Orchestrate Security
Last updated
Was this helpful?
Last updated
Was this helpful?
The Orchestrate Security section in StepSecurity allows you to analyze your GitHub Actions workflows against security best practices and automatically fix security gaps through automation
You can use to fix security issues in a single workflow and to apply fixes across all workflows in a repository.
Once these fixes are applied and merged, they will enforce the following security enhancements:
The GITHUB_TOKEN is an automatically generated secret that grants authenticated access to the GitHub API.
To minimize security risks, StepSecurity enforces the principle of least privilege, restricting token access to only the necessary scopes. This reduces the risk of privilege escalation and unauthorized access.
The Harden-Runner GitHub Action installs a security agent on the Github-hosted runner to prevent exfiltration of credentials, monitor the build process, and detect compromised dependencies.
This ensures that workflows are protected against supply chain attacks and unauthorized data leaks.
Pinning GitHub Actions to a full-length commit SHA ensures that workflows remain immutable and protected from upstream modifications.
This prevents the risk of a compromised action repository introducing security vulnerabilities. Users should verify that the SHA comes from the official action repository rather than a fork.
StepSecurity also supports pinning to immutable Actions, adding an extra layer of protection to your workflows.
To prevent unauthorized updates and potential supply chain attacks, container images referenced in workflows are locked to a specific commit SHA.
This ensures that images remain consistent and are not silently updated with unverified changes.
StepSecurity automates the discovery of languages and technologies (e.g., Golang, GitHub Actions, etc.) used in repositories, enabling Dependabot to proactively upgrade dependencies with the latest security patches and improvements.
This automation helps reduce the risk of vulnerabilities caused by outdated third-party libraries.
Static Application Security Testing (SAST) scans source code during development to detect security vulnerabilities early in the software development lifecycle.
By proactively identifying potential weaknesses, you can remediate issues before deployment.
The Dependency Review Workflow scans package version changes in pull requests to detect vulnerabilities introduced by new dependencies.
This provides visibility into potential security risks before merging a PR, helping you maintain a secure software supply chain.
OpenSSF Scorecard evaluates repository security based on multiple heuristics and assigns a security score from 0 to 10.
This helps users understand areas for improvement and strengthen their security posture. Additionally, repositories can display a Scorecard badge to showcase security best practices.
Pre-commit hooks enforce security by scanning code before it is committed.
This helps detect hardcoded secrets, enforce code quality, and prevent security vulnerabilities at an early stage