From 457c5aec6ae2b0ea58ed1789e52da1865c0e3783 Mon Sep 17 00:00:00 2001 From: Mark Story Date: Sat, 29 Aug 2026 23:04:23 -0400 Subject: [PATCH] Pin action image and reduce permissions Pin the image revision used for dokku deployments and reduce permissions for deploy jobs. Pinning the image revision reduces the chances of supply chain attacks on images with access to real credentials. --- .github/workflows/deploy_docs_2x.yml | 5 ++++- .github/workflows/deploy_docs_3x.yml | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy_docs_2x.yml b/.github/workflows/deploy_docs_2x.yml index 4a69b09b..fe9c2efa 100644 --- a/.github/workflows/deploy_docs_2x.yml +++ b/.github/workflows/deploy_docs_2x.yml @@ -7,6 +7,9 @@ on: - 2.x workflow_dispatch: +permissions: + contents: read + jobs: deploy: runs-on: ubuntu-latest @@ -17,7 +20,7 @@ jobs: fetch-depth: 0 - name: Push to dokku - uses: dokku/github-action@master + uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0 with: git_remote_url: 'ssh://dokku@apps.cakephp.org:22/bake-docs-2' ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }} diff --git a/.github/workflows/deploy_docs_3x.yml b/.github/workflows/deploy_docs_3x.yml index dc8d5c63..63ae341f 100644 --- a/.github/workflows/deploy_docs_3x.yml +++ b/.github/workflows/deploy_docs_3x.yml @@ -7,6 +7,9 @@ on: - 3.x workflow_dispatch: +permissions: + contents: read + jobs: deploy: runs-on: ubuntu-latest @@ -17,7 +20,7 @@ jobs: fetch-depth: 0 - name: Push to dokku - uses: dokku/github-action@master + uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0 with: git_remote_url: 'ssh://dokku@apps.cakephp.org:22/bake-docs-3' ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }}