Harden GitHub Actions workflows: least-privilege permissions and SHA-pinned...

Valery Kharseko

8 hours ago 22552db27964b8e974414de599cbb0e3e827722f

 .github/workflows/release.yml

@@ -30,9 +30,16 @@
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  release-maven:
    runs-on: 'ubuntu-latest'
    # contents: write is required to push the release commits and tags produced by
    # maven-release-plugin, to create the GitHub release and to update the wiki.
    permissions:
      contents: write
    steps:
      - name: Print github context
        env:
@@ -90,7 +97,7 @@
        if: ${{ env.MAVEN_USERNAME!='' && env.MAVEN_PASSWORD!='' }}
        run: mvn --batch-mode -Darguments="-Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }}" -DsignTag=true -DtagNameFormat="${{ github.event.inputs.releaseVersion }}" -DreleaseVersion=${{ github.event.inputs.releaseVersion }} -DdevelopmentVersion=${{ github.event.inputs.developmentVersion }} release:prepare release:perform --file pom.xml
      - name: Release on GitHub
        uses: softprops/action-gh-release@v2
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          name: ${{ github.event.inputs.releaseVersion }}
          tag_name: ${{ github.event.inputs.releaseVersion }}
@@ -154,6 +161,10 @@
    runs-on: 'ubuntu-latest'
    needs:
      - release-maven
    # packages: write is required for the GHCR login that authenticates with GITHUB_TOKEN.
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6
        with:
@@ -162,7 +173,7 @@
          submodules: recursive
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ${{ github.repository }}
@@ -171,22 +182,22 @@
            type=raw,value=latest
            type=raw,value=${{ github.event.inputs.releaseVersion }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Login to DockerHub
        uses: docker/login-action@v4
        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Login to GHCR
        uses: docker/login-action@v4
        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push image
        uses: docker/build-push-action@v7
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        continue-on-error: true
        with:
          context: ./opendj-packages/opendj-docker
@@ -202,6 +213,10 @@
    runs-on: 'ubuntu-latest'
    needs:
      - release-maven
    # packages: write is required for the GHCR login that authenticates with GITHUB_TOKEN.
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6
        with:
@@ -210,7 +225,7 @@
          submodules: recursive
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ${{ github.repository }}
@@ -219,23 +234,23 @@
            type=raw,value=alpine
            type=raw,value=${{ github.event.inputs.releaseVersion }}-alpine
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Login to DockerHub
        uses: docker/login-action@v4
        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Login to GHCR
        uses: docker/login-action@v4
        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push image
        continue-on-error: true
        uses: docker/build-push-action@v7
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: ./opendj-packages/opendj-docker
          file: ./opendj-packages/opendj-docker/Dockerfile-alpine