工作流安全加固与供应链防御

name: Secure Workflow
on: [push]

# 顶层：全局默认最小权限
permissions:
  contents: read
  issues: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

  create-release:
    runs-on: ubuntu-latest
    # job 级：按需放大，仅此 job 生效
    permissions:
      contents: write
    steps:
      - run: gh release create v1.0.0

  no-permission-job:
    runs-on: ubuntu-latest
    # 显式关闭全部权限
    permissions: {}
    steps:
      - run: echo "此 job 不需要任何 token 权限"

# Organization → Settings → Actions → General
# Default workflow permissions: Read repository contents and packages permissions
# 并勾选：Allow GitHub Actions to create and approve pull requests（按需）

steps:
  # ✅ 固定到完整 commit SHA
  - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
  - uses: actions/setup-node@1d0a46970b10f4c00a5f49cae0f628a540f6cc2e  # v4.1.0

  # ❌ 反模式：可变 tag
  # - uses: actions/checkout@v4

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    reviewers:
      - "security-team"
    commit-message:
      prefix: "chore(deps)"

# ⚠️ pull_request_target：在目标分支上下文 + 完整 Secrets 下执行
on:
  pull_request_target:
    types: [opened, labeled]

on:
  pull_request_target:
    types: [opened]

jobs:
  label:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      # ✅ 只运行受信任的 github-script，不 checkout PR 代码
      - uses: actions/github-script@v7
        with:
          script: |
            const { data: pr } = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.payload.pull_request.number,
            });
            // 仅根据 PR 元数据打标签，绝不执行 PR 代码

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      # ✅ env 注入，避免命令行回显
      - name: Deploy
        env:
          API_KEY: ${{ secrets.API_KEY }}
        run: |
          curl -H "Authorization: Bearer $API_KEY" https://api.example.com

      # ❌ 危险：拼进命令行可能进入日志
      # - run: curl -H "Authorization: Bearer ${{ secrets.API_KEY }}" ...

# .github/secret_scanning.yml
secret_scanning:
  enable_push_protection: true   # 阻止含密钥的提交推送到仓库

# ❌ 漏洞：PR 标题包含 `"; rm -rf ./ && echo "`
steps:
  - run: echo "PR 标题：${{ github.event.pull_request.title }}"

# ✅ 防御：表达式先写入 env，脚本用变量引用
steps:
  - name: Comment with PR title
    env:
      PR_TITLE: ${{ github.event.pull_request.title }}
    run: |
      echo "PR 标题：$PR_TITLE"          # 变量值永不作为代码解析

jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      ENV_NAME: ${{ github.event.inputs.environment }}
    steps:
      - name: Validate input
        run: |
          case "$ENV_NAME" in
            staging|production) ;;        # 白名单
            *) echo "非法环境"; exit 1 ;;
          esac

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    outputs:
      artifacts-download: ${{ steps.build.outputs.artifacts-download }}
    steps:
      - uses: actions/checkout@v4
      - run: mkdir -p dist && echo "build" > dist/app
      - uses: actions/upload-artifact@v4
        with:
          name: artifacts
          path: dist/**

  provenance:
    needs: build
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: "${{ needs.build.outputs.artifacts-download }}"

steps:
  - uses: sigstore/cosign-installer@v3
  - name: Sign artifact
    run: |
      cosign sign-blob --yes dist/app.tar.gz \
        --output-signature dist/app.tar.gz.sig \
        --output-certificate dist/app.tar.gz.crt

cosign verify-blob \
  --signature dist/app.tar.gz.sig \
  --certificate dist/app.tar.gz.crt \
  --certificate-identity-regexp="^https://github.com/my-org/my-repo/.github/workflows/.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  dist/app.tar.gz

# 用标签限制 Runner 用途，并与敏感 job 隔离
jobs:
  deploy:
    runs-on: [self-hosted, production-safe]   # 专用标签组
    environment: production
    steps:
      - run: ./deploy.sh

# 定期拉取组织 audit log，监控高风险操作
curl -H "Authorization: token $TOKEN" \
  "https://api.github.com/orgs/my-org/audit-log?phrase=action:workflows"