Secure workflows against supply-chain attacks

[DougReeder]

The Problem

Supply-chain attacks against GitHub workflows are now frequent enough that we must act.

Our remediation

Run zizmor (or an equivalent tool) on each workflow and assess the recommendations

cd localrepo
docker run --rm --name zizmor -v .:/usr/repo ghcr.io/zizmorcore/zizmor --fix=all /usr/repo

Determine what permissions are needed for each workflow and then set the permissions accordingly

You can find the needed permissions by creating a testing branch and adding the following line to the start of each job (so it becomes the first step) in the workflow file, then push the modified workflow to your fork and run it (if it doesn't run automatically).

- uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 #v1 Beta 9

Note: workflows that are limited to Hubs Foundation repositories will need to be modified to work on your fork. Also, some workflows may only be triggerable when on the default branch, in which case you'll need to make the changes there and revert afterwards. Finally, there are some cases where this may not work, e.g. if the workflow uses the graphql api, so if this is the case, then you'll need to disable all permissions for the workflow file and turn on the ones GitHub complains about when running the workflow.

Main repos check status

• .github
  PR: no changes needed

• hubs-blender-exporter
  PR: CI: Removes unneeded permissions & pins action versions hubs-blender-exporter#348

• hubs-cloud
  PR: Restrict default-branch-pr-guard workflow to minimum required permissions and apply Zizmor fixes hubs-cloud#401

• hubs-compose
  PR: no changes needed

• hubs-docs
  PR: Increase publish workflow security and tighten permissions hubs-docs#273
  Restrict hubs-docs workflow to minimum required permissions hubs-docs#274

• hubs-ops
  PR: Pin GitHub Actions to specific commit SHAs for supply chain security hubs-ops#212
  Apply Zizmor fixes to increase HcPkgPreReleaseGitops workflow security hubs-ops#214
  Increase turkeyGitops workflow security and tighten permissions hubs-ops#215

• dialog
  PR: Restrict dialog workflow to minimum required permissions dialog#65

• hubs
  PR: Remediates weaknesses in CI, as advised by zizmor hubs#6578
  CI: storybook given write contents perms; RetPageOrigin removes all hubs#6584

• nearspark
  PR: Restrict nearspark workflow to minimum required permissions nearspark#37

• photomnemonic
  PR: Restrict photomnemonic workflow to minimum required permissions photomnemonic#39

• reticulum
  PR: Increase lint-and-test workflow security and tighten permissions reticulum#753
  Restrict ret-turkey workflow to minimum required permissions reticulum#754

• speelycaptor
  PR: Restrict speelycaptor workflow to minimum required permissions speelycaptor#22

• spoke
  PR: Restrict spoke-RetPageOrigin workflow to minimum required permissions Spoke#1315

Change Default workflow permissions

When all the workflows we actually use have been tightened up, we'll

• change the Hubs-Foundation default workflow permissions to "Read repository contents and packages permissions"

Other repos

• aframe
  PR: no changes needed

• aframe-physics-system
  PR: no changes needed

• ammo-debug-drawer
  PR: no changes needed

• ammo.js
  PR: no changes needed

• anime
  PR: no changes needed

• avatar-texture-tool
  PR: no changes needed

• bitECS
  PR:

• blender-behavior-graph-examples
  PR: no changes needed

• blender-gltf-behavior-graph
  PR: no changes needed

• buffered-interpolation
  PR: no changes needed

• coturn
  PR: no changes needed

• gltf-navmesh-generator
  PR: no changes needed

• hubs-architecture-kit
  PR: no changes needed

• hubs-atrium-environment
  PR:

• hubs-avatar-pipelines
  PR: no changes needed

• Hubs-Backup-Tool
  PR:

• hubs-behavior-graphs-addon
  PR: no changes needed

• hubs-blender-files
  PR: no changes needed

• hubs-configtool
  PR: no changes needed

• hubs-discord-bot
  PR: no changes needed

• hubs-duck-addon
  PR: no changes needed

• hubs-github-build-size-bot
  PR: no changes needed

• hubs-glb-tools
  PR: no changes needed

• hubs-portals-addon
  PR: no changes needed

• hubs-postprocessing-addon
  PR: no changes needed

• hubs-rock-kit
  PR: no changes needed

• hubs-sound-pack
  PR: no changes needed

• hubs-template-addon
  PR: no changes needed

• hubs-ts-types
  PR: no changes needed

• ita
  PR: no changes needed

• lib-hubs
  PR: no changes needed

• main-website
  PR: no changes needed

• networked-aframe
  PR: no changes needed

• nipplejs
  PR: no changes needed

• phoenix-js
  PR: no changes needed

• policies-procedures-guidelines-public
  PR: no changes needed

• press-release-kit (Private Repo)
  PR: no changes needed

• spoke-react-components
  PR: no changes needed

• spritesheet.js
  PR: no changes needed

• three-ammo
  PR: no changes needed

• three-batch-manager
  PR: no changes needed

• three-bmfont-text
  PR: no changes needed

• three-pathfinding
  PR: no changes needed

• three-to-ammo
  PR: no changes needed

• three.js
  PR: no changes needed

• turkey-ops
  PR:

• turkey-portal
  PR:

• webcontainers (Private Repo)
  PR: no changes needed

[github-actions]

Thank you for the issue.

ROADMAP STATUS: This issue isn't currently on any roadmap. Updates will be conveyed here as its place on/off a roadmap changes.

You can view the roadmaps here: Roadmaps Google Drive folder.

For more information on how the roadmaps work, see our roadmaps policy on GitHub.

[Exairnous]

I updated the issue description to include instructions for checking workflow permissions, plus I added some commonly used repositories to the main repo check list, and have added/marked all the repositories that only contain the roadmap auto commenter as completed, since the permissions have been figured out already and the output of Zizmor doesn't raise any concerns (it was previously decided not to pin our own actions and the usage of pull_request_target should be completely safe since we're not processing any untrusted input).

Output of Zizmor for the .github repository (which only contains the roadmap auto commenter workflows):

 INFO zizmor: 🌈 zizmor v1.25.2
 INFO audit: zizmor: 🌈 completed /usr/repo/.github/workflows/reusable-roadmap-auto-commenter.yml
 INFO audit: zizmor: 🌈 completed /usr/repo/.github/workflows/roadmap-auto-commenter.yml
error[dangerous-triggers]: use of fundamentally insecure workflow trigger
  --> /usr/repo/.github/workflows/roadmap-auto-commenter.yml:6:1
   |
 6 | / on:
 7 | |   issues:
 8 | |     types:
 9 | |       - opened
10 | |   pull_request_target:
11 | |     types:
12 | |       - opened
   | |______________^ pull_request_target is almost always used insecurely
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#dangerous-triggers

error[unpinned-uses]: unpinned action reference
  --> /usr/repo/.github/workflows/roadmap-auto-commenter.yml:19:11
   |
19 |     uses: Hubs-Foundation/.github/.github/workflows/reusable-roadmap-auto-commenter.yml@main
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

9 findings (7 suppressed): 0 informational, 0 low, 0 medium, 2 high
No fixes available to apply.

[Exairnous]

@DougReeder I think we can remove the references to repositories yet to be created because I expect the change to the default workflow permissions setting will happen long before they are created.

[Exairnous]

Decided to add all the repos to the issue because after listing all the ones that didn't need changing, there were only five not on the list.

[Exairnous]

Updated the issue to remove the references to repositories yet to be created.

[Exairnous]

Updated the zizmor command in the issue to remove the container after running.