7.json (5401B)
1 { 2 "number": 7, 3 "title": "Improve code quality by securing supply chain", 4 "state": "merged", 5 "diff_file": "7.diff", 6 "author": "MTRNord", 7 "created_at": "2022-01-20T17:59:16Z", 8 "closed_at": "2022-01-20T18:47:17Z", 9 "merged_at": "2022-01-20T18:47:17Z", 10 "base_ref": "main", 11 "head_ref": "MTRNord/supply-chain-fixes", 12 "labels": [ 13 "enhancement", 14 "security" 15 ], 16 "assignees": [ 17 "MTRNord" 18 ], 19 "requested_reviewers": [], 20 "body": "(Arguable this isn't necessary, but I want to learn this for the future.)\r\n\r\n## Observed further optimization possibilities\r\n- Playwright Tests probably should have their own Dockerfile to run on so the ubuntu repos can be blocked.\r\n- Pull Requests trigger deploy CI. This should not happen :o", 21 "comments": [ 22 { 23 "author": "varunsh-coder", 24 "created_at": "2022-01-20T18:10:09Z", 25 "body": "Hi @MTRNord I observed you tried https://app.stepsecurity.io to address security issues. Please let me know if you have any feedback. I will be happy to help out. Thanks!" 26 }, 27 { 28 "author": "MTRNord", 29 "created_at": "2022-01-20T18:20:30Z", 30 "body": "> Hi @MTRNord I observed you tried https://app.stepsecurity.io to address security issues. Please let me know if you have any feedback. I will be happy to help out. Thanks!\r\n\r\nThanks for making this if anything comes up I will write some feedback \ud83d\udc4d " 31 }, 32 { 33 "author": "varunsh-coder", 34 "created_at": "2022-01-20T18:24:51Z", 35 "body": "> > Hi @MTRNord I observed you tried https://app.stepsecurity.io to address security issues. Please let me know if you have any feedback. I will be happy to help out. Thanks!\r\n> \r\n> Thanks for making this if anything comes up I will write some feedback \ud83d\udc4d\r\n\r\nIf you run the playwright tests in audit mode, as below, then you will get all the endpoints at once. Then you can add all at once, and change it to `block`\r\n\r\n```\r\n- name: Harden Runner\r\n uses: step-security/harden-runner@14dc64f30986eaa2ad2dddcec073f5aab18e5a24 # v1\r\n with:\r\n egress-policy: audit\r\n allowed-endpoints: \r\n github.com:22\r\n github.com:443\r\n registry.npmjs.org:443\r\n playwright.azureedge.net:443\r\n azure.archive.ubuntu.com:443\r\n azure.archive.ubuntu.com:80\r\n security.ubuntu.com:80\r\n packages.microsoft.com:80\r\n packages.microsoft.com:443\r\n```" 36 }, 37 { 38 "author": "MTRNord", 39 "created_at": "2022-01-20T18:26:20Z", 40 "body": "> > > Hi @MTRNord I observed you tried https://app.stepsecurity.io to address security issues. Please let me know if you have any feedback. I will be happy to help out. Thanks!\r\n> > \r\n> > \r\n> > Thanks for making this if anything comes up I will write some feedback \ud83d\udc4d\r\n> \r\n> If you run the playwright tests in audit mode, as below, then you will get all the endpoints at once. Then you can add all at once, and change it to `block`\r\n> \r\n> ```\r\n> - name: Harden Runner\r\n> uses: step-security/harden-runner@14dc64f30986eaa2ad2dddcec073f5aab18e5a24 # v1\r\n> with:\r\n> egress-policy: audit\r\n> allowed-endpoints: \r\n> github.com:22\r\n> github.com:443\r\n> registry.npmjs.org:443\r\n> playwright.azureedge.net:443\r\n> azure.archive.ubuntu.com:443\r\n> azure.archive.ubuntu.com:80\r\n> security.ubuntu.com:80\r\n> packages.microsoft.com:80\r\n> packages.microsoft.com:443\r\n> ```\r\n\r\nYeah I saw that :) Here it was more an issue that the specific pipeline was broken initially due to a bug with npm :) So it stretched a little more than I wanted it to :)" 41 }, 42 { 43 "author": "MTRNord", 44 "created_at": "2022-01-20T18:47:48Z", 45 "body": "(Test failure is not related to the content of the PR, hence it will be fixed in a separate PR)" 46 }, 47 { 48 "author": "varunsh-coder", 49 "created_at": "2022-01-20T22:45:43Z", 50 "body": "Hi @MTRNord , I am curious why you did not add these domains to the `allowed-endpoints` list (e.g. fonts.gstatic.com)? Is it that you don't think these are needed? They will show up as annotations in every run and I am wondering if there is a better user experience. \r\nhttps://github.com/MTRNord/matrix-art/actions/runs/1725841456" 51 }, 52 { 53 "author": "MTRNord", 54 "created_at": "2022-01-20T22:49:34Z", 55 "body": "> Hi @MTRNord , I am curious why you did not add these domains to the `allowed-endpoints` list (e.g. fonts.gstatic.com)? Is it that you don't think these are needed? They will show up as annotations in every run and I am wondering if there is a better user experience. https://github.com/MTRNord/matrix-art/actions/runs/1725841456\r\n\r\nThe end to end UI tests that are running currently don't check for fonts and similar. So it is fine if the font falls back to the browser default. There is not really a good reason to not allow them to be honest :) I just wanted to rewrite that specific job, so I don't have to open the access to the package sources. So I focused on the other things first and want to come back to that one job in another PR :)" 56 } 57 ], 58 "review_comments": [] 59 }