From 80335d88d14ce70b5fe43a7fa441e039df04a8b2 Mon Sep 17 00:00:00 2001
From: StepSecurity Bot <bot@stepsecurity.io>
Date: Fri, 22 Mar 2024 14:19:11 -0700
Subject: [PATCH] [StepSecurity] Apply security best practices (#17811)

---
 .github/workflows/dependency-review.yml | 27 +++++++++++++++++++
 .pre-commit-config.yaml                 | 35 +++++++++++++++++++++++++
 ee/vulnerability-dashboard/Dockerfile   |  2 +-
 infrastructure/kubequery/Dockerfile     |  4 +--
 server/mdm/scep/Dockerfile              |  2 +-
 tools/tuf/test/Dockerfile               |  2 +-
 6 files changed, 67 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/dependency-review.yml
 create mode 100644 .pre-commit-config.yaml

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 000000000..3f3456223
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,27 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 000000000..aee960260
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,35 @@
+repos:
+- repo: https://github.com/digitalpulp/pre-commit-php
+  rev: 1.4.0
+  hooks:
+  - id: php-lint-all
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.16.3
+  hooks:
+  - id: gitleaks
+- repo: https://github.com/golangci/golangci-lint
+  rev: v1.52.2
+  hooks:
+  - id: golangci-lint
+- repo: https://github.com/jumanjihouse/pre-commit-hooks
+  rev: 3.0.0
+  hooks:
+  - id: RuboCop
+  - id: shellcheck
+- repo: https://github.com/pocc/pre-commit-hooks
+  rev: v1.3.5
+  hooks:
+  - id: cpplint
+- repo: https://github.com/pre-commit/mirrors-eslint
+  rev: v8.38.0
+  hooks:
+  - id: eslint
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace
+- repo: https://github.com/pylint-dev/pylint
+  rev: v2.17.2
+  hooks:
+  - id: pylint
diff --git a/ee/vulnerability-dashboard/Dockerfile b/ee/vulnerability-dashboard/Dockerfile
index 84a2056fd..0d96a8a8f 100644
--- a/ee/vulnerability-dashboard/Dockerfile
+++ b/ee/vulnerability-dashboard/Dockerfile
@@ -1,5 +1,5 @@
 # Use the official Node.js 14 image as a base
-FROM node:20
+FROM node:20@sha256:e06aae17c40c7a6b5296ca6f942a02e6737ae61bbbf3e2158624bb0f887991b5
 
 # Set the working directory in the container
 WORKDIR /usr/src/app
diff --git a/infrastructure/kubequery/Dockerfile b/infrastructure/kubequery/Dockerfile
index a3088c1a3..5480212ad 100644
--- a/infrastructure/kubequery/Dockerfile
+++ b/infrastructure/kubequery/Dockerfile
@@ -5,7 +5,7 @@
 #
 # SPDX-License-Identifier: (Apache-2.0 OR GPL-2.0-only)
 
-FROM ubuntu:20.04 AS builder
+FROM ubuntu:20.04@sha256:80ef4a44043dec4490506e6cc4289eeda2d106a70148b74b5ae91ee670e9c35d AS builder
 
 ARG BASEQUERY_VERSION=5.0.2
 
@@ -15,7 +15,7 @@ RUN dpkg -i /tmp/basequery.deb
 
 # =====
 
-FROM uptycs/busybox:v1.33.0
+FROM uptycs/busybox:v1.33.0@sha256:6a312f5959d374420eedce83f42d2ad19a027bd4e448ed734372bc1a07ad8b10
 
 ARG BASEQUERY_VERSION
 ARG KUBEQUERY_VERSION
diff --git a/server/mdm/scep/Dockerfile b/server/mdm/scep/Dockerfile
index c34882b76..89e0abca6 100644
--- a/server/mdm/scep/Dockerfile
+++ b/server/mdm/scep/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3
+FROM alpine:3@sha256:c5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b
 
 COPY ./scepclient-linux-amd64 /usr/bin/scepclient
 COPY ./scepserver-linux-amd64 /usr/bin/scepserver
diff --git a/tools/tuf/test/Dockerfile b/tools/tuf/test/Dockerfile
index eef0bfc90..d83db1c41 100644
--- a/tools/tuf/test/Dockerfile
+++ b/tools/tuf/test/Dockerfile
@@ -1,4 +1,4 @@
-FROM debian:bookworm-slim
+FROM debian:bookworm-slim@sha256:ccb33c3ac5b02588fc1d9e4fc09b952e433d0c54d8618d0ee1afadf1f3cf2455
 
 WORKDIR /usr/src/app