ci: scope workflow token permissions and pin dependencies

.github/dependabot.yml

@@ -1,7 +1,9 @@
 version: 2
 updates:
   - package-ecosystem: "npm"
-    directory: "/frontend"
+    directories:
+      - "/frontend"
+      - "/e2e"
     groups:
       minor-patch:
         update-types:
@@ -21,7 +23,9 @@ updates:
       interval: "daily"
 
   - package-ecosystem: "docker"
-    directory: "/"
+    directories:
+      - "/"
+      - "/frontend"
     schedule:
       interval: "daily"
 

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
         run: go mod download
 
       - name: Setup sqlc
-        uses: sqlc-dev/setup-sqlc@v5
+        uses: sqlc-dev/setup-sqlc@bac53b7fb28c039a6c7f5736fd1e89744021bdd6 # v5.0.0
         with:
           sqlc-version: "1.31.1"
 

.github/workflows/e2e.yml

@@ -5,6 +5,9 @@ on:
   #   branches:
   #     - main
 
+permissions:
+  contents: read
+
 jobs:
   test:
     timeout-minutes: 30

.github/workflows/nightly.yml

@@ -5,11 +5,12 @@ on:
     - cron: "0 0 * * *"
 
 permissions:
-  contents: write
-  packages: write
+  contents: read
 
 jobs:
   create-release:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -29,6 +30,8 @@ jobs:
           tag_name: nightly
 
   generate-metadata:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     needs: create-release
     outputs:
@@ -52,6 +55,8 @@ jobs:
           echo "BUILD_TAGS=$GIN_BUILD_TAGS" >> "$GITHUB_OUTPUT"
 
   binary-build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     needs:
       - create-release
@@ -101,6 +106,8 @@ jobs:
           path: tinyauth-amd64
 
   binary-build-arm:
+    permissions:
+      contents: read
     runs-on: ubuntu-24.04-arm
     needs:
       - create-release
@@ -150,6 +157,9 @@ jobs:
           path: tinyauth-arm64
 
   image-build:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
     needs:
       - create-release
@@ -208,6 +218,9 @@ jobs:
           retention-days: 1
 
   image-build-distroless:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
     needs:
       - create-release
@@ -268,6 +281,9 @@ jobs:
           retention-days: 1
 
   image-build-arm:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-24.04-arm
     needs:
       - create-release
@@ -326,6 +342,9 @@ jobs:
           retention-days: 1
 
   image-build-arm-distroless:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-24.04-arm
     needs:
       - create-release
@@ -386,6 +405,8 @@ jobs:
           retention-days: 1
 
   image-merge:
+    permissions:
+      packages: write
     runs-on: ubuntu-latest
     needs:
       - image-build
@@ -425,6 +446,8 @@ jobs:
             $(printf 'ghcr.io/${{ github.repository_owner }}/tinyauth@sha256:%s ' *)
 
   image-merge-distroless:
+    permissions:
+      packages: write
     runs-on: ubuntu-latest
     needs:
       - image-build-distroless
@@ -464,6 +487,8 @@ jobs:
             $(printf 'ghcr.io/${{ github.repository_owner }}/tinyauth@sha256:%s ' *)
 
   update-release:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     needs:
       - binary-build

.github/workflows/release.yml

@@ -6,11 +6,12 @@ on:
       - "v*"
 
 permissions:
-  contents: write
-  packages: write
+  contents: read
 
 jobs:
   generate-metadata:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     outputs:
       VERSION: ${{ steps.metadata.outputs.VERSION }}
@@ -33,6 +34,8 @@ jobs:
           echo "BUILD_TAGS=$GIN_BUILD_TAGS" >> "$GITHUB_OUTPUT"
 
   binary-build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     needs:
       - generate-metadata
@@ -79,6 +82,8 @@ jobs:
           path: tinyauth-amd64
 
   binary-build-arm:
+    permissions:
+      contents: read
     runs-on: ubuntu-24.04-arm
     needs:
       - generate-metadata
@@ -125,6 +130,9 @@ jobs:
           path: tinyauth-arm64
 
   image-build:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
     needs:
       - generate-metadata
@@ -181,6 +189,9 @@ jobs:
           retention-days: 1
 
   image-build-distroless:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
     needs:
       - generate-metadata
@@ -239,6 +250,9 @@ jobs:
           retention-days: 1
 
   image-build-arm:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-24.04-arm
     needs:
       - generate-metadata
@@ -295,6 +309,9 @@ jobs:
           retention-days: 1
 
   image-build-arm-distroless:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-24.04-arm
     needs:
       - generate-metadata
@@ -353,6 +370,8 @@ jobs:
           retention-days: 1
 
   image-merge:
+    permissions:
+      packages: write
     runs-on: ubuntu-latest
     needs:
       - image-build
@@ -394,6 +413,8 @@ jobs:
             $(printf 'ghcr.io/${{ github.repository_owner }}/tinyauth@sha256:%s ' *)
 
   image-merge-distroless:
+    permissions:
+      packages: write
     runs-on: ubuntu-latest
     needs:
       - image-build-distroless
@@ -437,6 +458,8 @@ jobs:
             $(printf 'ghcr.io/${{ github.repository_owner }}/tinyauth@sha256:%s ' *)
 
   update-release:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     needs:
       - binary-build

.github/workflows/sponsors.yml

@@ -3,11 +3,13 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   generate-sponsors:
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

Dockerfile

@@ -1,5 +1,5 @@
 # Site builder
-FROM node:26.10-alpine3.23 AS frontend-builder
+FROM node:26.10-alpine3.23@sha256:c3c6e314fd42e41962360b2482fc18d150beb47976c3aa7b8b9689d7ef42a5c2 AS frontend-builder
 
 WORKDIR /frontend
 
@@ -49,7 +49,7 @@ RUN CGO_ENABLED=0 go build -tags "${BUILD_TAGS}" -ldflags "${LDFLAGS} \
     -o tinyauth ./cmd/tinyauth
 
 # Runner
-FROM alpine:3.24 AS runner
+FROM alpine:3.24@sha256:f59abe656b692d901e184be3445e084786602108599d2a51d229c0f5a48c71bf AS runner
 
 WORKDIR /tinyauth
 

Dockerfile.distroless

@@ -1,5 +1,5 @@
 # Site builder
-FROM node:26.10-alpine3.23 AS frontend-builder
+FROM node:26.10-alpine3.23@sha256:c3c6e314fd42e41962360b2482fc18d150beb47976c3aa7b8b9689d7ef42a5c2 AS frontend-builder
 
 WORKDIR /frontend
 
@@ -54,7 +54,7 @@ RUN mkdir -p /data/resources /data/oidc /data/tailscale
 RUN chown -R tinyauth:tinyauth /data
 
 # Runner
-FROM gcr.io/distroless/static-debian12:latest AS runner
+FROM gcr.io/distroless/static-debian12:latest@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS runner
 
 WORKDIR /tinyauth
 

frontend/Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM node:26.1-alpine3.23
+FROM node:26.1-alpine3.23@sha256:e71ac5e964b9201072425d59d2e876359efa25dc96bb1768cb73295728d6e4ea
 
 RUN npm install -g pnpm@11.1.2