From 7cb27eb589b3d78ecd85e8f0a25a16265418343a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 11 Mar 2026 14:00:19 +0000 Subject: [PATCH 1/2] Initial plan From cd78ed14b4494c019c1c8dea032aaf3e049f82f3 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 11 Mar 2026 14:08:51 +0000 Subject: [PATCH 2/2] Consolidate all dependency update PRs: Python deps, GitHub Actions, and StepSecurity best practices Co-authored-by: ChiefGyk3D <19499446+ChiefGyk3D@users.noreply.github.com> --- .github/dependabot.yml | 5 ++ .github/workflows/ci-tests.yml | 25 +++++-- .github/workflows/codeql-analysis.yml | 16 +++-- .github/workflows/dependency-review.yml | 9 ++- .github/workflows/dependency-scan.yml | 13 ++-- .github/workflows/docker-build-publish.yml | 39 +++++++---- .github/workflows/scorecards.yml | 81 ++++++++++++++++++++++ .github/workflows/snyk-security.yml | 13 ++-- .pre-commit-config.yaml | 18 +++++ Docker/Dockerfile | 2 +- requirements.txt | 16 ++--- 11 files changed, 195 insertions(+), 42 deletions(-) create mode 100644 .github/workflows/scorecards.yml create mode 100644 .pre-commit-config.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c3c826f..820f6d1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -46,3 +46,8 @@ updates: - "github-actions" commit-message: prefix: "ci" + + - package-ecosystem: pip + directory: /Docker + schedule: + interval: daily diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml index bc7ce1d..9197e8b 100644 --- a/.github/workflows/ci-tests.yml +++ b/.github/workflows/ci-tests.yml @@ -22,6 +22,9 @@ on: branches: [ main, develop ] workflow_dispatch: +permissions: + contents: read + jobs: test: name: Test Python ${{ matrix.python-version }} @@ -32,11 +35,16 @@ jobs: python-version: ['3.10','3.11', '3.12', '3.13', '3.14'] steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 + with: + egress-policy: audit + - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: ${{ matrix.python-version }} cache: 'pip' @@ -51,7 +59,7 @@ jobs: pytest tests/ -v --cov=stream_daemon --cov-report=xml --cov-report=term - name: Upload coverage to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 if: matrix.python-version == '3.14' with: file: ./coverage.xml @@ -66,11 +74,16 @@ jobs: runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 + with: + egress-policy: audit + - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.14' cache: 'pip' @@ -96,7 +109,7 @@ jobs: continue-on-error: true - name: Upload Bandit report - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@v7 if: always() with: name: bandit-security-report diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 79e2ef4..6d36fc4 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -25,6 +25,9 @@ on: - cron: '0 0 * * 0' workflow_dispatch: +permissions: + contents: read + jobs: analyze: name: Analyze Code @@ -40,19 +43,24 @@ jobs: language: [ 'python' ] steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 + with: + egress-policy: audit + - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 with: languages: ${{ matrix.language }} queries: security-extended,security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 68cc372..aa32ca6 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -29,11 +29,16 @@ jobs: runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 + with: + egress-policy: audit + - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Review dependency changes - uses: actions/dependency-review-action@v4 + uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 with: fail-on-severity: moderate comment-summary-in-pr: true diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml index 986c535..cd105c5 100644 --- a/.github/workflows/dependency-scan.yml +++ b/.github/workflows/dependency-scan.yml @@ -27,11 +27,16 @@ jobs: runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 + with: + egress-policy: audit + - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.13' @@ -50,7 +55,7 @@ jobs: continue-on-error: true - name: Upload Safety report - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@v7 if: always() with: name: safety-vulnerability-report @@ -58,7 +63,7 @@ jobs: retention-days: 30 - name: Upload pip-audit report - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@v7 if: always() with: name: pip-audit-report diff --git a/.github/workflows/docker-build-publish.yml b/.github/workflows/docker-build-publish.yml index 49c3e19..62c76bd 100644 --- a/.github/workflows/docker-build-publish.yml +++ b/.github/workflows/docker-build-publish.yml @@ -30,6 +30,9 @@ env: # Convert repository name to lowercase for Docker compatibility IMAGE_NAME: ${{ github.repository }} +permissions: + contents: read + jobs: build-test: name: Build and Test Docker Image @@ -40,19 +43,24 @@ jobs: security-events: write # Required for uploading SARIF results steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 + with: + egress-policy: audit + - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set lowercase image name id: image-name run: echo "value=$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Log in to Container Registry if: github.event_name != 'pull_request' - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -60,7 +68,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ${{ env.REGISTRY }}/${{ steps.image-name.outputs.value }} tags: | @@ -73,7 +81,7 @@ jobs: type=raw,value=latest,enable={{is_default_branch}} - name: Build Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . file: ./Docker/Dockerfile @@ -92,7 +100,7 @@ jobs: docker run --rm "$IMAGE_TAG" python -c "import stream_daemon; print('Import successful')" - name: Scan image with Trivy - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # master with: image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }} format: 'sarif' @@ -101,14 +109,14 @@ jobs: continue-on-error: true # Don't fail the build if Trivy has issues - name: Upload Trivy results to GitHub Security - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 if: always() && hashFiles('trivy-results.sarif') != '' with: sarif_file: 'trivy-results.sarif' - name: Push Docker image if: github.event_name != 'pull_request' - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . file: ./Docker/Dockerfile @@ -127,11 +135,16 @@ jobs: contents: read steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 + with: + egress-policy: audit + - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Check Docker Hub credentials id: check-credentials @@ -146,7 +159,7 @@ jobs: - name: Log in to Docker Hub if: steps.check-credentials.outputs.skip != 'true' - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -154,7 +167,7 @@ jobs: - name: Extract metadata for Docker Hub if: steps.check-credentials.outputs.skip != 'true' id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ${{ secrets.DOCKERHUB_USERNAME }}/stream-daemon tags: | @@ -166,7 +179,7 @@ jobs: - name: Build and push to Docker Hub if: steps.check-credentials.outputs.skip != 'true' - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . file: ./Docker/Dockerfile diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml new file mode 100644 index 0000000..3c73396 --- /dev/null +++ b/.github/workflows/scorecards.yml @@ -0,0 +1,81 @@ +# This workflow uses actions that are not certified by GitHub. They are provided +# by a third-party and are governed by separate terms of service, privacy +# policy, and support documentation. + +name: Scorecard supply-chain security +on: + # For Branch-Protection check. Only the default branch is supported. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection + branch_protection_rule: + # To guarantee Maintained check is occasionally updated. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained + schedule: + - cron: '20 7 * * 2' + push: + branches: ["main"] + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Needed to publish results and get a badge (see publish_results below). + id-token: write + contents: read + actions: read + # To allow GraphQL ListCommits to work + issues: read + pull-requests: read + # To detect SAST tools + checks: read + + steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 + with: + egress-policy: audit + + - name: "Checkout code" + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 + with: + results_file: results.sarif + results_format: sarif + # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: + # - you want to enable the Branch-Protection check on a *public* repository, or + # - you are installing Scorecards on a *private* repository + # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. + # repo_token: ${{ secrets.SCORECARD_TOKEN }} + + # Public repositories: + # - Publish results to OpenSSF REST API for easy access by consumers + # - Allows the repository to include the Scorecard badge. + # - See https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories: + # - `publish_results` will always be set to `false`, regardless + # of the value entered here. + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard. + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@820e3160e279568db735cee8ed8f8e77a6da7818 # v3.32.6 + with: + sarif_file: results.sarif diff --git a/.github/workflows/snyk-security.yml b/.github/workflows/snyk-security.yml index 216749c..33fa849 100644 --- a/.github/workflows/snyk-security.yml +++ b/.github/workflows/snyk-security.yml @@ -32,8 +32,13 @@ jobs: runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 + with: + egress-policy: audit + - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Snyk CLI uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 @@ -41,7 +46,7 @@ jobs: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.13' @@ -63,14 +68,14 @@ jobs: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - name: Upload Snyk Code results - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 if: always() with: sarif_file: snyk-code.sarif category: snyk-code - name: Upload Snyk Open Source results - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 if: always() with: sarif_file: snyk-opensource.sarif diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..0ef0fe8 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,18 @@ +repos: +- repo: https://github.com/gitleaks/gitleaks + rev: v8.16.3 + hooks: + - id: gitleaks +- repo: https://github.com/jumanjihouse/pre-commit-hooks + rev: 3.0.0 + hooks: + - id: shellcheck +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.4.0 + hooks: + - id: end-of-file-fixer + - id: trailing-whitespace +- repo: https://github.com/pylint-dev/pylint + rev: v2.17.2 + hooks: + - id: pylint diff --git a/Docker/Dockerfile b/Docker/Dockerfile index b66c08e..56125fe 100644 --- a/Docker/Dockerfile +++ b/Docker/Dockerfile @@ -2,7 +2,7 @@ # Python 3.14 with multi-arch support: amd64, arm64 # Because running stream announcements requires the absolute latest Python. # Can't use 3.13. That would be barbaric. We need 3.14 to tell people about Fortnite streams. -FROM python:3.14-slim +FROM python:3.14-slim@sha256:6a27522252aef8432841f224d9baaa6e9fce07b07584154fa0b9a96603af7456 # Set build arguments for platform detection (automatically set by buildx) ARG TARGETPLATFORM diff --git a/requirements.txt b/requirements.txt index c0ada00..495066b 100644 --- a/requirements.txt +++ b/requirements.txt @@ -15,23 +15,23 @@ ###################################################################### twitchAPI==4.5.0 Mastodon.py==2.1.4 -boto3==1.42.39 +boto3==1.42.63 hvac==2.4.0 atproto==0.0.65 doppler-sdk==1.3.0 -python-dotenv==1.2.1 -google-api-python-client==2.188.0 -google-genai==1.61.0 +python-dotenv==1.2.2 +google-api-python-client==2.192.0 +google-genai==1.66.0 # CVE-2025-4565 fix: Requires protobuf >= 4.25.8 (v4), >= 5.29.5 (v5), or >= 6.31.1 (v6) -# Using v4 for compatibility; upgrade to v5/v6 requires testing -protobuf==6.33.5 +# Updated to v7 for latest fixes and features +protobuf==7.34.0 # Ollama Python client for local LLM support ollama==0.6.1 # CVE-2024-45590, CVE-2024-42473: Fixed in requests >= 2.32.2 # CVE-2024-6472: Fixed in requests >= 2.32.4 # Using latest stable version 2.32.5 requests==2.32.5 -discord.py==2.6.4 +discord.py==2.7.1 matrix-nio==0.25.2 beautifulsoup4==4.14.3 # CVE-2024-5569: Infinite loop in zipp, fixed in >= 3.19.1 @@ -42,7 +42,7 @@ zipp==3.23.0 urllib3==2.6.3 # pip symbolic link extraction vulnerability fix # Ensures pip >= 24.2 for CVE fixes -pip==26.0 +pip==26.0.1 # Testing framework pytest==9.0.2 pytest-asyncio==1.3.0