Security hardening (tasks collection) #5

This issue is a collection of sub-tasks for:

• Minimizing our dependencies to secrets

• Removing un-necessary CI items

• Augment the audit

• Hardening who can do what and how in terms of commits, branches, tags

• harden branches

• fork only policy for branches for PRs

• harden tags

• check for unused secrets

NPM releases:

• Trusted publisher instead of NPM_TOKEN: ci: trusted staged publish diracx-web#517
  • verify with a release

PyPI releases. Use trusted publisher (with environment) instead of PYPI_TOKEN: coming soon (for ref: https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-pypi)

• Use Github token instead of RELEASE_PLEASE_TOKEN:
  • intercede: ci: use github token with release-please intercede#41 + gh environment setting + trusted publisher
    • verify with a release
  • signurlarity: ci: relying on github token with release-please signurlarity#66 + gh environment setting + trusted publisher
  • diracx: ci: use GITHUB_TOKEN for release-please and publish with the pypi environment diracx#1187 + gh environment setting + trusted publisher
  • DIRAC: + gh environment setting + trusted publisher
  • WebAppDIRAC: + gh environment setting + trusted publisher
  • DB12 + gh environment setting + trusted publisher
  • diraccfg + gh environment setting + trusted publisher

DIRACOS2 releases:

• Something with Conda?

container-images:

• still needed? If not, archive?

• Renovate instead of CHART_UPDATE_TOKEN? (would likely be more consistent with our current workflows with Renovate) chore: set up Renovate to bump diracx/diracx-web versions diracx-charts#322 along with ci: stop pushing chart bumps to diracx-charts diracx#1183 & ci: stop pushing chart bumps to diracx-charts diracx-web#518

• Re-request a review-native mechanism instead of DRAFT_PAT?: ci: remove draft PR workflows and adjust  #4 along with ci: drop the draft conversion on changes requested mkdocs-diracx-plugin#8 & ci: drop the draft conversion on changes requested diracx-charts#323 & ci: drop the draft conversion on changes requested diracx-web#519 & ci: drop the draft conversion on changes requested diracx#1184

• Stop sending images to docker: Update images-creator.yml to remove Docker Hub steps management#76

• No more sweep and labeler: Remove labeler and pr-sweep GitHub actions DIRAC#8881 & Remove labeler and pr-sweep GitHub actions DIRAC#8882 & Remove labeler and pr-sweep GitHub actions DIRAC#8883 and Remove labeler and pr-sweep GitHub actions WebAppDIRAC#817 & Remove labeler and pr-sweep GitHub actions WebAppDIRAC#816

• add zizmor everywhere as pre-commit, to harden the CIs.

  • diracx (already there)
  • intercede: ci: add zizmor (pixi task + pre-commit) and fix its auditor findings intercede#43
  • signurlarity: ci: add zizmor (pixi task + pre-commit) and fix its auditor findings signurlarity#68
  • all other projects

• evaluate https://github.com/step-security/harden-runner

• Minimize GITHUB_TOKEN permissions: always set permissions: {} at the workflow level to disable all permissions by default. Then, grant only the specific permissions needed at the job level.