diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..6cfe4e4 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,30 @@ +# Dependabot keeps the GitHub Actions used by the workflows up to date. This +# repository has no Composer or npm dependencies: the plugin ships no +# third-party code, so the actions are its whole supply chain. +# +# Actions are pinned to exact commits with the version in a comment; +# Dependabot updates both. Updates come as one grouped PR a week, and only +# for releases at least a week old, so a hijacked release has time to be +# caught before it reaches CI or the release pipeline. Security updates +# (when turned on in Settings → Advanced Security) are not delayed. +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + time: "06:00" + timezone: America/New_York + cooldown: + default-days: 7 + groups: + github-actions: + patterns: + - "*" + commit-message: + prefix: ci + labels: + - dependencies + - github-actions + open-pull-requests-limit: 5 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c1f4cfe..c4a88f7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,9 +9,8 @@ on: permissions: contents: read -# Third-party actions are pinned to exact commits (tags can be moved). -# checkout v5 = fbc6f39…, setup-php v2 = eb7c497…, setup-node v5 = a0853c2…, -# WordPress/plugin-check-action v1.1.9 = 10857da… +# Actions are pinned to exact commits (tags can be moved), with the version in a comment. +# Dependabot (.github/dependabot.yml) proposes updates weekly. jobs: lint: @@ -22,8 +21,10 @@ jobs: matrix: php: ['7.0', '7.1', '7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5'] steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 - - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + with: + persist-credentials: false + - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php }} coverage: none @@ -34,8 +35,10 @@ jobs: name: README diagrams parse runs-on: ubuntu-latest steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 - - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + with: + persist-credentials: false + - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: node-version: '22' - run: npm install --no-save --no-audit --no-fund mermaid@11 jsdom @@ -52,13 +55,15 @@ jobs: needs: lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + with: + persist-credentials: false - name: Build the WordPress.org edition run: bash .github/scripts/build-wporg.sh build # The same checks the WordPress.org review team runs. Errors fail the job. - - uses: WordPress/plugin-check-action@10857da14b6c2246d15402b3e69f777edcf8c12e + - uses: WordPress/plugin-check-action@10857da14b6c2246d15402b3e69f777edcf8c12e # v1.1.9 with: build-dir: './build/jat-shell-scanner' slug: 'jat-shell-scanner' @@ -69,8 +74,10 @@ jobs: needs: lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 - - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + with: + persist-credentials: false + - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: '8.3' coverage: none @@ -128,9 +135,11 @@ jobs: --health-cmd="mysqladmin ping -proot" --health-interval=5s --health-timeout=5s --health-retries=20 steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + with: + persist-credentials: false - - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 + - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php }} extensions: mysqli, zip diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..87ee089 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,40 @@ +name: CodeQL + +# Scans the GitHub Actions workflows for security problems: untrusted input in +# run steps (script injection), over-broad tokens, risky triggers. CodeQL has +# no PHP support; the plugin's own code is covered by CI (Plugin Check, the +# reviewers' phpcs ruleset, integration and false-positive tests). +on: + push: + branches: [main] + paths: ['.github/**'] + pull_request: + paths: ['.github/**'] + schedule: + - cron: '17 9 * * 1' # Mondays, after Dependabot's run + workflow_dispatch: + +permissions: + contents: read + +jobs: + analyze: + name: Analyze workflows + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write # upload results to the Security tab + actions: read + steps: + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + with: + persist-credentials: false + + - uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 + with: + languages: actions + queries: security-extended + + - uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 + with: + category: /language:actions diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d09bad8..5be22fe 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,7 +12,7 @@ name: Release # That job only runs once the SVN_USERNAME and SVN_PASSWORD repository # secrets exist (set them after WordPress.org approves the plugin). # -# 10up/action-wordpress-plugin-deploy 2.3.0 = 54bd289… +# Actions are pinned to exact commits; Dependabot proposes updates weekly. on: workflow_run: workflows: [CI] @@ -28,14 +28,20 @@ concurrency: jobs: release: - if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' + # Only CI runs for pushes to main in this repository: never a pull request's code (a fork's or not). + if: >- + github.event.workflow_run.conclusion == 'success' && + github.event.workflow_run.event == 'push' && + github.event.workflow_run.head_branch == 'main' && + github.event.workflow_run.head_repository.full_name == github.repository runs-on: ubuntu-latest outputs: version: ${{ steps.v.outputs.version }} skip: ${{ steps.v.outputs.skip }} steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: + persist-credentials: false ref: ${{ github.event.workflow_run.head_sha }} - name: Read and check version @@ -93,7 +99,11 @@ jobs: wporg: name: Deploy to WordPress.org needs: release - if: needs.release.outputs.skip != '1' + if: >- + needs.release.outputs.skip != '1' && + github.event.workflow_run.event == 'push' && + github.event.workflow_run.head_branch == 'main' && + github.event.workflow_run.head_repository.full_name == github.repository runs-on: ubuntu-latest steps: - name: Are WordPress.org SVN credentials set? @@ -103,9 +113,10 @@ jobs: run: | if [ -n "$SVN_USERNAME" ]; then echo "ok=1" >> "$GITHUB_OUTPUT"; else echo "::notice::SVN_USERNAME / SVN_PASSWORD not set — skipping the WordPress.org deploy."; fi - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 if: steps.creds.outputs.ok == '1' with: + persist-credentials: false ref: ${{ github.event.workflow_run.head_sha }} - name: Build the WordPress.org edition @@ -114,7 +125,7 @@ jobs: sudo apt-get update -qq && sudo apt-get install -y -qq subversion bash .github/scripts/build-wporg.sh build - - uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 + - uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 # 2.3.0 if: steps.creds.outputs.ok == '1' env: SVN_USERNAME: ${{ secrets.SVN_USERNAME }} diff --git a/.github/workflows/wiki.yml b/.github/workflows/wiki.yml index 52319e8..fad6120 100644 --- a/.github/workflows/wiki.yml +++ b/.github/workflows/wiki.yml @@ -24,7 +24,9 @@ jobs: name: Rebuild the wiki runs-on: ubuntu-latest steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + with: + persist-credentials: false - name: Build and publish env: diff --git a/.github/workflows/wporg-assets.yml b/.github/workflows/wporg-assets.yml index 4a9032b..fb828c0 100644 --- a/.github/workflows/wporg-assets.yml +++ b/.github/workflows/wporg-assets.yml @@ -9,7 +9,7 @@ name: Update WordPress.org assets # # Needs the SVN_USERNAME and SVN_PASSWORD repository secrets. # -# 10up/action-wordpress-plugin-asset-update 2.2.0 = 2480306… +# Actions are pinned to exact commits; Dependabot proposes updates weekly. on: workflow_dispatch: push: @@ -40,7 +40,9 @@ jobs: exit 1 fi - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + with: + persist-credentials: false - name: Install Subversion run: sudo apt-get update -qq && sudo apt-get install -y -qq subversion @@ -48,7 +50,7 @@ jobs: # IGNORE_OTHER_FILES: the WordPress.org copy is built by # .github/scripts/build-wporg.sh, so trunk never matches the repo # file for file. Only readme.txt and the assets are sent. - - uses: 10up/action-wordpress-plugin-asset-update@2480306f6f693672726d08b5917ea114cb2825f7 + - uses: 10up/action-wordpress-plugin-asset-update@2480306f6f693672726d08b5917ea114cb2825f7 # 2.2.0 env: SVN_USERNAME: ${{ secrets.SVN_USERNAME }} SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }} diff --git a/.github/workflows/wporg-deploy.yml b/.github/workflows/wporg-deploy.yml index 6960f41..4f66f44 100644 --- a/.github/workflows/wporg-deploy.yml +++ b/.github/workflows/wporg-deploy.yml @@ -7,7 +7,7 @@ name: Deploy to WordPress.org # # Needs the SVN_USERNAME and SVN_PASSWORD repository secrets. # -# 10up/action-wordpress-plugin-deploy 2.3.0 = 54bd289… +# Actions are pinned to exact commits; Dependabot proposes updates weekly. on: workflow_dispatch: @@ -33,7 +33,9 @@ jobs: exit 1 fi - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + with: + persist-credentials: false - name: Read version id: v @@ -47,7 +49,7 @@ jobs: sudo apt-get update -qq && sudo apt-get install -y -qq subversion bash .github/scripts/build-wporg.sh build - - uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 + - uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 # 2.3.0 env: SVN_USERNAME: ${{ secrets.SVN_USERNAME }} SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }} diff --git a/.github/workflows/wporg-readme.yml b/.github/workflows/wporg-readme.yml index d259bfe..6a9a421 100644 --- a/.github/workflows/wporg-readme.yml +++ b/.github/workflows/wporg-readme.yml @@ -8,7 +8,7 @@ name: Update WordPress.org readme # # Needs the SVN_USERNAME and SVN_PASSWORD repository secrets. # -# 10up/action-wordpress-plugin-asset-update 2.2.0 = 2480306… +# Actions are pinned to exact commits; Dependabot proposes updates weekly. on: workflow_dispatch: @@ -24,12 +24,14 @@ jobs: name: Update readme and images runs-on: ubuntu-latest steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + with: + persist-credentials: false - name: Install Subversion run: sudo apt-get update -qq && sudo apt-get install -y -qq subversion - - uses: 10up/action-wordpress-plugin-asset-update@2480306f6f693672726d08b5917ea114cb2825f7 + - uses: 10up/action-wordpress-plugin-asset-update@2480306f6f693672726d08b5917ea114cb2825f7 # 2.2.0 env: SVN_USERNAME: ${{ secrets.SVN_USERNAME }} SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }} diff --git a/README.md b/README.md index c3fcebc..e7f2c19 100644 --- a/README.md +++ b/README.md @@ -1133,7 +1133,7 @@ flowchart LR **Wiki.** The [wiki](https://github.com/CptNope/JAT-Shell-Scanner/wiki) is built from this README by `.github/scripts/build-wiki.py`, which splits the numbered sections into pages. The **Wiki** workflow rebuilds it whenever README.md changes on main, so edit the README, not the wiki. -Workflow actions are pinned to exact commits. Detection rules live in [`includes/signatures.php`](includes/signatures.php) — **new indicators are very welcome**: open an issue or pull request with a link to the source. +Workflow actions are pinned to exact commits, with the version in a comment. **Dependabot** proposes one grouped update a week, only for releases at least a week old, and **CodeQL** scans the workflows themselves for injection and over-broad permissions. Detection rules live in [`includes/signatures.php`](includes/signatures.php) — **new indicators are very welcome**: open an issue or pull request with a link to the source. ## 22. Limits