
ca-certificates \
|
||||
libgcc \
|
||||
libicu \
|
||||
openssl \
|
||||
libstdc++ \
|
||||
ncurses-base \
|
||||
libunwind \
|
||||
uuid \
|
||||
zlib \
|
||||
which \
|
||||
curl \
|
||||
git \
|
||||
wget \
|
||||
&& yum clean all
|
||||
|
||||
COPY PowerShellPackage.ps1 /
|
||||
|
||||
ENV DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
|
||||
|
||||
# Use PowerShell as the default shell
|
||||
ENTRYPOINT [ "pwsh" ]
|
||||
@@ -1,37 +0,0 @@
|
||||
# Docker image file that describes an Ubuntu16.04 image with PowerShell installed from Microsoft APT Repo
|
||||
|
||||
FROM mcr.microsoft.com/powershell:ubuntu-16.04
|
||||
LABEL maintainer="PowerShell Team <powershellteam@hotmail.com>"
|
||||
|
||||
# Install dependencies and clean up
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
apt-utils \
|
||||
apt-utils \
|
||||
libc6 \
|
||||
libcurl3 \
|
||||
ca-certificates \
|
||||
libgcc1 \
|
||||
libicu55 \
|
||||
libssl1.0.0 \
|
||||
libstdc++6 \
|
||||
libtinfo5 \
|
||||
libunwind8 \
|
||||
libuuid1 \
|
||||
libcroco3 \
|
||||
libgraphite2-3 \
|
||||
zlib1g \
|
||||
curl \
|
||||
git \
|
||||
apt-transport-https \
|
||||
locales \
|
||||
wget \
|
||||
&& apt-get clean \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
COPY PowerShellPackage.ps1 /
|
||||
|
||||
ENV DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
|
||||
|
||||
# Use PowerShell as the default shell
|
||||
ENTRYPOINT [ "pwsh" ]
|
||||
@@ -1,37 +0,0 @@
|
||||
# Docker image file that describes an Ubuntu16.04 image with PowerShell installed from Microsoft APT Repo
|
||||
|
||||
FROM mcr.microsoft.com/powershell:ubuntu-18.04
|
||||
LABEL maintainer="PowerShell Team <powershellteam@hotmail.com>"
|
||||
|
||||
# Install dependencies and clean up
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
apt-utils \
|
||||
apt-utils \
|
||||
libc6 \
|
||||
libcurl4 \
|
||||
ca-certificates \
|
||||
libgcc1 \
|
||||
libicu60 \
|
||||
libssl1.0.0 \
|
||||
libstdc++6 \
|
||||
libtinfo5 \
|
||||
libunwind8 \
|
||||
libuuid1 \
|
||||
libcroco3 \
|
||||
libgraphite2-3 \
|
||||
zlib1g \
|
||||
curl \
|
||||
git \
|
||||
apt-transport-https \
|
||||
locales \
|
||||
wget \
|
||||
&& apt-get clean \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
COPY PowerShellPackage.ps1 /
|
||||
|
||||
ENV DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
|
||||
|
||||
# Use PowerShell as the default shell
|
||||
ENTRYPOINT [ "pwsh" ]
|
||||
@@ -1,30 +0,0 @@
|
||||
# escape=`
|
||||
#0.3.6 (no powershell 6)
|
||||
FROM mcr.microsoft.com/powershell:windowsservercore
|
||||
LABEL maintainer='PowerShell Team <powershellteam@hotmail.com>'
|
||||
LABEL description="This Dockerfile for Windows Server Core with git installed via chocolatey."
|
||||
|
||||
SHELL ["C:\\Program Files\\PowerShell\\latest\\pwsh.exe", "-command"]
|
||||
# Install Git, and NuGet
|
||||
# Git installs to C:\Program Files\Git
|
||||
# nuget installs to C:\ProgramData\chocolatey\bin\NuGet.exe
|
||||
COPY dockerInstall.psm1 containerFiles/dockerInstall.psm1
|
||||
RUN Import-Module ./containerFiles/dockerInstall.psm1; `
|
||||
Install-ChocolateyPackage -PackageName git -Executable git.exe; `
|
||||
Install-ChocolateyPackage -PackageName nuget.commandline -Executable nuget.exe -Cleanup
|
||||
|
||||
# Install WIX
|
||||
ADD https://github.com/wixtoolset/wix3/releases/download/wix311rtm/wix311-binaries.zip /wix.zip
|
||||
COPY wix.psm1 containerFiles/wix.psm1
|
||||
RUN Import-Module ./containerFiles/wix.psm1; `
|
||||
Install-WixZip -zipPath \wix.Zip
|
||||
|
||||
# Install makeappx and makepri
|
||||
ADD https://pscoretestdata.blob.core.windows.net/build-files/makeappx/makeappx.zip?sp=r&st=2019-04-05T18:02:52Z&se=2020-04-06T02:02:52Z&spr=https&sv=2018-03-28&sig=t07uC1K3uFLtINQsmorHobgPh%2B%2BBgjFnmHEJGNZT6Hk%3D&sr=b /makeappx.zip
|
||||
RUN Expand-Archive /makeappx.zip
|
||||
|
||||
COPY PowerShellPackage.ps1 /
|
||||
|
||||
ENV DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
|
||||
|
||||
ENTRYPOINT ["C:\\Program Files\\PowerShell\\latest\\pwsh.exe", "-command"]
|
||||
Reference in New Issue
Block a user