7.md (4622B)
1 # PR #7 Improve code quality by securing supply chain 2 3 - **Status:** merged 4 - **Author:** @MTRNord 5 - **Created:** 2022-01-20T17:59:16Z 6 - **Branch:** MTRNord/supply-chain-fixes → main 7 - **Merged:** 2022-01-20T18:47:17Z 8 - **Labels:** enhancement, security 9 - **Assignees:** @MTRNord 10 - **Diff:** [7.diff](./7.diff) 11 12 --- 13 14 (Arguable this isn't necessary, but I want to learn this for the future.) 15 16 ## Observed further optimization possibilities 17 - Playwright Tests probably should have their own Dockerfile to run on so the ubuntu repos can be blocked. 18 - Pull Requests trigger deploy CI. This should not happen :o 19 20 21 ## Comments 22 23 ### @varunsh-coder — 2022-01-20T18:10:09Z 24 25 Hi @MTRNord I observed you tried https://app.stepsecurity.io to address security issues. Please let me know if you have any feedback. I will be happy to help out. Thanks! 26 27 ### @MTRNord — 2022-01-20T18:20:30Z 28 29 > Hi @MTRNord I observed you tried https://app.stepsecurity.io to address security issues. Please let me know if you have any feedback. I will be happy to help out. Thanks! 30 31 Thanks for making this if anything comes up I will write some feedback 👍 32 33 ### @varunsh-coder — 2022-01-20T18:24:51Z 34 35 > > Hi @MTRNord I observed you tried https://app.stepsecurity.io to address security issues. Please let me know if you have any feedback. I will be happy to help out. Thanks! 36 > 37 > Thanks for making this if anything comes up I will write some feedback 👍 38 39 If you run the playwright tests in audit mode, as below, then you will get all the endpoints at once. Then you can add all at once, and change it to `block` 40 41 ``` 42 - name: Harden Runner 43 uses: step-security/harden-runner@14dc64f30986eaa2ad2dddcec073f5aab18e5a24 # v1 44 with: 45 egress-policy: audit 46 allowed-endpoints: 47 github.com:22 48 github.com:443 49 registry.npmjs.org:443 50 playwright.azureedge.net:443 51 azure.archive.ubuntu.com:443 52 azure.archive.ubuntu.com:80 53 security.ubuntu.com:80 54 packages.microsoft.com:80 55 packages.microsoft.com:443 56 ``` 57 58 ### @MTRNord — 2022-01-20T18:26:20Z 59 60 > > > Hi @MTRNord I observed you tried https://app.stepsecurity.io to address security issues. Please let me know if you have any feedback. I will be happy to help out. Thanks! 61 > > 62 > > 63 > > Thanks for making this if anything comes up I will write some feedback 👍 64 > 65 > If you run the playwright tests in audit mode, as below, then you will get all the endpoints at once. Then you can add all at once, and change it to `block` 66 > 67 > ``` 68 > - name: Harden Runner 69 > uses: step-security/harden-runner@14dc64f30986eaa2ad2dddcec073f5aab18e5a24 # v1 70 > with: 71 > egress-policy: audit 72 > allowed-endpoints: 73 > github.com:22 74 > github.com:443 75 > registry.npmjs.org:443 76 > playwright.azureedge.net:443 77 > azure.archive.ubuntu.com:443 78 > azure.archive.ubuntu.com:80 79 > security.ubuntu.com:80 80 > packages.microsoft.com:80 81 > packages.microsoft.com:443 82 > ``` 83 84 Yeah I saw that :) Here it was more an issue that the specific pipeline was broken initially due to a bug with npm :) So it stretched a little more than I wanted it to :) 85 86 ### @MTRNord — 2022-01-20T18:47:48Z 87 88 (Test failure is not related to the content of the PR, hence it will be fixed in a separate PR) 89 90 ### @varunsh-coder — 2022-01-20T22:45:43Z 91 92 Hi @MTRNord , I am curious why you did not add these domains to the `allowed-endpoints` list (e.g. fonts.gstatic.com)? Is it that you don't think these are needed? They will show up as annotations in every run and I am wondering if there is a better user experience. 93 https://github.com/MTRNord/matrix-art/actions/runs/1725841456 94 95 ### @MTRNord — 2022-01-20T22:49:34Z 96 97 > Hi @MTRNord , I am curious why you did not add these domains to the `allowed-endpoints` list (e.g. fonts.gstatic.com)? Is it that you don't think these are needed? They will show up as annotations in every run and I am wondering if there is a better user experience. https://github.com/MTRNord/matrix-art/actions/runs/1725841456 98 99 The end to end UI tests that are running currently don't check for fonts and similar. So it is fine if the font falls back to the browser default. There is not really a good reason to not allow them to be honest :) I just wanted to rewrite that specific job, so I don't have to open the access to the package sources. So I focused on the other things first and want to come back to that one job in another PR :) 100