From 98e644d538ff2c57e96c54bdd6e13df31c7d19ba Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Sat, 10 Dec 2022 16:12:12 -0800 Subject: [PATCH] [github-actions] apply step-security updates (#8509) --- .github/workflows/build.yml | 95 +++++++++++++++++++++---- .github/workflows/codeql.yml | 14 +++- .github/workflows/docker.yml | 14 +++- .github/workflows/fuzz.yml | 14 +++- .github/workflows/makefile-check.yml | 10 ++- .github/workflows/otbr.yml | 44 ++++++++---- .github/workflows/otci.yml | 10 ++- .github/workflows/otns.yml | 52 +++++++++----- .github/workflows/posix.yml | 87 +++++++++++++++++------ .github/workflows/simulation-1.1.yml | 100 ++++++++++++++++++++------- .github/workflows/simulation-1.2.yml | 82 ++++++++++++++++------ .github/workflows/size.yml | 7 +- .github/workflows/toranj.yml | 43 +++++++++--- .github/workflows/version.yml | 10 ++- 14 files changed, 448 insertions(+), 134 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6f8cd4573..5855eed43 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -45,7 +45,12 @@ jobs: pretty: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -61,8 +66,13 @@ jobs: markdown-lint-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 - - uses: gaurav-nelson/github-action-markdown-link-check@v1 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 + - uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1 with: use-verbose-mode: 'yes' max-depth: 3 @@ -70,7 +80,12 @@ jobs: cmake-version: runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -100,7 +115,12 @@ jobs: CC: ${{ matrix.compiler_c }} CXX: ${{ matrix.compiler_cpp }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -114,7 +134,12 @@ jobs: scan-build: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -128,14 +153,19 @@ jobs: mbedtls3-build: runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y ninja-build libreadline-dev libncurses-dev rm -rf third_party/mbedtls/repo - - uses: actions/checkout@v3 + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: repository: ARMmbed/mbedtls ref: v3.2.1 @@ -167,7 +197,12 @@ jobs: gcc_download_url: https://developer.arm.com/-/media/Files/downloads/gnu-rm/9-2019q4/RC2.1/gcc-arm-none-eabi-9-2019-q4-major-x86_64-linux.tar.bz2 gcc_extract_dir: gcc-arm-none-eabi-9-2019-q4-major steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -199,7 +234,12 @@ jobs: CC: gcc-${{ matrix.gcc_ver }} CXX: g++-${{ matrix.gcc_ver }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -227,7 +267,12 @@ jobs: CC: clang-${{ matrix.clang_ver }} CXX: clang++-${{ matrix.clang_ver }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -260,7 +305,12 @@ jobs: CXXFLAGS: -m32 -Wconversion LDFLAGS: -m32 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -283,7 +333,12 @@ jobs: gn: runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -314,7 +369,12 @@ jobs: CC: ${{ matrix.CC }} CXX: ${{ matrix.CXX }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -332,7 +392,12 @@ jobs: android: runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Build diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b3c1d4637..285e62349 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,6 +34,9 @@ on: pull_request: branches: [ "main" ] +permissions: # added using https://github.com/step-security/secure-workflows + contents: read + jobs: analyze: name: Analyze @@ -50,15 +53,20 @@ jobs: # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support steps: + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y ninja-build libreadline-dev libncurses-dev - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@a669cc5936cc5e1b6a362ec1ff9e410dc570d190 # v2.1.36 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -72,6 +80,6 @@ jobs: ./script/test build - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@a669cc5936cc5e1b6a362ec1ff9e410dc570d190 # v2.1.36 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 3121cf03d..5f6e8da2a 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -40,6 +40,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }} cancel-in-progress: true +permissions: # added using https://github.com/step-security/secure-workflows + contents: read + jobs: buildx: @@ -51,7 +54,12 @@ jobs: include: - docker_name: environment steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true @@ -75,7 +83,7 @@ jobs: ${TAGS} --file ${DOCKER_FILE} . - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 + uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2.2.1 - name: Docker Buildx (build) run: | @@ -83,7 +91,7 @@ jobs: - name: Login to DockerHub if: success() && github.repository == 'openthread/openthread' && github.event_name != 'pull_request' - uses: docker/login-action@v2 + uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 59ed8a3c2..6a985e215 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -37,23 +37,31 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }} cancel-in-progress: true +permissions: # added using https://github.com/step-security/secure-workflows + contents: read + jobs: Fuzzing: runs-on: ubuntu-20.04 steps: + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + - name: Build Fuzzers - uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master + uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@c0e4bb8d15a68b7f8cc731ea75523e48a2301bcf # master with: oss-fuzz-project-name: 'openthread' dry-run: false - name: Run Fuzzers - uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master + uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@c0e4bb8d15a68b7f8cc731ea75523e48a2301bcf # master with: oss-fuzz-project-name: 'openthread' fuzz-seconds: 1800 dry-run: false - name: Upload Crash - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: failure() with: name: artifacts diff --git a/.github/workflows/makefile-check.yml b/.github/workflows/makefile-check.yml index 2f1d051f8..10c86d2ad 100644 --- a/.github/workflows/makefile-check.yml +++ b/.github/workflows/makefile-check.yml @@ -40,11 +40,19 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }} cancel-in-progress: true +permissions: # added using https://github.com/step-security/secure-workflows + contents: read + jobs: makefile-check: runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Check diff --git a/.github/workflows/otbr.yml b/.github/workflows/otbr.yml index 9d32243ac..7db727cc7 100644 --- a/.github/workflows/otbr.yml +++ b/.github/workflows/otbr.yml @@ -59,7 +59,12 @@ jobs: # of OMR prefix and Domain prefix is not deterministic. BORDER_ROUTING: 0 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Build OTBR Docker @@ -83,11 +88,11 @@ jobs: export CI_ENV="$(bash <(curl -s https://codecov.io/env)) -e GITHUB_ACTIONS -e COVERAGE" echo "CI_ENV=${CI_ENV}" sudo -E ./script/test cert_suite ./tests/scripts/thread-cert/backbone/*.py || (sudo chmod a+r *.log *.json *.pcap && false) - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-thread-1-3-backbone-docker path: /tmp/coverage/ - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: thread-1-3-backbone-results @@ -100,7 +105,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-thread-1-3-backbone path: tmp/coverage.info @@ -169,7 +174,12 @@ jobs: NAT64: ${{ matrix.nat64 }} MAX_JOBS: 3 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 - name: Build OTBR Docker env: GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" @@ -192,11 +202,11 @@ jobs: export CI_ENV="$(bash <(curl -s https://codecov.io/env)) -e GITHUB_ACTIONS -e COVERAGE" echo "CI_ENV=${CI_ENV}" sudo -E ./script/test cert_suite ${{ matrix.cert_scripts }} || (sudo chmod a+r *.log *.json *.pcap && false) - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-thread-border-router-docker path: /tmp/coverage/ - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: thread-border-router-results @@ -209,7 +219,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-thread-border-router path: tmp/coverage.info @@ -220,13 +230,18 @@ jobs: - thread-border-router runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y lcov - - uses: actions/download-artifact@v3 + - uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1 with: path: coverage/ - name: Combine Coverage @@ -235,7 +250,7 @@ jobs: script/test combine_coverage - name: Upload Coverage continue-on-error: true - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1 with: files: final.info fail_ci_if_error: true @@ -244,7 +259,12 @@ jobs: needs: upload-coverage runs-on: ubuntu-20.04 steps: - - uses: geekyeggo/delete-artifact@v2 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0 with: name: cov-* useGlob: true diff --git a/.github/workflows/otci.yml b/.github/workflows/otci.yml index f3c717073..fceb54076 100644 --- a/.github/workflows/otci.yml +++ b/.github/workflows/otci.yml @@ -40,6 +40,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }} cancel-in-progress: true +permissions: # added using https://github.com/step-security/secure-workflows + contents: read + jobs: cli-sim: @@ -54,7 +57,12 @@ jobs: VIRTUAL_TIME: ${{ matrix.virtual_time }} REAL_DEVICE: 0 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 - name: Bootstrap run: | sudo rm /etc/apt/sources.list.d/* && sudo apt-get update diff --git a/.github/workflows/otns.yml b/.github/workflows/otns.yml index 5e63fad07..8d7397cf0 100644 --- a/.github/workflows/otns.yml +++ b/.github/workflows/otns.yml @@ -48,18 +48,26 @@ env: MAX_NETWORK_SIZE: 999 GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" +permissions: # added using https://github.com/step-security/secure-workflows + contents: read + jobs: unittests: name: Unittests runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 - - uses: actions/setup-go@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 + - uses: actions/setup-go@d0a58c1c4d2b25278816e339b944508c875f3613 # v3.4.0 with: go-version: '1.14' - name: Set up Python 3.6 - uses: actions/setup-python@v4 + uses: actions/setup-python@2c3dd9e7e29afd70cc0950079bde6c979d1f69f9 # v4.3.1 with: python-version: 3.6 - name: Bootstrap @@ -75,7 +83,7 @@ jobs: cd /tmp/otns ./script/test py-unittests ) - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: unittests-pcaps @@ -85,7 +93,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-otns-unittests path: tmp/coverage.info @@ -94,12 +102,12 @@ jobs: name: Examples runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 - - uses: actions/setup-go@v3 + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 + - uses: actions/setup-go@d0a58c1c4d2b25278816e339b944508c875f3613 # v3.4.0 with: go-version: '1.14' - name: Set up Python 3.6 - uses: actions/setup-python@v4 + uses: actions/setup-python@2c3dd9e7e29afd70cc0950079bde6c979d1f69f9 # v4.3.1 with: python-version: 3.6 - name: Bootstrap @@ -115,7 +123,7 @@ jobs: cd /tmp/otns ./script/test py-examples ) - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: examples-pcaps @@ -125,7 +133,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-otns-examples path: tmp/coverage.info @@ -152,12 +160,17 @@ jobs: env: STRESS_LEVEL: ${{ matrix.stress_level }} steps: - - uses: actions/checkout@v3 - - uses: actions/setup-go@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 + - uses: actions/setup-go@d0a58c1c4d2b25278816e339b944508c875f3613 # v3.4.0 with: go-version: '1.14' - name: Set up Python 3.6 - uses: actions/setup-python@v4 + uses: actions/setup-python@2c3dd9e7e29afd70cc0950079bde6c979d1f69f9 # v4.3.1 with: python-version: 3.6 - name: Bootstrap @@ -173,7 +186,7 @@ jobs: cd /tmp/otns ./script/test stress-tests ${{ matrix.suite }} ) - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: stress-tests-${{ matrix.suite }}-pcaps @@ -183,7 +196,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-otns-stress-tests-${{ matrix.suite }} path: tmp/coverage.info @@ -195,11 +208,16 @@ jobs: - stress-tests runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y lcov - - uses: actions/download-artifact@v3 + - uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1 with: path: coverage/ - name: Upload Coverage diff --git a/.github/workflows/posix.yml b/.github/workflows/posix.yml index 403d35f12..c99b58e4b 100644 --- a/.github/workflows/posix.yml +++ b/.github/workflows/posix.yml @@ -48,7 +48,12 @@ jobs: CFLAGS: -DCLI_COAP_SECURE_USE_COAP_DEFAULT_HANDLER=1 -DOPENTHREAD_CONFIG_MLE_MAX_CHILDREN=15 CXXFLAGS: -DCLI_COAP_SECURE_USE_COAP_DEFAULT_HANDLER=1 -DOPENTHREAD_CONFIG_MLE_MAX_CHILDREN=15 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y expect ninja-build lcov socat @@ -63,7 +68,7 @@ jobs: CRASHED=$(./script/test check_crash | tail -1) [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed." echo "CRASHED_RCP=$CRASHED" >> $GITHUB_ENV - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() && env.CRASHED_RCP == '1' }} with: name: core-expect-rcp @@ -72,7 +77,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-expects-linux-1 path: tmp/coverage.info @@ -94,13 +99,13 @@ jobs: CRASHED=$(./script/test check_crash | tail -1) [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed." echo "CRASHED_TUN=$CRASHED" >> $GITHUB_ENV - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() && env.CRASHED_TUN == '1' }} with: name: core-expect-linux path: | ./ot-core-dump/* - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: syslog-expect-linux @@ -108,7 +113,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-expects-linux-2 path: tmp/coverage.info @@ -116,7 +121,12 @@ jobs: tcplp-buffering: runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Build @@ -135,7 +145,12 @@ jobs: VIRTUAL_TIME: 1 VIRTUAL_TIME_UART: 1 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -151,7 +166,7 @@ jobs: - name: Run run: | VERBOSE=1 OT_CLI_PATH="$PWD/output/posix/bin/ot-cli -v" RADIO_DEVICE="$PWD/output/simulation/bin/ot-rcp" make -f src/posix/Makefile-posix check - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: thread-cert @@ -159,7 +174,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-thread-cert path: tmp/coverage.info @@ -169,7 +184,12 @@ jobs: env: COVERAGE: 1 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -186,7 +206,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-ncp-rcp-migrate path: tmp/coverage.info @@ -203,7 +223,12 @@ jobs: OT_DAEMON: ${{ matrix.OT_DAEMON }} OT_READLINE: 'readline' steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 - name: Bootstrap run: | sudo rm /etc/apt/sources.list.d/* && sudo apt-get update @@ -231,7 +256,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-pty-linux-${{ matrix.DAEMON }} path: tmp/coverage.info @@ -247,7 +272,12 @@ jobs: OT_DAEMON: ${{ matrix.OT_DAEMON }} OT_READLINE: 'off' steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 - name: Bootstrap run: | rm -f '/usr/local/bin/2to3' @@ -263,7 +293,12 @@ jobs: rcp-stack-reset: runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 - name: Bootstrap env: GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" @@ -279,7 +314,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-rcp-stack-reset path: tmp/coverage.info @@ -292,20 +327,25 @@ jobs: - thread-cert runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y lcov - - uses: actions/download-artifact@v3 + - uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1 with: path: coverage/ - name: Combine Coverage run: | script/test combine_coverage - name: Upload Coverage - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1 with: files: final.info fail_ci_if_error: true @@ -314,7 +354,12 @@ jobs: needs: upload-coverage runs-on: ubuntu-20.04 steps: - - uses: geekyeggo/delete-artifact@v2 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0 with: name: cov-* useGlob: true diff --git a/.github/workflows/simulation-1.1.yml b/.github/workflows/simulation-1.1.yml index b79734ead..0c4f16ba8 100644 --- a/.github/workflows/simulation-1.1.yml +++ b/.github/workflows/simulation-1.1.yml @@ -51,7 +51,12 @@ jobs: THREAD_VERSION: 1.1 VIRTUAL_TIME: 1 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -77,7 +82,12 @@ jobs: VIRTUAL_TIME: 1 MULTIPLY: 3 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -94,7 +104,7 @@ jobs: - name: Run run: | ./script/test cert_suite ./tests/scripts/thread-cert/Cert_*.py ./tests/scripts/thread-cert/test_*.py - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: packet-verification-pcaps @@ -104,7 +114,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-packet-verification path: tmp/coverage.info @@ -120,7 +130,12 @@ jobs: THREAD_VERSION: 1.1 VIRTUAL_TIME: 1 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -135,7 +150,7 @@ jobs: - name: Run run: | VERBOSE=1 make -f examples/Makefile-simulation check - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: cli-ftd-thread-cert @@ -143,7 +158,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-cli-ftd path: tmp/coverage.info @@ -166,7 +181,12 @@ jobs: VIRTUAL_TIME: 1 MESSAGE_USE_HEAP: ${{ matrix.message_use_heap }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -181,7 +201,7 @@ jobs: - name: Run run: | VERBOSE=1 make -f examples/Makefile-simulation check - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: cli-mtd-thread-cert @@ -189,7 +209,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-cli-mtd-${{ matrix.message_use_heap }} path: tmp/coverage.info @@ -206,7 +226,12 @@ jobs: TIME_SYNC: 1 VIRTUAL_TIME: 1 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -221,7 +246,7 @@ jobs: - name: Run run: | VERBOSE=1 make -f examples/Makefile-simulation check - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: cli-time-sync-thread-cert @@ -229,7 +254,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-cli-time-sync path: tmp/coverage.info @@ -241,7 +266,12 @@ jobs: CXXFLAGS: -DCLI_COAP_SECURE_USE_COAP_DEFAULT_HANDLER=1 -DOPENTHREAD_CONFIG_MLE_MAX_CHILDREN=15 THREAD_VERSION: 1.1 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y expect ninja-build lcov socat @@ -256,7 +286,7 @@ jobs: CRASHED=$(./script/test check_crash | tail -1) [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed." echo "CRASHED_CLI=$CRASHED" >> $GITHUB_ENV - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() && env.CRASHED_CLI == '1' }} with: name: core-expect-cli @@ -265,7 +295,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-expects path: tmp/coverage.info @@ -275,7 +305,12 @@ jobs: env: THREAD_VERSION: 1.1 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -308,7 +343,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-ot-commissioner path: tmp/coverage.info @@ -323,7 +358,12 @@ jobs: VIRTUAL_TIME: 1 CXXFLAGS: "-DOPENTHREAD_CONFIG_LOG_PREPEND_UPTIME=0" steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -337,7 +377,7 @@ jobs: - name: Run run: | VERBOSE=1 make -f examples/Makefile-simulation check - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: multiple-instance-thread-cert @@ -345,7 +385,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-multiple-instance path: tmp/coverage.info @@ -361,20 +401,25 @@ jobs: - multiple-instance runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y lcov - - uses: actions/download-artifact@v3 + - uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1 with: path: coverage/ - name: Combine Coverage run: | script/test combine_coverage - name: Upload Coverage - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1 with: files: final.info fail_ci_if_error: true @@ -383,7 +428,12 @@ jobs: needs: upload-coverage runs-on: ubuntu-20.04 steps: - - uses: geekyeggo/delete-artifact@v2 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0 with: name: cov-* useGlob: true diff --git a/.github/workflows/simulation-1.2.yml b/.github/workflows/simulation-1.2.yml index 2e04435fc..5f2c46a76 100644 --- a/.github/workflows/simulation-1.2.yml +++ b/.github/workflows/simulation-1.2.yml @@ -40,6 +40,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }} cancel-in-progress: true +permissions: # added using https://github.com/step-security/secure-workflows + contents: read + jobs: thread-1-3: @@ -61,7 +64,12 @@ jobs: compiler: [{c: "gcc", cxx: "g++", gcov: "gcc"}, { c: "clang-10", cxx: "clang++-10", gcov: "llvm"}] arch: ["m32", "m64"] steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -86,12 +94,12 @@ jobs: CRASHED=$(./script/test check_crash | tail -1) [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed." echo "CRASHED=$CRASHED" >> $GITHUB_ENV - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: thread-1-3-${{ matrix.compiler.c }}-${{ matrix.arch }}-pcaps path: "*.pcap" - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() && env.CRASHED == '1' }} with: name: core-packet-verification-thread-1-3 @@ -100,7 +108,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage "${{ matrix.compiler.gcov }}" - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-thread-1-3-${{ matrix.compiler.c }}-${{ matrix.arch }} path: tmp/coverage.info @@ -117,7 +125,12 @@ jobs: INTER_OP: 1 INTER_OP_BBR: 0 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -145,14 +158,14 @@ jobs: CRASHED=$(./script/test check_crash | tail -1) [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed." echo "CRASHED=$CRASHED" >> $GITHUB_ENV - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: packet-verification-low-power-pcaps path: | *.pcap *.json - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() && env.CRASHED == '1' }} with: name: core-packet-verification-low-power @@ -161,7 +174,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-packet-verification-low-power path: tmp/coverage.info @@ -175,7 +188,12 @@ jobs: THREAD_VERSION: 1.3 MULTIPLY: 3 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -192,7 +210,7 @@ jobs: - name: Run run: | ./script/test cert_suite ./tests/scripts/thread-cert/Cert_*.py ./tests/scripts/thread-cert/test_*.py - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: packet-verification-1.1-on-1.3-pcaps @@ -202,7 +220,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-packet-verification-1-1-on-1-3 path: tmp/coverage.info @@ -214,7 +232,12 @@ jobs: THREAD_VERSION: 1.3 VIRTUAL_TIME: 0 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -231,7 +254,7 @@ jobs: CRASHED=$(./script/test check_crash | tail -1) [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed." echo "CRASHED=$CRASHED" >> $GITHUB_ENV - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() && env.CRASHED == '1' }} with: name: core-expect-1-3 @@ -240,7 +263,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-expects path: tmp/coverage.info @@ -257,7 +280,12 @@ jobs: VIRTUAL_TIME: 1 INTER_OP: 1 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -284,12 +312,12 @@ jobs: CRASHED=$(./script/test check_crash | tail -1) [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed." echo "CRASHED=$CRASHED" >> $GITHUB_ENV - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() }} with: name: thread-1-3-posix-pcaps path: "*.pcap" - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: ${{ failure() && env.CRASHED == '1' }} with: name: core-thread-1-3-posix @@ -298,7 +326,7 @@ jobs: - name: Generate Coverage run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 with: name: cov-thread-1-3-posix path: tmp/coverage.info @@ -312,20 +340,25 @@ jobs: - thread-1-3-posix runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y lcov - - uses: actions/download-artifact@v3 + - uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1 with: path: coverage/ - name: Combine Coverage run: | script/test combine_coverage - name: Upload Coverage - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1 with: files: final.info fail_ci_if_error: true @@ -334,7 +367,12 @@ jobs: needs: upload-coverage runs-on: ubuntu-20.04 steps: - - uses: geekyeggo/delete-artifact@v2 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0 with: name: cov-* useGlob: true diff --git a/.github/workflows/size.yml b/.github/workflows/size.yml index ea79f101c..2086a07ad 100644 --- a/.github/workflows/size.yml +++ b/.github/workflows/size.yml @@ -45,7 +45,12 @@ jobs: size-report: runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 - name: Bootstrap if: "github.event_name == 'push'" run: | diff --git a/.github/workflows/toranj.yml b/.github/workflows/toranj.yml index d109c9168..72db263f9 100644 --- a/.github/workflows/toranj.yml +++ b/.github/workflows/toranj.yml @@ -53,7 +53,12 @@ jobs: COVERAGE: 1 TORANJ_RADIO : ${{ matrix.TORANJ_RADIO }} steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -85,7 +90,7 @@ jobs: if: "matrix.TORANJ_RADIO != 'multi'" run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: "matrix.TORANJ_RADIO != 'multi'" with: name: cov-toranj-ncp-${{ matrix.TORANJ_RADIO }} @@ -102,7 +107,12 @@ jobs: TORANJ_RADIO : ${{ matrix.TORANJ_RADIO }} TORANJ_CLI: 1 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -119,7 +129,7 @@ jobs: if: "matrix.TORANJ_RADIO != 'multi'" run: | ./script/test generate_coverage gcc - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 if: "matrix.TORANJ_RADIO != 'multi'" with: name: cov-toranj-cli-${{ matrix.TORANJ_RADIO }} @@ -129,7 +139,12 @@ jobs: name: toranj-unittest runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap @@ -152,20 +167,25 @@ jobs: - toranj-cli runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y lcov - - uses: actions/download-artifact@v3 + - uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1 with: path: coverage/ - name: Combine Coverage run: | script/test combine_coverage - name: Upload Coverage - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1 with: files: final.info fail_ci_if_error: true @@ -174,7 +194,12 @@ jobs: needs: upload-coverage runs-on: ubuntu-20.04 steps: - - uses: geekyeggo/delete-artifact@v2 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0 with: name: cov-* useGlob: true diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml index f4fb637cd..bd0f8f6a7 100644 --- a/.github/workflows/version.yml +++ b/.github/workflows/version.yml @@ -37,11 +37,19 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }} cancel-in-progress: true +permissions: # added using https://github.com/step-security/secure-workflows + contents: read + jobs: api-version: runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 with: submodules: true - name: Check