Harden GitHub Actions Workflow - stale.yml

[stepsecurity-app]

Summary

This issue is created by StepSecurity related to security issues in stale.yml . The platform has identified 1 vulnerability (0 critical, 0 high, 0 medium, 1 low).

Remediation Overview

The platform can generate remediations for a few vulnerabilities. For such vulnerabilities, you can find the fixed workflow file in the Suggested Fix For Auto-Remediable Issues section. You can manually deploy these changes or create a pull request by commenting @stepsecurity-app pull-request create on this issue.

If you’d like an automated pull request with the fixed workflow file, comment:

@stepsecurity-app pull-request create

Other issues require manual investigation and changes.

Once a vulnerability has been remediated, ✅ will appear in the title. Note that it may take up to 24 hours for these issues to be updated.

Please review the individual vulnerability section below and follow the recommended resolution steps.

Security Checks Details

❌ Network and runtime security monitoring should be enabled for GitHub-hosted runners

• Severity: Low

• Description: This check passes if the step-security/harden-runner GitHub Action is used in a job that runs on a GitHub-hosted runner. Harden-Runner prevents exfiltration of code and CI/CD credentials, and detects tampering of files during build.

• Resolution: Add the step-security/harden-runner GitHub Action to the job.

• Automated Remediation Available ?: true

• References:

  • GitHub Security Guide

  • The Open Source Security Foundation (OpenSSF) Security Guide

✅ Actions should be pinned to a full-length commit SHA

• Severity: Critical

• Description: GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.

• Resolution: Pin Actions to a full-length commit SHA..

• Automated Remediation Available ?: true

• References:

  • GitHub Security Guide

  • The Open Source Security Foundation (OpenSSF) Security Guide

Suggested Fix For Auto-Remediable Issues

Below is the updated workflow, which fixes the following security vulnerabilities:

• Network and runtime security monitoring should be enabled for GitHub-hosted runners

  # 此工作流会对长时间没有活动的issues和PRs发出警告，并在一定时间后关闭它们。
  #
  # 你可以通过修改此文件来调整行为。
  # 更多信息，请参阅：
  # https://github.com/actions/stale
  name: 标记不活跃的issues和pull requests
  on:
    schedule:
    - cron: '37 21 * * *'
  jobs:
    stale:
      runs-on: ubuntu-latest
      permissions:
        issues: write
        pull-requests: write
      steps:
      - 
+ name: Harden the runner (Audit all outbound calls)
+       uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+       with:
+         egress-policy: audit
+     - 
  uses: actions/stale@v5
        with:
          repo-token: ${{ secrets.TOKEN }}
          stale-issue-message: '此Issue已长时间没有活动'
          stale-pr-message: '此Pull Request已长时间没有活动'
          stale-issue-label: '无issue活动'
          stale-pr-label: '无pr活动'

Additional Information

For more information, refer to the documentation page here.
Please don't make any changes in the description as the platform makes automated updates in description. Please use the comment section below to provide input.

Automated remediation commands and options

• Create a pull request with automated security fixes

@stepsecurity-app pull-request create

• Close this issue and prevent it from being reopened

@stepsecurity-app issue close <REASON>

• Update issue description with latest security check status

@stepsecurity-app issue force-update

• View all available commands and their usage

@stepsecurity-app help

Which GitHub Actions security best practices were evaluated?

The workflow was evaluated for the following GitHub Actions security best practices:

• Network & runtime security monitoring
• Token permissions
• Third‐party GitHub Actions usage & pinning

[github-actions]

该GitHub issue是关于改进 stale.yml 工作流文件的安全性，突出两个安全问题：1个严重问题（actions未固定至完整的commit SHA）和1个低风险问题（缺少网络和运行时安全监控）。平台建议将GitHub Actions固定到完整的commit SHA，并在工作流中引入 step-security/harden-runner 以增强运行时安全监控。这些问题可以通过自动生成的修复文件解决，用户可以选择手动应用这些更改或通过评论启用自动拉取请求（PR）。此外，修复后问题状态会更新为✅，并可能需要24小时同步。有关具体修复步骤和更多信息，请参阅相关文档和安全指南。