62 lines
2.0 KiB
Python
Executable File
62 lines
2.0 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
|
|
from pathlib import Path
|
|
import unittest
|
|
|
|
from check_workflow_security import check_workflow
|
|
|
|
|
|
SAFE_SHA = "a" * 40
|
|
|
|
|
|
class WorkflowSecurityTests(unittest.TestCase):
|
|
def check(self, text: str) -> list[str]:
|
|
return check_workflow(Path(".github/workflows/test.yml"), text)
|
|
|
|
def test_accepts_read_only_pull_request_workflow_with_pinned_action(self) -> None:
|
|
errors = self.check(
|
|
f"""name: Test
|
|
on:
|
|
pull_request:
|
|
jobs:
|
|
test:
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@{SAFE_SHA} # v7
|
|
with:
|
|
persist-credentials: false
|
|
"""
|
|
)
|
|
self.assertEqual(errors, [])
|
|
|
|
def test_rejects_mutable_action_reference(self) -> None:
|
|
errors = self.check("jobs:\n test:\n steps:\n - uses: actions/checkout@v7\n")
|
|
self.assertTrue(any("full commit SHA" in error for error in errors))
|
|
|
|
def test_rejects_secrets_in_pull_request_workflow(self) -> None:
|
|
errors = self.check(
|
|
"on:\n pull_request:\njobs:\n test:\n env:\n TOKEN: ${{ secrets.TOKEN }}\n"
|
|
)
|
|
self.assertTrue(any("must not reference repository secrets" in error for error in errors))
|
|
|
|
def test_rejects_write_permission_in_pull_request_workflow(self) -> None:
|
|
errors = self.check(
|
|
"on:\n pull_request:\njobs:\n test:\n permissions:\n contents: write\n"
|
|
)
|
|
self.assertTrue(any("must not request write permissions" in error for error in errors))
|
|
|
|
def test_rejects_privileged_untrusted_trigger(self) -> None:
|
|
errors = self.check("on:\n pull_request_target:\n")
|
|
self.assertTrue(any("unaudited privileged trigger" in error for error in errors))
|
|
|
|
def test_rejects_mutable_raw_github_download(self) -> None:
|
|
errors = self.check(
|
|
"jobs:\n test:\n steps:\n - run: curl https://raw.githubusercontent.com/o/r/main/tool.sh\n"
|
|
)
|
|
self.assertTrue(any("immutable commit" in error for error in errors))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|