chore: always pin harden-runner unless exempted

[shubham-stepsecurity]

No description provided.

[step-security-bot]

Please find StepSecurity AI-CodeWise code comments below.

Code Comments

remediation/workflow/secureworkflow.go

[
    {
        "Severity": "High",
        "Recommendation": "Always validate and sanitize user input to prevent injection attacks and other security vulnerabilities.",
        "Description": "The code is missing input validation and sanitization for 'inputYaml' which could lead to potential security vulnerabilities such as injection attacks.",
        "Remediation": "Implement proper input validation and sanitization mechanisms for the 'inputYaml' parameter before using it in the code. For instance, use regex validation or a library function to sanitize the input."
    },
    {
        "Severity": "Medium",
        "Recommendation": "Avoid using hardcoded sensitive data directly in the code to prevent exposure.",
        "Description": "Sensitive data like 'HardenRunnerActionPathWithTag' is hardcoded in the code, which may lead to exposure of sensitive information.",
        "Remediation": "Store sensitive data like 'HardenRunnerActionPathWithTag' in a secure configuration file or environment variable, and access it from there rather than hardcoding it in the code."
    }
]

testfiles/secureworkflow/output/nopin.yml

[
    {
        "Severity": "High",
        "Recommendation": "Ensure hardened runner version is locked down to a specific commit hash",
        "Description": "Using tagged versions for dependencies is more secure than using generic tags like 'v2'. Locking the runner version down to a specific commit hash can prevent unexpected behavior changes due to updates.",
        "Remediation": "Change 'uses: step-security/harden-runner@v2' to 'uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5'"
    }
]

Feedback

We appreciate your feedback in helping us improve the service! To provide feedback, please use emojis on this comment. If you find the comments helpful, give them a 👍. If they aren't useful, kindly express that with a 👎. If you have questions or detailed feedback, please create n GitHub issue in StepSecurity/AI-CodeWise.