Harden GitHub Actions workflows: least-privilege permissions and SHA-pinned...

Valery Kharseko

8 hours ago 22552db27964b8e974414de599cbb0e3e827722f

 .github/workflows/build.yml

@@ -23,6 +23,11 @@
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Nothing in this workflow writes back to the repository: the docker jobs push to
# the local registry service, not to a remote one.
permissions:
  contents: read

jobs:
  build-maven:
    runs-on: ${{ matrix.os }}
@@ -69,7 +74,7 @@
         restore-keys: ${{ runner.os }}-m2-repository
    - name: Setup MSVC Developer Command Prompt (x86)
      if: runner.os == 'Windows'
      uses: ilammy/msvc-dev-cmd@v1
      uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
      env:
        # Opt in to Node.js 24 for this action, which still ships on Node.js 20.
        # See https://github.com/ilammy/msvc-dev-cmd/issues/99
@@ -408,16 +413,16 @@
          echo "release_version=$git_version_last" >> $GITHUB_ENV
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            localhost:5000/${{ github.repository }}
          tags: |
            type=raw,value=${{ env.release_version }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
        with:
          driver-opts: network=host
      - name: Prepare Dockerfile
@@ -427,7 +432,7 @@
          cp ./opendj-server-legacy/target/package/opendj-*.zip ./opendj-packages/opendj-docker
          sed -i -E '/^#COPY opendj/s/^#//' ./opendj-packages/opendj-docker/Dockerfile
      - name: Build image (default)
        uses: docker/build-push-action@v7
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: ./opendj-packages/opendj-docker
          file: ./opendj-packages/opendj-docker/Dockerfile
@@ -527,7 +532,7 @@
          echo "release_version=$git_version_last" >> $GITHUB_ENV
      - name: Docker meta 
        id: meta
        uses: docker/metadata-action@v6
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            localhost:5000/${{ github.repository }}
@@ -535,9 +540,9 @@
            type=raw,value=alpine
            type=raw,value=${{ env.release_version }}-alpine
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
        with:
          driver-opts: network=host
      - name: Prepare Dockerfile
@@ -547,7 +552,7 @@
          cp ./opendj-server-legacy/target/package/opendj-*.zip ./opendj-packages/opendj-docker
          sed -i -E '/^#COPY opendj/s/^#//' ./opendj-packages/opendj-docker/Dockerfile-alpine
      - name: Build image
        uses: docker/build-push-action@v7
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: ./opendj-packages/opendj-docker
          file: ./opendj-packages/opendj-docker/Dockerfile-alpine