From 79acb7ef25714ad89ec44013cf0b331308eb3cc1 Mon Sep 17 00:00:00 2001 From: Mark Story Date: Sat, 29 Aug 2026 23:08:06 -0400 Subject: [PATCH] Pin action image and reduce permissions Pin the image revision used for dokku deployments and reduce permissions for deploy jobs. Pinning the image revision reduces the chances of supply chain attacks on images with access to real credentials. --- .github/workflows/deploy_docs_2x.yml | 5 ++++- .github/workflows/deploy_docs_3x.yml | 5 ++++- .github/workflows/deploy_docs_4x.yml | 5 ++++- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deploy_docs_2x.yml b/.github/workflows/deploy_docs_2x.yml index 15dec27c..4c0a8d5b 100644 --- a/.github/workflows/deploy_docs_2x.yml +++ b/.github/workflows/deploy_docs_2x.yml @@ -7,6 +7,9 @@ on: - 2.x workflow_dispatch: +permissions: + contents: read + jobs: deploy: runs-on: ubuntu-latest @@ -17,7 +20,7 @@ jobs: fetch-depth: 0 - name: Push to dokku - uses: dokku/github-action@master + uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0 with: git_remote_url: 'ssh://dokku@apps.cakephp.org:22/authentication-docs-2' ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }} diff --git a/.github/workflows/deploy_docs_3x.yml b/.github/workflows/deploy_docs_3x.yml index aaed049e..4023058a 100644 --- a/.github/workflows/deploy_docs_3x.yml +++ b/.github/workflows/deploy_docs_3x.yml @@ -7,6 +7,9 @@ on: - 3.x workflow_dispatch: +permissions: + contents: read + jobs: deploy: runs-on: ubuntu-latest @@ -17,7 +20,7 @@ jobs: fetch-depth: 0 - name: Push to dokku - uses: dokku/github-action@master + uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0 with: git_remote_url: 'ssh://dokku@apps.cakephp.org:22/authentication-docs-3' ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }} diff --git a/.github/workflows/deploy_docs_4x.yml b/.github/workflows/deploy_docs_4x.yml index 8f47b950..51ed2821 100644 --- a/.github/workflows/deploy_docs_4x.yml +++ b/.github/workflows/deploy_docs_4x.yml @@ -7,6 +7,9 @@ on: - 4.x workflow_dispatch: +permissions: + contents: read + jobs: deploy: runs-on: ubuntu-latest @@ -17,7 +20,7 @@ jobs: fetch-depth: 0 - name: Push to dokku - uses: dokku/github-action@master + uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0 with: git_remote_url: 'ssh://dokku@apps.cakephp.org:22/authentication-docs-4' ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }}