From 16d006c1e4957df2567bd7a8f9ba1a187edcc9ff Mon Sep 17 00:00:00 2001 From: Ryc O'Chet Date: Thu, 12 Nov 2026 21:04:52 +0000 Subject: [PATCH] ci: scope workflow token permissions and pin dependencies - set read-only top-level permissions on all workflows and grant write access per job only where needed (release, nightly, sponsors) - add missing permissions block to the e2e workflow - pin sqlc-dev/setup-sqlc to a commit sha - pin node, alpine and distroless base images to digests - let dependabot cover /e2e (npm) and /frontend (docker) --- .github/dependabot.yml | 8 ++++++-- .github/workflows/ci.yml | 2 +- .github/workflows/e2e.yml | 3 +++ .github/workflows/nightly.yml | 29 +++++++++++++++++++++++++++-- .github/workflows/release.yml | 27 +++++++++++++++++++++++++-- .github/workflows/sponsors.yml | 6 ++++-- Dockerfile | 4 ++-- Dockerfile.distroless | 4 ++-- frontend/Dockerfile.dev | 2 +- 9 files changed, 71 insertions(+), 14 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f3c4c16a2..554ec7606 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,7 +1,9 @@ version: 2 updates: - package-ecosystem: "npm" - directory: "/frontend" + directories: + - "/frontend" + - "/e2e" groups: minor-patch: update-types: @@ -21,7 +23,9 @@ updates: interval: "daily" - package-ecosystem: "docker" - directory: "/" + directories: + - "/" + - "/frontend" schedule: interval: "daily" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dc33272d8..5734ee1c5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,7 +29,7 @@ jobs: run: go mod download - name: Setup sqlc - uses: sqlc-dev/setup-sqlc@v5 + uses: sqlc-dev/setup-sqlc@bac53b7fb28c039a6c7f5736fd1e89744021bdd6 # v5.0.0 with: sqlc-version: "1.31.1" diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 4e6cdcb60..b4b34ff4e 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -5,6 +5,9 @@ on: # branches: # - main +permissions: + contents: read + jobs: test: timeout-minutes: 30 diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 4cad0be2c..dcae7493e 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -5,11 +5,12 @@ on: - cron: "0 0 * * *" permissions: - contents: write - packages: write + contents: read jobs: create-release: + permissions: + contents: write runs-on: ubuntu-latest steps: - name: Checkout @@ -29,6 +30,8 @@ jobs: tag_name: nightly generate-metadata: + permissions: + contents: read runs-on: ubuntu-latest needs: create-release outputs: @@ -52,6 +55,8 @@ jobs: echo "BUILD_TAGS=$GIN_BUILD_TAGS" >> "$GITHUB_OUTPUT" binary-build: + permissions: + contents: read runs-on: ubuntu-latest needs: - create-release @@ -101,6 +106,8 @@ jobs: path: tinyauth-amd64 binary-build-arm: + permissions: + contents: read runs-on: ubuntu-24.04-arm needs: - create-release @@ -150,6 +157,9 @@ jobs: path: tinyauth-arm64 image-build: + permissions: + contents: read + packages: write runs-on: ubuntu-latest needs: - create-release @@ -208,6 +218,9 @@ jobs: retention-days: 1 image-build-distroless: + permissions: + contents: read + packages: write runs-on: ubuntu-latest needs: - create-release @@ -268,6 +281,9 @@ jobs: retention-days: 1 image-build-arm: + permissions: + contents: read + packages: write runs-on: ubuntu-24.04-arm needs: - create-release @@ -326,6 +342,9 @@ jobs: retention-days: 1 image-build-arm-distroless: + permissions: + contents: read + packages: write runs-on: ubuntu-24.04-arm needs: - create-release @@ -386,6 +405,8 @@ jobs: retention-days: 1 image-merge: + permissions: + packages: write runs-on: ubuntu-latest needs: - image-build @@ -425,6 +446,8 @@ jobs: $(printf 'ghcr.io/${{ github.repository_owner }}/tinyauth@sha256:%s ' *) image-merge-distroless: + permissions: + packages: write runs-on: ubuntu-latest needs: - image-build-distroless @@ -464,6 +487,8 @@ jobs: $(printf 'ghcr.io/${{ github.repository_owner }}/tinyauth@sha256:%s ' *) update-release: + permissions: + contents: write runs-on: ubuntu-latest needs: - binary-build diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f282dfb15..4ab954f69 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,11 +6,12 @@ on: - "v*" permissions: - contents: write - packages: write + contents: read jobs: generate-metadata: + permissions: + contents: read runs-on: ubuntu-latest outputs: VERSION: ${{ steps.metadata.outputs.VERSION }} @@ -33,6 +34,8 @@ jobs: echo "BUILD_TAGS=$GIN_BUILD_TAGS" >> "$GITHUB_OUTPUT" binary-build: + permissions: + contents: read runs-on: ubuntu-latest needs: - generate-metadata @@ -79,6 +82,8 @@ jobs: path: tinyauth-amd64 binary-build-arm: + permissions: + contents: read runs-on: ubuntu-24.04-arm needs: - generate-metadata @@ -125,6 +130,9 @@ jobs: path: tinyauth-arm64 image-build: + permissions: + contents: read + packages: write runs-on: ubuntu-latest needs: - generate-metadata @@ -181,6 +189,9 @@ jobs: retention-days: 1 image-build-distroless: + permissions: + contents: read + packages: write runs-on: ubuntu-latest needs: - generate-metadata @@ -239,6 +250,9 @@ jobs: retention-days: 1 image-build-arm: + permissions: + contents: read + packages: write runs-on: ubuntu-24.04-arm needs: - generate-metadata @@ -295,6 +309,9 @@ jobs: retention-days: 1 image-build-arm-distroless: + permissions: + contents: read + packages: write runs-on: ubuntu-24.04-arm needs: - generate-metadata @@ -353,6 +370,8 @@ jobs: retention-days: 1 image-merge: + permissions: + packages: write runs-on: ubuntu-latest needs: - image-build @@ -394,6 +413,8 @@ jobs: $(printf 'ghcr.io/${{ github.repository_owner }}/tinyauth@sha256:%s ' *) image-merge-distroless: + permissions: + packages: write runs-on: ubuntu-latest needs: - image-build-distroless @@ -437,6 +458,8 @@ jobs: $(printf 'ghcr.io/${{ github.repository_owner }}/tinyauth@sha256:%s ' *) update-release: + permissions: + contents: write runs-on: ubuntu-latest needs: - binary-build diff --git a/.github/workflows/sponsors.yml b/.github/workflows/sponsors.yml index c3f309743..e23755945 100644 --- a/.github/workflows/sponsors.yml +++ b/.github/workflows/sponsors.yml @@ -3,11 +3,13 @@ on: workflow_dispatch: permissions: - contents: write - pull-requests: write + contents: read jobs: generate-sponsors: + permissions: + contents: write + pull-requests: write runs-on: ubuntu-latest steps: - name: Checkout diff --git a/Dockerfile b/Dockerfile index e5f891a8f..c4a7f11ea 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Site builder -FROM node:26.10-alpine3.23 AS frontend-builder +FROM node:26.10-alpine3.23@sha256:c3c6e314fd42e41962360b2482fc18d150beb47976c3aa7b8b9689d7ef42a5c2 AS frontend-builder WORKDIR /frontend @@ -49,7 +49,7 @@ RUN CGO_ENABLED=0 go build -tags "${BUILD_TAGS}" -ldflags "${LDFLAGS} \ -o tinyauth ./cmd/tinyauth # Runner -FROM alpine:3.24 AS runner +FROM alpine:3.24@sha256:f59abe656b692d901e184be3445e084786602108599d2a51d229c0f5a48c71bf AS runner WORKDIR /tinyauth diff --git a/Dockerfile.distroless b/Dockerfile.distroless index f599c49ca..659a7d255 100644 --- a/Dockerfile.distroless +++ b/Dockerfile.distroless @@ -1,5 +1,5 @@ # Site builder -FROM node:26.10-alpine3.23 AS frontend-builder +FROM node:26.10-alpine3.23@sha256:c3c6e314fd42e41962360b2482fc18d150beb47976c3aa7b8b9689d7ef42a5c2 AS frontend-builder WORKDIR /frontend @@ -54,7 +54,7 @@ RUN mkdir -p /data/resources /data/oidc /data/tailscale RUN chown -R tinyauth:tinyauth /data # Runner -FROM gcr.io/distroless/static-debian12:latest AS runner +FROM gcr.io/distroless/static-debian12:latest@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS runner WORKDIR /tinyauth diff --git a/frontend/Dockerfile.dev b/frontend/Dockerfile.dev index 5d2b475a7..254d22426 100644 --- a/frontend/Dockerfile.dev +++ b/frontend/Dockerfile.dev @@ -1,4 +1,4 @@ -FROM node:26.1-alpine3.23 +FROM node:26.1-alpine3.23@sha256:e71ac5e964b9201072425d59d2e876359efa25dc96bb1768cb73295728d6e4ea RUN npm install -g pnpm@11.1.2