Orchestrate Security
The Orchestrate Security section in StepSecurity allows you to analyze your GitHub Actions workflows against security best practices and automatically fix security gaps through automation
You can use Secure Workflow to fix security issues in a single workflow and Secure Repo to apply fixes across all workflows in a repository.
Once these fixes are applied and merged, they will enforce the following security enhancements:
Restrict Permissions for GITHUB_TOKEN
The GITHUB_TOKEN is an automatically generated secret that grants authenticated access to the GitHub API.
To minimize security risks, StepSecurity enforces the principle of least privilege, restricting token access to only the necessary scopes. This reduces the risk of privilege escalation and unauthorized access.
Add stepsecurity/harden-runner
The Harden-Runner GitHub Action installs a security agent on the Github-hosted runner to prevent exfiltration of credentials, monitor the build process, and detect compromised dependencies.
This ensures that workflows are protected against supply chain attacks and unauthorized data leaks.
Pin Actions to a Full-length Commit SHA
Pinning GitHub Actions to a full-length commit SHA ensures that workflows remain immutable and protected from upstream modifications.
This prevents the risk of a compromised action repository introducing security vulnerabilities. Users should verify that the SHA comes from the official action repository rather than a fork.
StepSecurity also supports pinning to immutable Actions, adding an extra layer of protection to your workflows.
Pin Image Tags to Digests in Dockerfiles
To prevent unauthorized updates and potential supply chain attacks, container images referenced in workflows are locked to a specific commit SHA.
This ensures that images remain consistent and are not silently updated with unverified changes.
Update Dependabot Configuration
StepSecurity automates the discovery of languages and technologies (e.g., Golang, GitHub Actions, etc.) used in repositories, enabling Dependabot to proactively upgrade dependencies with the latest security patches and improvements.
This automation helps reduce the risk of vulnerabilities caused by outdated third-party libraries.
Add CodeQL Workflow (SAST Tool)
Static Application Security Testing (SAST) scans source code during development to detect security vulnerabilities early in the software development lifecycle.
By proactively identifying potential weaknesses, you can remediate issues before deployment.
Add Dependency Review Workflow
The Dependency Review Workflow scans package version changes in pull requests to detect vulnerabilities introduced by new dependencies.
This provides visibility into potential security risks before merging a PR, helping you maintain a secure software supply chain.
Add OpenSSF Scorecard Workflow
OpenSSF Scorecard evaluates repository security based on multiple heuristics and assigns a security score from 0 to 10.
This helps users understand areas for improvement and strengthen their security posture. Additionally, repositories can display a Scorecard badge to showcase security best practices.
Update Pre-commit Configuration
Pre-commit hooks enforce security by scanning code before it is committed.
This helps detect hardcoded secrets, enforce code quality, and prevent security vulnerabilities at an early stage
Last updated
Was this helpful?