From 22552db27964b8e974414de599cbb0e3e827722f Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 29 Jul 2026 04:49:21 +0000
Subject: [PATCH] Harden GitHub Actions workflows: least-privilege permissions and SHA-pinned actions (#778)
---
.github/workflows/build.yml | 23 ++++++++++++++---------
1 files changed, 14 insertions(+), 9 deletions(-)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1767f9a..a868163 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,6 +23,11 @@
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
+# Nothing in this workflow writes back to the repository: the docker jobs push to
+# the local registry service, not to a remote one.
+permissions:
+ contents: read
+
jobs:
build-maven:
runs-on: ${{ matrix.os }}
@@ -69,7 +74,7 @@
restore-keys: ${{ runner.os }}-m2-repository
- name: Setup MSVC Developer Command Prompt (x86)
if: runner.os == 'Windows'
- uses: ilammy/msvc-dev-cmd@v1
+ uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
env:
# Opt in to Node.js 24 for this action, which still ships on Node.js 20.
# See https://github.com/ilammy/msvc-dev-cmd/issues/99
@@ -408,16 +413,16 @@
echo "release_version=$git_version_last" >> $GITHUB_ENV
- name: Docker meta
id: meta
- uses: docker/metadata-action@v6
+ uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
with:
images: |
localhost:5000/${{ github.repository }}
tags: |
type=raw,value=${{ env.release_version }}
- name: Set up QEMU
- uses: docker/setup-qemu-action@v4
+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v4
+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
with:
driver-opts: network=host
- name: Prepare Dockerfile
@@ -427,7 +432,7 @@
cp ./opendj-server-legacy/target/package/opendj-*.zip ./opendj-packages/opendj-docker
sed -i -E '/^#COPY opendj/s/^#//' ./opendj-packages/opendj-docker/Dockerfile
- name: Build image (default)
- uses: docker/build-push-action@v7
+ uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: ./opendj-packages/opendj-docker
file: ./opendj-packages/opendj-docker/Dockerfile
@@ -527,7 +532,7 @@
echo "release_version=$git_version_last" >> $GITHUB_ENV
- name: Docker meta
id: meta
- uses: docker/metadata-action@v6
+ uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
with:
images: |
localhost:5000/${{ github.repository }}
@@ -535,9 +540,9 @@
type=raw,value=alpine
type=raw,value=${{ env.release_version }}-alpine
- name: Set up QEMU
- uses: docker/setup-qemu-action@v4
+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v4
+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
with:
driver-opts: network=host
- name: Prepare Dockerfile
@@ -547,7 +552,7 @@
cp ./opendj-server-legacy/target/package/opendj-*.zip ./opendj-packages/opendj-docker
sed -i -E '/^#COPY opendj/s/^#//' ./opendj-packages/opendj-docker/Dockerfile-alpine
- name: Build image
- uses: docker/build-push-action@v7
+ uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: ./opendj-packages/opendj-docker
file: ./opendj-packages/opendj-docker/Dockerfile-alpine
--
Gitblit v1.10.0