From a8f916df2a92857203f082aaeb801c810d90874c Mon Sep 17 00:00:00 2001 From: Mark Story Date: Sat, 29 Aug 2026 22:56:36 -0400 Subject: [PATCH] Pin action image and reduce permissions Pin the image revision used for dokku deployments and reduce permissions for deploy jobs. Pinning the image revision reduces the chances of supply chain attacks on images with access to real credentials. --- .github/workflows/deploy_docs_3x.yml | 5 ++++- .github/workflows/deploy_docs_4x.yml | 5 ++++- .github/workflows/deploy_docs_5x.yml | 5 ++++- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deploy_docs_3x.yml b/.github/workflows/deploy_docs_3x.yml index a22bdc7e..dff7cc3e 100644 --- a/.github/workflows/deploy_docs_3x.yml +++ b/.github/workflows/deploy_docs_3x.yml @@ -7,6 +7,9 @@ on: - 3.x workflow_dispatch: +permissions: + contents: read + jobs: deploy: runs-on: ubuntu-latest @@ -17,7 +20,7 @@ jobs: fetch-depth: 0 - name: Push to dokku - uses: dokku/github-action@master + uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0 with: git_remote_url: 'ssh://dokku@apps.cakephp.org:22/migrations-docs-3' ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }} diff --git a/.github/workflows/deploy_docs_4x.yml b/.github/workflows/deploy_docs_4x.yml index af3f7f76..2cd9660f 100644 --- a/.github/workflows/deploy_docs_4x.yml +++ b/.github/workflows/deploy_docs_4x.yml @@ -7,6 +7,9 @@ on: - 4.x workflow_dispatch: +permissions: + contents: read + jobs: deploy: runs-on: ubuntu-latest @@ -17,7 +20,7 @@ jobs: fetch-depth: 0 - name: Push to dokku - uses: dokku/github-action@master + uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0 with: git_remote_url: 'ssh://dokku@apps.cakephp.org:22/migrations-docs-4' ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }} diff --git a/.github/workflows/deploy_docs_5x.yml b/.github/workflows/deploy_docs_5x.yml index 4d186664..96a72989 100644 --- a/.github/workflows/deploy_docs_5x.yml +++ b/.github/workflows/deploy_docs_5x.yml @@ -7,6 +7,9 @@ on: - 5.x workflow_dispatch: +permissions: + contents: read + jobs: deploy: runs-on: ubuntu-latest @@ -17,7 +20,7 @@ jobs: fetch-depth: 0 - name: Push to dokku - uses: dokku/github-action@master + uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0 with: git_remote_url: 'ssh://dokku@apps.cakephp.org:22/migrations-docs-5' ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }}