Harden GitHub Actions Workflow - publish-to-pypi.yml

[stepsecurity-app]

Summary

This issue is created by StepSecurity related to security issues in publish-to-pypi.yml . The platform has identified 2 vulnerabilities (1 critical, 0 high, 0 medium, 1 low).

Remediation Overview

The platform can generate remediations for a few vulnerabilities. For such vulnerabilities, you can find the fixed workflow file in the Suggested Fix For Auto-Remediable Issues section. You can manually deploy these changes or create a pull request by commenting @stepsecurity-app pull-request create on this issue.

If you’d like an automated pull request with the fixed workflow file, comment:

@stepsecurity-app pull-request create

Other issues require manual investigation and changes.

Once a vulnerability has been remediated, ✅ will appear in the title. Note that it may take up to 24 hours for these issues to be updated.

Please review the individual vulnerability section below and follow the recommended resolution steps.

Security Checks Details

❌ Network and runtime security monitoring should be enabled for GitHub-hosted runners

• Severity: Low

• Description: This check passes if the step-security/harden-runner GitHub Action is used in a job that runs on a GitHub-hosted runner. Harden-Runner prevents exfiltration of code and CI/CD credentials, and detects tampering of files during build.

• Resolution: Add the step-security/harden-runner GitHub Action to the job.

• Automated Remediation Available ?: true

• References:

  • GitHub Security Guide

  • The Open Source Security Foundation (OpenSSF) Security Guide

❌ Actions should be pinned to a full-length commit SHA

• Severity: Critical

• Description: GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.

• Resolution: Pin Actions to a full-length commit SHA..

• Automated Remediation Available ?: true

• References:

  • GitHub Security Guide

  • The Open Source Security Foundation (OpenSSF) Security Guide

Suggested Fix For Auto-Remediable Issues

Below is the updated workflow, which fixes the following security vulnerabilities:

• Network and runtime security monitoring should be enabled for GitHub-hosted runners

• Actions should be pinned to a full-length commit SHA

  name: 发布包到PyPI
  on:
    push:
      branches:
        - master
    pull_request:
      branches: [ "master" ]
      types: [closed]
  permissions:
    contents: read
    id-token: write
  jobs:
    release-build:
      runs-on: ubuntu-latest
      steps:
      - 
+ name: Harden the runner (Audit all outbound calls)
+       uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+       with:
+         egress-policy: audit
+     - 
  uses: actions/checkout@
+ 08eba0b27e820071cde6df949e0beb9ba4906955 # 
  v4
+ .3.0
      - name: 设置Python环境
        uses: actions/setup-python@
+ a26af69be951a213d495a4c3e4e4022e16d87065 # 
  v5
+ .6.0
        with:
          python-version: '3.x'
      - name: 构建发布分发包
        run: |
          python -m pip install build
          python -m build
      - name: 上传分发包作为工件
        uses: actions/upload-artifact@
+ ea165f8d65b6e75b540449e92b4886f43607fa02 # 
  v4
+ .6.2
        with:
          name: release-dists
          path: dist/
    pypi-publish:
      runs-on: ubuntu-latest
      needs: release-build
      if: ${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.merged) }}
      environment:
        name: pypi
        url: https://pypi.org/project/MZAPI
      steps:
      - name: 
+ Harden the runner (Audit all outbound calls)
+       uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+       with:
+         egress-policy: audit
+     - name: 
  检索发布分发包
        uses: actions/download-artifact@
+ d3f86a106a0bac45b974a628896c90dbdf5c8093 # 
  v4
+ .3.0
        with:
          name: release-dists
          path: dist/
      - name: 提取版本号
        id: extract_version
        run: |
          filename=$(ls dist/mzapi_python-*.whl)
          version=$(echo $filename | sed -e 's/.*-\([0-9]*\.[0-9]*\.[0-9]*\)-py3-none-any\.whl/\1/')
          echo "version=$version" >> $GITHUB_ENV
      - name: 将发布分发包发布到PyPI
        uses: pypa/gh-action-pypi-publish@
+ ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # 
  release/v1
        with:
          packages-dir: dist/
      - name: 安装twine
        run: |
          python -m pip install twine
      - name: Create GitHub release
        uses: softprops/action-gh-release@
+ 6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # 
  v2
+ .4.1
        with:
            tag_name: v${{ env.version }}
            name: Release v${{ env.version }}
            body: |
              🎉 发布新版本${{ env.version }} 🎉
              这是我们新版本${{ env.version }}的发布说明。本次发布包含了以下更改：
              ${{ github.event.head_commit.message }}！
            files: |
              dist/*.whl
              dist/*.tar.gz
            token: ${{ secrets.TOKEN }}

Additional Information

For more information, refer to the documentation page here.
Please don't make any changes in the description as the platform makes automated updates in description. Please use the comment section below to provide input.

Automated remediation commands and options

• Create a pull request with automated security fixes

@stepsecurity-app pull-request create

• Close this issue and prevent it from being reopened

@stepsecurity-app issue close <REASON>

• Update issue description with latest security check status

@stepsecurity-app issue force-update

• View all available commands and their usage

@stepsecurity-app help

Which GitHub Actions security best practices were evaluated?

The workflow was evaluated for the following GitHub Actions security best practices:

• Network & runtime security monitoring
• Token permissions
• Third‐party GitHub Actions usage & pinning

[github-actions]

This GitHub issue highlights security vulnerabilities detected in the publish-to-pypi.yml workflow by StepSecurity. Two vulnerabilities were identified: a critical issue requiring actions to be pinned to full-length commit SHAs (to prevent mutable tags and enhance security), and a low-severity issue recommending the use of the step-security/harden-runner GitHub Action to enable network and runtime security monitoring for GitHub-hosted runners. Automated remediation is available for these vulnerabilities via updated workflow configurations provided in the issue. Users can manually implement the fixes or request an automated pull request by commenting @stepsecurity-app pull-request create. Additional security guidance and resources are also provided for reference.