GitHub - octo-sts/app: A GitHub App that acts like a Security Token Service (STS) for the Github API
pull_request_target 㧠GitHub Actions ã®æ”¹ç«„を防ã
本記事ã§ã¯ GitHub Actions 㧠pull_request event ã®ä»£ã‚ã‚Šã« pull_request_target を用ã„〠workflow ã®æ”¹ç«„を防ã„ã§ã‚ˆã‚Šå®‰å…¨ã« CI を実行ã™ã‚‹æ–¹æ³•ã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ ã¾ãšã¯å‰ç½®ãã¨ã—ã¦èƒŒæ™¯ã‚„解決ã—ãŸã„ã‚»ã‚ュリティ的ãªèª²é¡Œã«ã¤ã„ã¦èª¬æ˜Žã—ãŸå¾Œã€ pull_request_target を用ã„ãŸå®‰å…¨ãª CI ã®å®Ÿè¡Œã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ 本記事ã§ã¯ OSS 開発ã¨ã¯é•ã„æ¥å‹™ã§ private repository を用ã„ã¦è¤‡æ•°äººã§é–‹ç™ºã‚’è¡Œã†ã“ã¨ã‚’å‰æã«ã—ã¾ã™ã€‚ é•·ã„ã®ã§è¦ç´„ GitHub Actions 㧠Workflow ã®æ”¹ç«„を防ãŽãŸã„ GitHub ã® branch protection rule ã‚„ codeowner, OIDC ã ã‘ã§ã¯ä¸å分ãªã‚±ãƒ¼ã‚¹ã‚‚ã‚ã‚‹ pull_request event ã®ä»£ã‚ã‚Šã« pull_r
GitHub Actions could be so much better
ENOSUCHBLOG Programming, philosophy, pedaling. Home Tags Series Favorites Archive Main Site TILs GitHub Actions could be so much better Sep 22, 2023 Tags: programming, rant, security, workflow I love GitHub Actions: I’ve been a daily user of it since 2019 for both professional and hobbyist projects, and have found it invaluable to both my overall productivity and peace of mind. I’m just old enough
GitHub - GitHubSecurityLab/actions-permissions: GitHub token permissions Monitor and Advisor actions
社内用GitHub Actionsã®ã‚»ã‚ュリティガイドラインを公開ã—ã¾ã™ | メルカリエンジニアリング
ã“ã®è¨˜äº‹ã¯ã€Merpay Tech Openness Month 2023 ã®4日目ã®è¨˜äº‹ã§ã™ã€‚ ã“ã‚“ã«ã¡ã¯ã€‚メルコインã®ãƒãƒƒã‚¯ã‚¨ãƒ³ãƒ‰ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®@goroã§ã™ã€‚ ã¯ã˜ã‚ã« ã“ã®GitHub Actionsã®ã‚»ã‚ュリティガイドラインã¯ã€ç¤¾å†…ã§Github Actionsã®åˆ©ç”¨ã«å…ˆé§†ã‘ã€ç¤¾å†…有志ã«ã‚ˆã£ã¦æ¤œè¨Žã•ã‚Œã¾ã—ãŸã€‚「GitHub Actionsを使ã†ã«ã‚ãŸã‚Šã©ã†ã„ã£ãŸç‚¹ã«ç•™æ„ã™ã‚Œã°æœ€ä½Žé™ã®å®‰å…¨æ€§ã‚’確ä¿ã§ãã‚‹ã‹å¦ç¿’ã—ã¦ã‚‚らã„ãŸã„ã€ã€Œå®šæœŸçš„ã«æœ¬ãƒ‰ã‚ュメントを見返ã—ã¦ã‚‚らã„自分ãŸã¡ã®ãƒªãƒã‚¸ãƒˆãƒªãƒ¼ãŒå®‰å…¨ãªçŠ¶æ…‹ã«ãªã£ã¦ã„ã‚‹ã‹ç‚¹æ¤œã™ã‚‹éš›ã«å½¹ç«‹ã¦ã¦ã‚‚らã„ãŸã„ã€ã¨ã„ã†æ€ã„ã«åŸºã¥ã„ã¦ä½œæˆã•ã‚Œã¦ã„ã¾ã™ã€‚ 今回ã¯ãã‚“ãªã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã®ä¸€éƒ¨ã‚’ã€ç¤¾å¤–ã®æ–¹ã€…ã«ã‚‚役立ã¤ã¨æ€ã„公開ã™ã‚‹ã“ã¨ã«ã—ã¾ã—ãŸã€‚ ガイドラインã«ãŠã‘る目標 ã“ã®ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã¯äº‹å‰ã«2段階ã®ç›®æ¨™ã‚’è¨å®šã—ã¦ä½œæˆã•ã‚Œã¦ã„ã¾ã™ã€‚ã¾ãšç¬¬1ã«ã€Œå¸¸ã«é”æˆã—ãŸã„ã“ã¨
å…±åŒé–‹ç™ºã‚’始ã‚ã‚‹ã¨ãã«ä¾¿åˆ©ãª 5 ã¤ã® GitHub Actions
ã¯ã˜ã‚㫠スタートアップç‰ã«ãŠã„ã¦æ–°ã—ã„プãƒãƒ€ã‚¯ãƒˆã‚’始ã‚る時ã¯ã€è² 債ãŒç„¡ã„代ã‚ã‚Šã«ä½•ã‚‚ã‚ã‚Šã¾ã›ã‚“。 ãã†ã„ã£ãŸæ™‚ã«ã€ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã®å“質を担ä¿ã™ã‚‹ãŸã‚ã® CI ã®ã‚»ãƒƒãƒˆã‚¢ãƒƒãƒ—ãŒã€åˆæœŸã‹ã‚‰é‡è¦ã«ãªã£ã¦ãã¾ã™ã€‚ GitHub を使用ã—ã¦ã„ã‚‹å ´åˆã¯ã€GitHub Actions を使用ã•ã‚Œã‚‹ã“ã¨ãŒæ®†ã©ã ã¨æ€ã†ã®ã§ã€ãã¡ã‚‰ã‚’å‰æã«é€²ã‚ã¦ã„ããŸã„ã¨æ€ã„ã¾ã™ã€‚ 1. rhysd/actionlint 様々ãªã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒ action ã‚’è¿½åŠ ã—ãŸã‚Šã€ç·¨é›†ã—ãŸã‚Šã™ã‚‹ã‚ˆã†ã«ãªã£ãŸæ™‚ã€å…¨å“¡ãŒæ£ã—ã„書ãæ–¹ã§æ›¸ã„ã¦ã„ãã“ã¨ã¯é›£ã—ã„ã§ã™ã€‚ ã¾ãŸã€ãれを 1 人㮠GitHub Actions Expert ãŒãƒ¬ãƒ“ューã—ã¦ã„ãã®ã¯å¤§å¤‰ã§ã€å±žäººåŒ–ã—ã¦ã—ã¾ã£ã¦ã„ã‚‹ã®ã§ã€é¿ã‘ã‚‹æ–¹ãŒæœ›ã¾ã—ã„ã§ã™ã€‚ 以下をコピペã™ã‚Œã°ã€ä½¿ç”¨ã§ãã¾ã™ã€‚ name: Actionlint on: push: branches: [ main ] p
advisories/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md at master · justinsteven/advisories
The check-spelling GitHub Actions community workflow is a spell checker for GitHub commits. When the workflow is enabled on a given repository, it is activated whenever a Pull Request is made to that repo. The workflow checks the spelling according to a configuration defined by the repo, and submits a Pull Request comment showing the details of any spelling errors. For a repo configured to use the
GitHub Actionsã®`permissions`を自動ã§è¨å®šã™ã‚‹ãƒ„ールを書ã„ãŸ
GitHub Actionsã«ã¯permissionsã¨ã„ã†ãƒ•ã‚£ãƒ¼ãƒ«ãƒ‰ãŒã‚ã‚Šã€ãã‚Œãžã‚Œã®Workflow/Jobã§ã®secrets.GITHUB_TOKENã®æ¨©é™ã‚’è¨å®šã§ãるよã†ã«ãªã£ã¦ã„ã¾ã™ã€‚ secrets.GITHUB_TOKENã¯GitHub Actionsã®å®Ÿè¡Œã”ã¨ã«ç™ºè¡Œã•ã‚Œã‚‹GitHubã®Tokenã§ã€å¤šãã®GitHub Actionsã¯ã“ã®ãƒˆãƒ¼ã‚¯ãƒ³ã‚’使ã£ã¦ãƒªãƒã‚¸ãƒˆãƒªã‚’git cloneã—ãŸã‚Šã€Issueã«ã‚³ãƒ¡ãƒ³ãƒˆã‚’書ã„ãŸã‚Šã—ã¦ã„ã¾ã™ã€‚ GitHub Actions: Control permissions for GITHUB_TOKEN | GitHub Changelog Workflow syntax for GitHub Actions - GitHub Docs ã“ã®permissionsã‚’ã¡ã‚ƒã‚“ã¨è¨å®šã™ã‚‹ã“ã¨ã§ã‚µãƒ—ライãƒã‚§ãƒ¼ãƒ³æ”»æ’ƒãªã©ã®å½±éŸ¿ã‚’軽減ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™
Redirecting…
Redirecting… Click here if you are not redirected.
VSCodeã®GitHubリãƒã‚¸ãƒˆãƒªã«å¯¾ã™ã‚‹ä¸æ£ãªPushアクセス
ã¯ã˜ã‚ã«Microsoftã¯è„†å¼±æ€§ã®è¨ºæ–行為をセーフãƒãƒ¼ãƒãƒ¼ã«ã‚ˆã‚Šè¨±å¯ã—ã¦ã„ã¾ã™ã€‚ 本記事ã¯ã€ãã®ã‚»ãƒ¼ãƒ•ãƒãƒ¼ãƒãƒ¼ã‚’éµå®ˆã—ãŸä¸Šã§ç™ºè¦‹/å ±å‘Šã—ãŸè„†å¼±æ€§ã‚’解説ã—ãŸã‚‚ã®ã§ã‚ã‚Šã€ç„¡è¨±å¯ã®è„†å¼±æ€§è¨ºæ–行為を推奨ã™ã‚‹äº‹ã‚’æ„図ã—ãŸã‚‚ã®ã§ã¯ã‚ã‚Šã¾ã›ã‚“。 MicrosoftãŒé‹å–¶/æä¾›ã™ã‚‹ã‚µãƒ¼ãƒ“スã«è„†å¼±æ€§ã‚’発見ã—ãŸå ´åˆã¯ã€Microsoft Bug Bounty Programã¸å ±å‘Šã—ã¦ãã ã•ã„。 è¦ç´„VSCodeã®Issue管ç†æ©Ÿèƒ½ã«è„†å¼±æ€§ãŒå˜åœ¨ã—ã€ä¸é©åˆ‡ãªæ£è¦è¡¨ç¾ã€èªè¨¼ã®æ¬ 如ã€ã‚³ãƒžãƒ³ãƒ‰ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’組ã¿åˆã‚ã›ã‚‹ã“ã¨ã«ã‚ˆã‚ŠVSCodeã®GitHubリãƒã‚¸ãƒˆãƒªã«å¯¾ã™ã‚‹ä¸æ£ãªæ›¸ãè¾¼ã¿ãŒå¯èƒ½ã ã£ãŸã€‚ 発見ã®ãã£ã‹ã‘電車ã«ä¹—ã£ã¦ã„ã‚‹éš›ã«ãµã¨æ€ã„ç«‹ã£ã¦microsoft/vscodeを眺ã‚ã¦ã„ãŸæ‰€ã€CI用ã®ã‚¹ã‚¯ãƒªãƒ—トãŒåˆ¥ã®ãƒªãƒã‚¸ãƒˆãƒª(microsoft/vscode-github-triage-actions)ã«ã¾
Redirecting…
Redirecting… Click here if you are not redirected.
GitHub Actions ã® self-hosted runner 㨠Amazon EKS を使ã£ãŸ Docker ã® Build Pipeline/Build Pipeline for Docker with GitHub Actions self-hosted runner and Amazon EKS
Kubernetes Meetup Tokyo #32 on 7/28 発表資料
How to safely use GitHub Actions in organizations - Human Who Codes
GitHub Actions1 are programs designed to run inside of workflows2, triggered by specific events inside a GitHub repository. To date, people use GitHub Actions to do things like run continuous integration (CI) tests, publish releases, respond to issues, and more. Because the workflows are executed inside a fresh virtual machine that is deleted after the workflow completes, there isn’t much risk of
Use GitHub actions at your own risk
It all started with a tweet that I made mid december: Am I the only one scared about sharing my access tokens to random @github actions found on the marketplace ? What if one day those random-action@master stored my tokens ? Wouldn't it be as easy as taking control as maintainer of an old action that everybody uses ? — Julien Renaux (@julienrenaux) December 12, 2019 I had a hunch that using Github
1
ãŠçŸ¥ã‚‰ã›
ランã‚ング
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
The end of GitHub PATs: You can’t leak what you don’t have
GitHub - step-security/secure-repo: Orchestrate GitHub Actions Security
{{#tags}}- {{label}}
{{/tags}}