Securing the pipeline

import re
from urllib.request import urlopen

import yaml

with urlopen("https://academy.cloudtechanalytics.com/datasets/cicd/deploy.yml") as f:
    workflow = yaml.safe_load(f.read().decode("utf-8"))

def review(wf):
    problems = []
    trigger = wf.get("on", wf.get(True)) or {}
    branches = (trigger.get("push") or {}).get("branches", [])
    if any(b in ("**", "*") for b in branches):
        problems.append("trigger: a push to any branch runs the workflow")
    if wf.get("permissions") == "write-all":
        problems.append("permissions: write-all gives the token full write access")
    for name, job in wf["jobs"].items():
        steps = job.get("steps", [])
        if name.startswith("deploy"):
            if "needs" not in job:
                problems.append(f"{name}: doesn't need the test job, so it runs even if tests fail")
            if "environment" not in job:
                problems.append(f"{name}: no environment, so no approval before production")
        for step in steps:
            uses = step.get("uses", "")
            if uses and not uses.startswith("actions/") and not re.search(r"@[0-9a-f]{40}
quot;, uses):
                problems.append(f"{name}: third-party action {uses} isn't pinned to a commit SHA")
            if "run" in step and "secrets." in step["run"] and re.search(r"\becho\b", step["run"]):
                problems.append(f"{name}: a step prints a secret")
    return problems

for p in review(workflow):
    print("-", p)

- trigger: a push to any branch runs the workflow
- permissions: write-all gives the token full write access
- deploy: doesn't need the test job, so it runs even if tests fail
- deploy: no environment, so no approval before production
- deploy: third-party action quickship-dev/ssh-deploy-action@main isn't pinned to a commit SHA
- deploy: a step prints a secret