From dbb31dbb43ea661d86be4b4836aeccd01ac69594 Mon Sep 17 00:00:00 2001 From: schapron Date: Mon, 21 Sep 2026 15:18:12 +0200 Subject: [PATCH 1/3] enh(secu): stop persisting checkout credentials in scan workflows Harden the checkout step of the dependency-analysis and gitleaks-analysis reusable workflows: rename to "Checkout sources", pin actions/checkout to de0fac2e # v6.0.2, and set `persist-credentials: false` so the GITHUB_TOKEN is not left in the runner git config after checkout. gitleaks keeps fetch-depth: 0. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/dependency-analysis.yml | 6 ++++-- .github/workflows/gitleaks-analysis.yml | 5 +++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/dependency-analysis.yml b/.github/workflows/dependency-analysis.yml index 171b54ac..d4a52891 100644 --- a/.github/workflows/dependency-analysis.yml +++ b/.github/workflows/dependency-analysis.yml @@ -14,8 +14,10 @@ jobs: runs-on: ${{ github.repository_visibility != 'public' && (github.repository_owner == 'centreon' && 'centreon-security' || github.repository_owner == 'quanta-computing' && 'quanta-security') || 'ubuntu-24.04' }} steps: - - name: Checkout Repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - name: Checkout sources + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Check dependencies type and lockfiles version run: | diff --git a/.github/workflows/gitleaks-analysis.yml b/.github/workflows/gitleaks-analysis.yml index f5f83dea..3e606a2b 100644 --- a/.github/workflows/gitleaks-analysis.yml +++ b/.github/workflows/gitleaks-analysis.yml @@ -9,10 +9,11 @@ jobs: runs-on: ${{ github.repository_visibility != 'public' && (github.repository_owner == 'centreon' && 'centreon-security' || github.repository_owner == 'quanta-computing' && 'quanta-security') || 'ubuntu-24.04' }} steps: - - name: Checkout Repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - name: Checkout sources + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 + persist-credentials: false - name: Run secret scan uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 From 8d7f6c66cb7ebabf3eadb0f9e1c554ba6c8748db Mon Sep 17 00:00:00 2001 From: schapron Date: Mon, 21 Sep 2026 15:32:06 +0200 Subject: [PATCH 2/3] fix(secu): keep actions/checkout at v7.0.1 in the hardened checkout Per decision to standardise on checkout v7.0.1 everywhere: pin the hardened "Checkout sources" step to 3d3c42e5 # v7.0.1 (instead of v6.0.2) in both reusable workflows. persist-credentials: false and the rename are unchanged. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/dependency-analysis.yml | 2 +- .github/workflows/gitleaks-analysis.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependency-analysis.yml b/.github/workflows/dependency-analysis.yml index d4a52891..5087bd69 100644 --- a/.github/workflows/dependency-analysis.yml +++ b/.github/workflows/dependency-analysis.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Checkout sources - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/gitleaks-analysis.yml b/.github/workflows/gitleaks-analysis.yml index 3e606a2b..027fa85e 100644 --- a/.github/workflows/gitleaks-analysis.yml +++ b/.github/workflows/gitleaks-analysis.yml @@ -10,7 +10,7 @@ jobs: steps: - name: Checkout sources - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false From 6e1f530ebbefbe1e702cc20a35cb9f7be8038c3d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Chapron?= <34628915+sc979@users.noreply.github.com> Date: Tue, 29 Sep 2026 16:22:36 +0200 Subject: [PATCH 3/3] Apply suggestion from @sc979 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Stéphane Chapron <34628915+sc979@users.noreply.github.com> --- .github/workflows/dependency-analysis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependency-analysis.yml b/.github/workflows/dependency-analysis.yml index 5087bd69..96f02587 100644 --- a/.github/workflows/dependency-analysis.yml +++ b/.github/workflows/dependency-analysis.yml @@ -14,7 +14,7 @@ jobs: runs-on: ${{ github.repository_visibility != 'public' && (github.repository_owner == 'centreon' && 'centreon-security' || github.repository_owner == 'quanta-computing' && 'quanta-security') || 'ubuntu-24.04' }} steps: - - name: Checkout sources + - name: Checkout Repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false