From 96e7d6cb3aa6f0f5077e5039e8fda220b82224e3 Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Tue, 14 Apr 2026 15:13:12 +0200 Subject: [PATCH] feat(security): security best practices from StepSecurity (#10682) Signed-off-by: StepSecurity Bot Co-authored-by: stepsecurity-app[bot] <188008098+stepsecurity-app[bot]@users.noreply.github.com> Co-authored-by: Pepe Fagoaga --- .github/workflows/api-bump-version.yml | 2 ++ .github/workflows/api-code-quality.yml | 2 ++ .github/workflows/api-codeql.yml | 2 ++ .github/workflows/api-container-build-push.yml | 2 ++ .github/workflows/api-container-checks.yml | 2 ++ .github/workflows/api-security.yml | 2 ++ .github/workflows/api-tests.yml | 2 ++ .github/workflows/backport.yml | 2 ++ .github/workflows/ci-zizmor.yml | 2 ++ .github/workflows/comment-label-update.yml | 2 ++ .github/workflows/conventional-commit.yml | 2 ++ .github/workflows/create-backport-label.yml | 2 ++ .github/workflows/docs-bump-version.yml | 2 ++ .github/workflows/find-secrets.yml | 2 ++ .github/workflows/helm-chart-checks.yml | 2 ++ .github/workflows/helm-chart-release.yml | 2 ++ .github/workflows/issue-lock-on-close.yml | 2 ++ .github/workflows/labeler.yml | 2 ++ .github/workflows/mcp-container-build-push.yml | 2 ++ .github/workflows/mcp-container-checks.yml | 2 ++ .github/workflows/mcp-pypi-release.yml | 2 ++ .github/workflows/pr-check-changelog.yml | 2 ++ .github/workflows/pr-check-compliance-mapping.yml | 2 ++ .github/workflows/pr-conflict-checker.yml | 2 ++ .github/workflows/pr-merged.yml | 2 ++ .github/workflows/prepare-release.yml | 2 ++ .github/workflows/sdk-bump-version.yml | 2 ++ .github/workflows/sdk-check-duplicate-test-names.yml | 2 ++ .github/workflows/sdk-code-quality.yml | 2 ++ .github/workflows/sdk-codeql.yml | 2 ++ .github/workflows/sdk-container-build-push.yml | 2 ++ .github/workflows/sdk-container-checks.yml | 2 ++ .github/workflows/sdk-pypi-release.yml | 2 ++ .github/workflows/sdk-refresh-aws-services-regions.yml | 2 ++ .github/workflows/sdk-refresh-oci-regions.yml | 2 ++ .github/workflows/sdk-security.yml | 2 ++ .github/workflows/sdk-tests.yml | 2 ++ .github/workflows/test-impact-analysis.yml | 2 ++ .github/workflows/ui-bump-version.yml | 2 ++ .github/workflows/ui-codeql.yml | 2 ++ .github/workflows/ui-container-build-push.yml | 2 ++ .github/workflows/ui-container-checks.yml | 2 ++ .github/workflows/ui-e2e-tests-v2.yml | 2 ++ .github/workflows/ui-tests.yml | 2 ++ 44 files changed, 88 insertions(+) diff --git a/.github/workflows/api-bump-version.yml b/.github/workflows/api-bump-version.yml index 7ddbf195f5..6abdc8c84c 100644 --- a/.github/workflows/api-bump-version.yml +++ b/.github/workflows/api-bump-version.yml @@ -13,6 +13,8 @@ env: PROWLER_VERSION: ${{ github.event.release.tag_name }} BASE_BRANCH: master +permissions: {} + jobs: detect-release-type: runs-on: ubuntu-latest diff --git a/.github/workflows/api-code-quality.yml b/.github/workflows/api-code-quality.yml index a859a77e04..1724e51d70 100644 --- a/.github/workflows/api-code-quality.yml +++ b/.github/workflows/api-code-quality.yml @@ -17,6 +17,8 @@ concurrency: env: API_WORKING_DIR: ./api +permissions: {} + jobs: api-code-quality: runs-on: ubuntu-latest diff --git a/.github/workflows/api-codeql.yml b/.github/workflows/api-codeql.yml index 3832900a89..915a5b2722 100644 --- a/.github/workflows/api-codeql.yml +++ b/.github/workflows/api-codeql.yml @@ -24,6 +24,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: api-analyze: name: CodeQL Security Analysis diff --git a/.github/workflows/api-container-build-push.yml b/.github/workflows/api-container-build-push.yml index b045bb0322..e6403ed689 100644 --- a/.github/workflows/api-container-build-push.yml +++ b/.github/workflows/api-container-build-push.yml @@ -33,6 +33,8 @@ env: PROWLERCLOUD_DOCKERHUB_REPOSITORY: prowlercloud PROWLERCLOUD_DOCKERHUB_IMAGE: prowler-api +permissions: {} + jobs: setup: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/api-container-checks.yml b/.github/workflows/api-container-checks.yml index 5192d1bd07..5b59939db9 100644 --- a/.github/workflows/api-container-checks.yml +++ b/.github/workflows/api-container-checks.yml @@ -18,6 +18,8 @@ env: API_WORKING_DIR: ./api IMAGE_NAME: prowler-api +permissions: {} + jobs: api-dockerfile-lint: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/api-security.yml b/.github/workflows/api-security.yml index a1a8b3fd82..9323df97c3 100644 --- a/.github/workflows/api-security.yml +++ b/.github/workflows/api-security.yml @@ -17,6 +17,8 @@ concurrency: env: API_WORKING_DIR: ./api +permissions: {} + jobs: api-security-scans: runs-on: ubuntu-latest diff --git a/.github/workflows/api-tests.yml b/.github/workflows/api-tests.yml index d4eb30e821..3d4e7e1799 100644 --- a/.github/workflows/api-tests.yml +++ b/.github/workflows/api-tests.yml @@ -30,6 +30,8 @@ env: VALKEY_DB: 0 API_WORKING_DIR: ./api +permissions: {} + jobs: api-tests: runs-on: ubuntu-latest diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index 3563db7154..5895188634 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -17,6 +17,8 @@ env: BACKPORT_LABEL_PREFIX: backport-to- BACKPORT_LABEL_IGNORE: was-backported +permissions: {} + jobs: backport: if: github.event.pull_request.merged == true && !(contains(github.event.pull_request.labels.*.name, 'backport')) && !(contains(github.event.pull_request.labels.*.name, 'was-backported')) diff --git a/.github/workflows/ci-zizmor.yml b/.github/workflows/ci-zizmor.yml index 2c8d61b961..a66af9684c 100644 --- a/.github/workflows/ci-zizmor.yml +++ b/.github/workflows/ci-zizmor.yml @@ -21,6 +21,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: zizmor: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/comment-label-update.yml b/.github/workflows/comment-label-update.yml index 3f5f3bb01f..9649d18cfc 100644 --- a/.github/workflows/comment-label-update.yml +++ b/.github/workflows/comment-label-update.yml @@ -9,6 +9,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.issue.number }} cancel-in-progress: false +permissions: {} + jobs: update-labels: if: contains(github.event.issue.labels.*.name, 'status/awaiting-response') diff --git a/.github/workflows/conventional-commit.yml b/.github/workflows/conventional-commit.yml index a1195ef389..5fc31003a4 100644 --- a/.github/workflows/conventional-commit.yml +++ b/.github/workflows/conventional-commit.yml @@ -16,6 +16,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number }} cancel-in-progress: true +permissions: {} + jobs: conventional-commit-check: runs-on: ubuntu-latest diff --git a/.github/workflows/create-backport-label.yml b/.github/workflows/create-backport-label.yml index 334406f76f..d7aa5709ae 100644 --- a/.github/workflows/create-backport-label.yml +++ b/.github/workflows/create-backport-label.yml @@ -13,6 +13,8 @@ env: BACKPORT_LABEL_PREFIX: backport-to- BACKPORT_LABEL_COLOR: B60205 +permissions: {} + jobs: create-label: runs-on: ubuntu-latest diff --git a/.github/workflows/docs-bump-version.yml b/.github/workflows/docs-bump-version.yml index e8c33ae53e..c1e3f6afb4 100644 --- a/.github/workflows/docs-bump-version.yml +++ b/.github/workflows/docs-bump-version.yml @@ -13,6 +13,8 @@ env: PROWLER_VERSION: ${{ github.event.release.tag_name }} BASE_BRANCH: master +permissions: {} + jobs: detect-release-type: runs-on: ubuntu-latest diff --git a/.github/workflows/find-secrets.yml b/.github/workflows/find-secrets.yml index af0a9c7e78..0aa955413f 100644 --- a/.github/workflows/find-secrets.yml +++ b/.github/workflows/find-secrets.yml @@ -14,6 +14,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: scan-secrets: runs-on: ubuntu-latest diff --git a/.github/workflows/helm-chart-checks.yml b/.github/workflows/helm-chart-checks.yml index 3cc857abd7..66f5954f69 100644 --- a/.github/workflows/helm-chart-checks.yml +++ b/.github/workflows/helm-chart-checks.yml @@ -21,6 +21,8 @@ concurrency: env: CHART_PATH: contrib/k8s/helm/prowler-app +permissions: {} + jobs: helm-lint: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/helm-chart-release.yml b/.github/workflows/helm-chart-release.yml index e947f8af82..43dcf4d355 100644 --- a/.github/workflows/helm-chart-release.yml +++ b/.github/workflows/helm-chart-release.yml @@ -13,6 +13,8 @@ concurrency: env: CHART_PATH: contrib/k8s/helm/prowler-app +permissions: {} + jobs: release-helm-chart: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/issue-lock-on-close.yml b/.github/workflows/issue-lock-on-close.yml index 27c7da0bb9..1848585745 100644 --- a/.github/workflows/issue-lock-on-close.yml +++ b/.github/workflows/issue-lock-on-close.yml @@ -9,6 +9,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.issue.number }} cancel-in-progress: false +permissions: {} + jobs: lock: if: | diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index a42d6e1f73..621a763da5 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -15,6 +15,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number }} cancel-in-progress: true +permissions: {} + jobs: labeler: runs-on: ubuntu-latest diff --git a/.github/workflows/mcp-container-build-push.yml b/.github/workflows/mcp-container-build-push.yml index 27d59d7bc1..90157db9ab 100644 --- a/.github/workflows/mcp-container-build-push.yml +++ b/.github/workflows/mcp-container-build-push.yml @@ -32,6 +32,8 @@ env: PROWLERCLOUD_DOCKERHUB_REPOSITORY: prowlercloud PROWLERCLOUD_DOCKERHUB_IMAGE: prowler-mcp +permissions: {} + jobs: setup: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/mcp-container-checks.yml b/.github/workflows/mcp-container-checks.yml index a8f760544f..b205232b0c 100644 --- a/.github/workflows/mcp-container-checks.yml +++ b/.github/workflows/mcp-container-checks.yml @@ -18,6 +18,8 @@ env: MCP_WORKING_DIR: ./mcp_server IMAGE_NAME: prowler-mcp +permissions: {} + jobs: mcp-dockerfile-lint: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/mcp-pypi-release.yml b/.github/workflows/mcp-pypi-release.yml index d6272034ec..cccda1f664 100644 --- a/.github/workflows/mcp-pypi-release.yml +++ b/.github/workflows/mcp-pypi-release.yml @@ -14,6 +14,8 @@ env: PYTHON_VERSION: "3.12" WORKING_DIRECTORY: ./mcp_server +permissions: {} + jobs: validate-release: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/pr-check-changelog.yml b/.github/workflows/pr-check-changelog.yml index c021e079cc..fa01ba4cbe 100644 --- a/.github/workflows/pr-check-changelog.yml +++ b/.github/workflows/pr-check-changelog.yml @@ -16,6 +16,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number }} cancel-in-progress: true +permissions: {} + jobs: check-changelog: if: contains(github.event.pull_request.labels.*.name, 'no-changelog') == false diff --git a/.github/workflows/pr-check-compliance-mapping.yml b/.github/workflows/pr-check-compliance-mapping.yml index 939e17d0b4..1ed78995bb 100644 --- a/.github/workflows/pr-check-compliance-mapping.yml +++ b/.github/workflows/pr-check-compliance-mapping.yml @@ -16,6 +16,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number }} cancel-in-progress: true +permissions: {} + jobs: check-compliance-mapping: if: contains(github.event.pull_request.labels.*.name, 'no-compliance-check') == false diff --git a/.github/workflows/pr-conflict-checker.yml b/.github/workflows/pr-conflict-checker.yml index e53a34ea23..667f807be8 100644 --- a/.github/workflows/pr-conflict-checker.yml +++ b/.github/workflows/pr-conflict-checker.yml @@ -15,6 +15,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number }} cancel-in-progress: true +permissions: {} + jobs: check-conflicts: runs-on: ubuntu-latest diff --git a/.github/workflows/pr-merged.yml b/.github/workflows/pr-merged.yml index 62eca02e58..4a98ac70c4 100644 --- a/.github/workflows/pr-merged.yml +++ b/.github/workflows/pr-merged.yml @@ -12,6 +12,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number }} cancel-in-progress: false +permissions: {} + jobs: trigger-cloud-pull-request: if: | diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index faa50d758f..4ff8fc049c 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -17,6 +17,8 @@ concurrency: env: PROWLER_VERSION: ${{ inputs.prowler_version }} +permissions: {} + jobs: prepare-release: if: github.event_name == 'workflow_dispatch' && github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/sdk-bump-version.yml b/.github/workflows/sdk-bump-version.yml index 99010c6af3..f899a84d1d 100644 --- a/.github/workflows/sdk-bump-version.yml +++ b/.github/workflows/sdk-bump-version.yml @@ -13,6 +13,8 @@ env: PROWLER_VERSION: ${{ github.event.release.tag_name }} BASE_BRANCH: master +permissions: {} + jobs: detect-release-type: runs-on: ubuntu-latest diff --git a/.github/workflows/sdk-check-duplicate-test-names.yml b/.github/workflows/sdk-check-duplicate-test-names.yml index ac8a01d117..17c595ca11 100644 --- a/.github/workflows/sdk-check-duplicate-test-names.yml +++ b/.github/workflows/sdk-check-duplicate-test-names.yml @@ -10,6 +10,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: check-duplicate-test-names: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/sdk-code-quality.yml b/.github/workflows/sdk-code-quality.yml index d73547c94d..b777ee1657 100644 --- a/.github/workflows/sdk-code-quality.yml +++ b/.github/workflows/sdk-code-quality.yml @@ -14,6 +14,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: sdk-code-quality: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/sdk-codeql.yml b/.github/workflows/sdk-codeql.yml index fa5056c2d6..0985ec1228 100644 --- a/.github/workflows/sdk-codeql.yml +++ b/.github/workflows/sdk-codeql.yml @@ -30,6 +30,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: sdk-analyze: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/sdk-container-build-push.yml b/.github/workflows/sdk-container-build-push.yml index bedc6a209e..6d606f21be 100644 --- a/.github/workflows/sdk-container-build-push.yml +++ b/.github/workflows/sdk-container-build-push.yml @@ -47,6 +47,8 @@ env: # AWS configuration (for ECR) AWS_REGION: us-east-1 +permissions: {} + jobs: setup: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/sdk-container-checks.yml b/.github/workflows/sdk-container-checks.yml index d0a46a8c98..3474df676e 100644 --- a/.github/workflows/sdk-container-checks.yml +++ b/.github/workflows/sdk-container-checks.yml @@ -17,6 +17,8 @@ concurrency: env: IMAGE_NAME: prowler +permissions: {} + jobs: sdk-dockerfile-lint: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/sdk-pypi-release.yml b/.github/workflows/sdk-pypi-release.yml index dd333de257..1932e84ed7 100644 --- a/.github/workflows/sdk-pypi-release.yml +++ b/.github/workflows/sdk-pypi-release.yml @@ -13,6 +13,8 @@ env: RELEASE_TAG: ${{ github.event.release.tag_name }} PYTHON_VERSION: '3.12' +permissions: {} + jobs: validate-release: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/sdk-refresh-aws-services-regions.yml b/.github/workflows/sdk-refresh-aws-services-regions.yml index ce8d1c8292..3ece09e8a5 100644 --- a/.github/workflows/sdk-refresh-aws-services-regions.yml +++ b/.github/workflows/sdk-refresh-aws-services-regions.yml @@ -13,6 +13,8 @@ env: PYTHON_VERSION: '3.12' AWS_REGION: 'us-east-1' +permissions: {} + jobs: refresh-aws-regions: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/sdk-refresh-oci-regions.yml b/.github/workflows/sdk-refresh-oci-regions.yml index 67f87076b7..958d5beb80 100644 --- a/.github/workflows/sdk-refresh-oci-regions.yml +++ b/.github/workflows/sdk-refresh-oci-regions.yml @@ -12,6 +12,8 @@ concurrency: env: PYTHON_VERSION: '3.12' +permissions: {} + jobs: refresh-oci-regions: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/sdk-security.yml b/.github/workflows/sdk-security.yml index e2e620d09c..c13061ff1b 100644 --- a/.github/workflows/sdk-security.yml +++ b/.github/workflows/sdk-security.yml @@ -14,6 +14,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: sdk-security-scans: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/sdk-tests.yml b/.github/workflows/sdk-tests.yml index ee46875a11..d63ed38834 100644 --- a/.github/workflows/sdk-tests.yml +++ b/.github/workflows/sdk-tests.yml @@ -14,6 +14,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: sdk-tests: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/test-impact-analysis.yml b/.github/workflows/test-impact-analysis.yml index 34a1536cbc..88500551f2 100644 --- a/.github/workflows/test-impact-analysis.yml +++ b/.github/workflows/test-impact-analysis.yml @@ -31,6 +31,8 @@ on: description: "Whether there are UI E2E tests to run" value: ${{ jobs.analyze.outputs.has-ui-e2e }} +permissions: {} + jobs: analyze: runs-on: ubuntu-latest diff --git a/.github/workflows/ui-bump-version.yml b/.github/workflows/ui-bump-version.yml index 9566c53006..273778e1c2 100644 --- a/.github/workflows/ui-bump-version.yml +++ b/.github/workflows/ui-bump-version.yml @@ -13,6 +13,8 @@ env: PROWLER_VERSION: ${{ github.event.release.tag_name }} BASE_BRANCH: master +permissions: {} + jobs: detect-release-type: runs-on: ubuntu-latest diff --git a/.github/workflows/ui-codeql.yml b/.github/workflows/ui-codeql.yml index c4ab182e92..c8b65e77d3 100644 --- a/.github/workflows/ui-codeql.yml +++ b/.github/workflows/ui-codeql.yml @@ -26,6 +26,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: ui-analyze: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/ui-container-build-push.yml b/.github/workflows/ui-container-build-push.yml index 4b73540b9b..6fab2d1efb 100644 --- a/.github/workflows/ui-container-build-push.yml +++ b/.github/workflows/ui-container-build-push.yml @@ -35,6 +35,8 @@ env: # Build args NEXT_PUBLIC_API_BASE_URL: http://prowler-api:8080/api/v1 +permissions: {} + jobs: setup: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/ui-container-checks.yml b/.github/workflows/ui-container-checks.yml index 04775fce25..eb7b508b58 100644 --- a/.github/workflows/ui-container-checks.yml +++ b/.github/workflows/ui-container-checks.yml @@ -18,6 +18,8 @@ env: UI_WORKING_DIR: ./ui IMAGE_NAME: prowler-ui +permissions: {} + jobs: ui-dockerfile-lint: if: github.repository == 'prowler-cloud/prowler' diff --git a/.github/workflows/ui-e2e-tests-v2.yml b/.github/workflows/ui-e2e-tests-v2.yml index a83073b16d..2a91e460be 100644 --- a/.github/workflows/ui-e2e-tests-v2.yml +++ b/.github/workflows/ui-e2e-tests-v2.yml @@ -15,6 +15,8 @@ on: - 'ui/**' - 'api/**' # API changes can affect UI E2E +permissions: {} + jobs: # First, analyze which tests need to run impact-analysis: diff --git a/.github/workflows/ui-tests.yml b/.github/workflows/ui-tests.yml index 631af22615..c11e90b8f4 100644 --- a/.github/workflows/ui-tests.yml +++ b/.github/workflows/ui-tests.yml @@ -18,6 +18,8 @@ env: UI_WORKING_DIR: ./ui NODE_VERSION: '24.13.0' +permissions: {} + jobs: ui-tests: runs-on: ubuntu-latest