diff --git a/.github/actions/sast-external-issues/action.yml b/.github/actions/sast-external-issues/action.yml index 0d17757..e93601b 100644 --- a/.github/actions/sast-external-issues/action.yml +++ b/.github/actions/sast-external-issues/action.yml @@ -24,10 +24,18 @@ inputs: description: 'Pinned OpenGrep release version.' required: false default: '1.9.0' + opengrep-sha256: + description: 'SHA256 of the opengrep_manylinux_x86 asset for opengrep-version.' + required: false + default: '57a5a7fcc2df876e02f606fd86841078ee6f15c7deb115a7929228c3eaa99273' gitleaks-version: description: 'Pinned gitleaks release version (kept in sync with reusable-security-scan).' required: false default: '8.21.2' + gitleaks-sha256: + description: 'SHA256 of the gitleaks__linux_x64.tar.gz asset for gitleaks-version.' + required: false + default: '5bc41815076e6ed6ef8fbecc9d9b75bcae31f39029ceb55da08086315316e3ba' output-file: description: 'Report path, relative to working-directory, for the generic issue JSON.' required: false @@ -45,14 +53,19 @@ runs: shell: bash env: OPENGREP_VERSION: ${{ inputs.opengrep-version }} + OPENGREP_SHA256: ${{ inputs.opengrep-sha256 }} GITLEAKS_VERSION: ${{ inputs.gitleaks-version }} + GITLEAKS_SHA256: ${{ inputs.gitleaks-sha256 }} run: | set -euo pipefail mkdir -p "$RUNNER_TEMP/sast-bin" curl -fsSL "https://github.com/opengrep/opengrep/releases/download/v${OPENGREP_VERSION}/opengrep_manylinux_x86" \ -o "$RUNNER_TEMP/sast-bin/opengrep" + echo "$OPENGREP_SHA256 $RUNNER_TEMP/sast-bin/opengrep" | sha256sum -c - curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ - | tar -xz -C "$RUNNER_TEMP/sast-bin" gitleaks + -o "$RUNNER_TEMP/gitleaks.tar.gz" + echo "$GITLEAKS_SHA256 $RUNNER_TEMP/gitleaks.tar.gz" | sha256sum -c - + tar -xz -C "$RUNNER_TEMP/sast-bin" -f "$RUNNER_TEMP/gitleaks.tar.gz" gitleaks chmod +x "$RUNNER_TEMP/sast-bin/opengrep" "$RUNNER_TEMP/sast-bin/gitleaks" echo "$RUNNER_TEMP/sast-bin" >> "$GITHUB_PATH" diff --git a/.github/workflows/reusable-docker-build.yml b/.github/workflows/reusable-docker-build.yml index 8718093..ea3a285 100644 --- a/.github/workflows/reusable-docker-build.yml +++ b/.github/workflows/reusable-docker-build.yml @@ -167,6 +167,7 @@ jobs: run: | curl -fsSL https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64 \ -o "${RUNNER_TEMP}/hadolint" + echo "56de6d5e5ec427e17b74fa48d51271c7fc0d61244bf5c90e828aab8362d55010 ${RUNNER_TEMP}/hadolint" | sha256sum -c - chmod +x "${RUNNER_TEMP}/hadolint" # DL3008 (apt) / DL3018 (apk): pinning OS package versions is # impractical — Debian/Alpine point releases supersede them and exact @@ -528,6 +529,7 @@ jobs: run: | curl -fsSL https://github.com/sigstore/cosign/releases/download/v2.4.1/cosign-linux-amd64 \ -o "${RUNNER_TEMP}/cosign" + echo "8b24b946dd5809c6bd93de08033bcf6bc0ed7d336b7785787c080f574b89249b ${RUNNER_TEMP}/cosign" | sha256sum -c - chmod +x "${RUNNER_TEMP}/cosign" echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}" - name: Login to GHCR diff --git a/.github/workflows/reusable-security-scan.yml b/.github/workflows/reusable-security-scan.yml index 7f5690a..f75dd3a 100644 --- a/.github/workflows/reusable-security-scan.yml +++ b/.github/workflows/reusable-security-scan.yml @@ -121,8 +121,11 @@ jobs: run: | VERSION=8.21.2 mkdir -p "$RUNNER_TEMP/bin" + SHA256=5bc41815076e6ed6ef8fbecc9d9b75bcae31f39029ceb55da08086315316e3ba curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \ - | tar -xz -C "$RUNNER_TEMP/bin" gitleaks + -o "$RUNNER_TEMP/gitleaks.tar.gz" + echo "$SHA256 $RUNNER_TEMP/gitleaks.tar.gz" | sha256sum -c - + tar -xz -C "$RUNNER_TEMP/bin" -f "$RUNNER_TEMP/gitleaks.tar.gz" gitleaks echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH" "$RUNNER_TEMP/bin/gitleaks" version - name: Run gitleaks @@ -172,6 +175,7 @@ jobs: mkdir -p "$RUNNER_TEMP/bin" curl -fsSL "https://github.com/google/osv-scanner/releases/download/v${VERSION}/osv-scanner_linux_amd64" \ -o "$RUNNER_TEMP/bin/osv-scanner" + echo "3abcfd7126c453a00421487e721b296e0cb68085bd431d6cef60872774170fc8 $RUNNER_TEMP/bin/osv-scanner" | sha256sum -c - chmod +x "$RUNNER_TEMP/bin/osv-scanner" echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH" "$RUNNER_TEMP/bin/osv-scanner" --version @@ -217,6 +221,7 @@ jobs: mkdir -p "$RUNNER_TEMP/bin" curl -fsSL "https://github.com/opengrep/opengrep/releases/download/v${VERSION}/opengrep_manylinux_x86" \ -o "$RUNNER_TEMP/bin/opengrep" + echo "57a5a7fcc2df876e02f606fd86841078ee6f15c7deb115a7929228c3eaa99273 $RUNNER_TEMP/bin/opengrep" | sha256sum -c - chmod +x "$RUNNER_TEMP/bin/opengrep" echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH" "$RUNNER_TEMP/bin/opengrep" --version @@ -235,7 +240,7 @@ jobs: DEST="$RUNNER_TEMP/opengrep-rules" mkdir -p "$DEST" TARBALL="$RUNNER_TEMP/opengrep-rules.tar.gz" - curl -fsSL -o "$TARBALL" https://codeload.github.com/opengrep/opengrep-rules/tar.gz/refs/heads/main + curl -fsSL -o "$TARBALL" https://codeload.github.com/opengrep/opengrep-rules/tar.gz/f1d2b562b414783763fd02a6ed2736eaed622efa tar -xzf "$TARBALL" -C "$DEST" --strip-components=1 echo "path=$DEST" >> "$GITHUB_OUTPUT" - name: Fetch the FerrLabs ruleset @@ -348,8 +353,12 @@ jobs: - name: Install trufflehog run: | mkdir -p "$RUNNER_TEMP/bin" - curl -fsSL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh \ - | sh -s -- -b "$RUNNER_TEMP/bin" + VERSION=3.99.7 + SHA256=bdbea0508e439b144f49de14e775908de5f902f3d14ea7ae8354bae72b0b72ef + curl -fsSL "https://github.com/trufflesecurity/trufflehog/releases/download/v${VERSION}/trufflehog_${VERSION}_linux_amd64.tar.gz" \ + -o "$RUNNER_TEMP/trufflehog.tar.gz" + echo "$SHA256 $RUNNER_TEMP/trufflehog.tar.gz" | sha256sum -c - + tar -xz -C "$RUNNER_TEMP/bin" -f "$RUNNER_TEMP/trufflehog.tar.gz" trufflehog echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH" "$RUNNER_TEMP/bin/trufflehog" --version - name: Run trufflehog (filesystem + git history)