Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 23:30 UTC
chore: apply security best practices for CI (#7066)
* chore: apply security best practices for CI Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * remove redundant codeql job Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * run scorecard flow on PRs Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
Mohammed Al Sahaf committed
Jun 16, 2025 at 23:14 UTC
2f0fc62b34b93f262d94724165eafde657f9adc0
8 files changed
+117
-26
.github/dependabot.yml
+5
@@ -5,3 +5,8 @@ updates:
5
directory: "/"
6
schedule:
7
interval: "monthly"
8
+
9
+ - package-ecosystem: gomod
10
+ directory: /
11
+ schedule:
12
+ interval: weekly
.github/workflows/ci.yml
+27
-8
@@ -16,6 +16,9 @@ env:
16
# https://github.com/actions/setup-go/issues/491
17
GOTOOLCHAIN: local
18
19
+permissions:
20
+ contents: read
21
+
22
jobs:
23
test:
24
strategy:
@@ -60,11 +63,16 @@ jobs:
63
pull-requests: read
64
actions: write # to allow uploading artifacts and cache
65
steps:
66
+ - name: Harden the runner (Audit all outbound calls)
67
+ uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
68
+ with:
69
+ egress-policy: audit
70
+
71
- name: Checkout code
64
- uses: actions/checkout@v4
72
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
73
74
- name: Install Go
67
- uses: actions/setup-go@v5
75
+ uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
76
with:
77
go-version: ${{ matrix.GO_SEMVER }}
78
check-latest: true
@@ -111,7 +119,7 @@ jobs:
119
./caddy stop
120
121
- name: Publish Build Artifact
114
- uses: actions/upload-artifact@v4
122
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
123
with:
124
name: caddy_${{ runner.os }}_go${{ matrix.go }}_${{ steps.vars.outputs.short_sha }}
125
path: ${{ matrix.CADDY_BIN_PATH }}
@@ -152,8 +160,14 @@ jobs:
160
if: github.event.pull_request.head.repo.full_name == 'caddyserver/caddy' && github.actor != 'dependabot[bot]'
161
continue-on-error: true # August 2020: s390x VM is down due to weather and power issues
162
steps:
163
+ - name: Harden the runner (Audit all outbound calls)
164
+ uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
165
+ with:
166
+ egress-policy: audit
167
+ allowed-endpoints: ci-s390x.caddyserver.com:22
168
+
169
- name: Checkout code
156
- uses: actions/checkout@v4
170
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
171
- name: Run Tests
172
run: |
173
set +e
@@ -205,15 +219,20 @@ jobs:
219
pull-requests: read
220
if: github.event.pull_request.head.repo.full_name == 'caddyserver/caddy' && github.actor != 'dependabot[bot]'
221
steps:
222
+ - name: Harden the runner (Audit all outbound calls)
223
+ uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
224
+ with:
225
+ egress-policy: audit
226
+
227
- name: Checkout code
209
- uses: actions/checkout@v4
228
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
229
211
- - uses: goreleaser/goreleaser-action@v6
230
+ - uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
231
with:
232
version: latest
233
args: check
234
- name: Install Go
216
- uses: actions/setup-go@v5
235
+ uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
236
with:
237
go-version: "~1.24"
238
check-latest: true
@@ -221,7 +240,7 @@ jobs:
240
run: |
241
go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
242
xcaddy version
224
- - uses: goreleaser/goreleaser-action@v6
243
+ - uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
244
with:
245
version: latest
246
args: build --single-target --snapshot
.github/workflows/cross-build.yml
+10
-2
@@ -14,6 +14,9 @@ env:
14
# https://github.com/actions/setup-go/issues/491
15
GOTOOLCHAIN: local
16
17
+permissions:
18
+ contents: read
19
+
20
jobs:
21
build:
22
strategy:
@@ -45,11 +48,16 @@ jobs:
48
pull-requests: read
49
continue-on-error: true
50
steps:
51
+ - name: Harden the runner (Audit all outbound calls)
52
+ uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
53
+ with:
54
+ egress-policy: audit
55
+
56
- name: Checkout code
49
- uses: actions/checkout@v4
57
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
58
59
- name: Install Go
52
- uses: actions/setup-go@v5
60
+ uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
61
with:
62
go-version: ${{ matrix.GO_SEMVER }}
63
check-latest: true
.github/workflows/lint.yml
+21
-6
@@ -44,14 +44,19 @@ jobs:
44
runs-on: ${{ matrix.OS_LABEL }}
45
46
steps:
47
- - uses: actions/checkout@v4
48
- - uses: actions/setup-go@v5
47
+ - name: Harden the runner (Audit all outbound calls)
48
+ uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
49
+ with:
50
+ egress-policy: audit
51
+
52
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
53
+ - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
54
with:
55
go-version: '~1.24'
56
check-latest: true
57
58
- name: golangci-lint
54
- uses: golangci/golangci-lint-action@v8
59
+ uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
60
with:
61
version: latest
62
@@ -67,8 +72,13 @@ jobs:
72
pull-requests: read
73
runs-on: ubuntu-latest
74
steps:
75
+ - name: Harden the runner (Audit all outbound calls)
76
+ uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
77
+ with:
78
+ egress-policy: audit
79
+
80
- name: govulncheck
71
- uses: golang/govulncheck-action@v1
81
+ uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
82
with:
83
go-version-input: '~1.24.1'
84
check-latest: true
@@ -79,10 +89,15 @@ jobs:
89
contents: read
90
pull-requests: write
91
steps:
92
+ - name: Harden the runner (Audit all outbound calls)
93
+ uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
94
+ with:
95
+ egress-policy: audit
96
+
97
- name: 'Checkout Repository'
83
- uses: actions/checkout@v4
98
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
99
- name: 'Dependency Review'
85
- uses: actions/dependency-review-action@v4
100
+ uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1
101
with:
102
comment-summary-in-pr: on-failure
103
# https://github.com/actions/dependency-review-action/issues/430#issuecomment-1468975566
.github/workflows/release.yml
+14
-6
@@ -9,6 +9,9 @@ env:
9
# https://github.com/actions/setup-go/issues/491
10
GOTOOLCHAIN: local
11
12
+permissions:
13
+ contents: read
14
+
15
jobs:
16
release:
17
name: Release
@@ -35,19 +38,24 @@ jobs:
38
contents: write
39
40
steps:
41
+ - name: Harden the runner (Audit all outbound calls)
42
+ uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
43
+ with:
44
+ egress-policy: audit
45
+
46
- name: Checkout code
39
- uses: actions/checkout@v4
47
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
48
with:
49
fetch-depth: 0
50
51
- name: Install Go
44
- uses: actions/setup-go@v5
52
+ uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
53
with:
54
go-version: ${{ matrix.GO_SEMVER }}
55
check-latest: true
56
57
# Force fetch upstream tags -- because 65 minutes
50
- # tl;dr: actions/checkout@v4 runs this line:
58
+ # tl;dr: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 runs this line:
59
# git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +ebc278ec98bb24f2852b61fde2a9bf2e3d83818b:refs/tags/
60
# which makes its own local lightweight tag, losing all the annotations in the process. Our earlier script ran:
61
# git fetch --prune --unshallow
@@ -101,11 +109,11 @@ jobs:
109
git verify-tag "${{ steps.vars.outputs.version_tag }}" || exit 1
110
111
- name: Install Cosign
104
- uses: sigstore/cosign-installer@main
112
+ uses: sigstore/cosign-installer@e9a05e6d32d7ed22b5656cd874ef31af58d05bfa # main
113
- name: Cosign version
114
run: cosign version
115
- name: Install Syft
108
- uses: anchore/sbom-action/download-syft@main
116
+ uses: anchore/sbom-action/download-syft@9246b90769f852b3a8921f330c59e0b3f439d6e9 # main
117
- name: Syft version
118
run: syft version
119
- name: Install xcaddy
@@ -114,7 +122,7 @@ jobs:
122
xcaddy version
123
# GoReleaser will take care of publishing those artifacts into the release
124
- name: Run GoReleaser
117
- uses: goreleaser/goreleaser-action@v6
125
+ uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
126
with:
127
version: latest
128
args: release --clean --timeout 60m
.github/workflows/release_published.yml
+10
-2
@@ -5,6 +5,9 @@ on:
5
release:
6
types: [published]
7
8
+permissions:
9
+ contents: read
10
+
11
jobs:
12
release:
13
name: Release Published
@@ -20,8 +23,13 @@ jobs:
23
steps:
24
25
# See https://github.com/peter-evans/repository-dispatch
26
+ - name: Harden the runner (Audit all outbound calls)
27
+ uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
28
+ with:
29
+ egress-policy: audit
30
+
31
- name: Trigger event on caddyserver/dist
24
- uses: peter-evans/repository-dispatch@v3
32
+ uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
33
with:
34
token: ${{ secrets.REPO_DISPATCH_TOKEN }}
35
repository: caddyserver/dist
@@ -29,7 +37,7 @@ jobs:
37
client-payload: '{"tag": "${{ github.event.release.tag_name }}"}'
38
39
- name: Trigger event on caddyserver/caddy-docker
32
- uses: peter-evans/repository-dispatch@v3
40
+ uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
41
with:
42
token: ${{ secrets.REPO_DISPATCH_TOKEN }}
43
repository: caddyserver/caddy-docker
.github/workflows/scorecard.yml
+10
-2
@@ -12,7 +12,10 @@ on:
12
schedule:
13
- cron: '20 2 * * 5'
14
push:
15
- branches: [ "master" ]
15
+ branches: [ "master", "2.*" ]
16
+ pull_request:
17
+ branches: [ "master", "2.*" ]
18
+
19
20
# Declare default permissions as read only.
21
permissions: read-all
@@ -33,6 +36,11 @@ jobs:
36
# actions: read
37
38
steps:
39
+ - name: Harden the runner (Audit all outbound calls)
40
+ uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
41
+ with:
42
+ egress-policy: audit
43
+
44
- name: "Checkout code"
45
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
46
with:
@@ -73,6 +81,6 @@ jobs:
81
# Upload the results to GitHub's code scanning dashboard (optional).
82
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
83
- name: "Upload to code-scanning"
76
- uses: github/codeql-action/upload-sarif@v3
84
+ uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
85
with:
86
sarif_file: results.sarif
.pre-commit-config.yaml
new
+20
@@ -0,0 +1,20 @@
1
+repos:
2
+- repo: https://github.com/gitleaks/gitleaks
3
+ rev: v8.16.3
4
+ hooks:
5
+ - id: gitleaks
6
+- repo: https://github.com/golangci/golangci-lint
7
+ rev: v1.52.2
8
+ hooks:
9
+ - id: golangci-lint-config-verify
10
+ - id: golangci-lint
11
+ - id: golangci-lint-fmt
12
+- repo: https://github.com/jumanjihouse/pre-commit-hooks
13
+ rev: 3.0.0
14
+ hooks:
15
+ - id: shellcheck
16
+- repo: https://github.com/pre-commit/pre-commit-hooks
17
+ rev: v4.4.0
18
+ hooks:
19
+ - id: end-of-file-fixer
20
+ - id: trailing-whitespace