From 3eb047a4cbfbbcf81bfcff701d20c4c7bb1d2f3a Mon Sep 17 00:00:00 2001 From: Nick Aldewereld Date: Wed, 8 Jul 2026 10:30:03 +0200 Subject: [PATCH 1/2] fix(ci): pass workflow_dispatch input via env instead of inline interpolation Interpolating ${{ github.event.inputs.release_version }} straight into a run: script is the textbook shell-injection pattern; route it through an env var and reference it as a shell variable instead. --- .github/workflows/cd-docker-release.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cd-docker-release.yaml b/.github/workflows/cd-docker-release.yaml index cf25462b..2dce4b39 100644 --- a/.github/workflows/cd-docker-release.yaml +++ b/.github/workflows/cd-docker-release.yaml @@ -147,7 +147,9 @@ jobs: - name: Get release version from input if: ${{ github.event_name == 'workflow_dispatch' }} - run: echo "RELEASE_VERSION=${{ github.event.inputs.release_version }}" >> $GITHUB_ENV + env: + RELEASE_VERSION_INPUT: ${{ github.event.inputs.release_version }} + run: echo "RELEASE_VERSION=${RELEASE_VERSION_INPUT}" >> $GITHUB_ENV - name: Checkout uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 From d12a86a2bdea2c5577a045bfd1d557e42b4d4994 Mon Sep 17 00:00:00 2001 From: Nick Aldewereld Date: Sat, 18 Jul 2026 11:59:11 +0200 Subject: [PATCH 2/2] fix(ci): pin actions to commit SHAs and scope packages:write to the docker job Third-party actions were referenced by mutable tags, so a retagged release would run unreviewed code with the workflow's token. Pin every action to a full commit SHA, matching the existing actions/checkout pin. The workflow also granted packages:write to all four jobs while only docker-release pushes images. Move it down to that job so the npm publish jobs run without registry write access. --- .github/workflows/cd-docker-release.yaml | 28 +++++++++++++----------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/.github/workflows/cd-docker-release.yaml b/.github/workflows/cd-docker-release.yaml index 2dce4b39..76265a72 100644 --- a/.github/workflows/cd-docker-release.yaml +++ b/.github/workflows/cd-docker-release.yaml @@ -33,7 +33,6 @@ on: permissions: contents: read - packages: write jobs: publish-crypto: @@ -51,9 +50,9 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 22 cache: 'pnpm' @@ -85,9 +84,9 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 22 cache: 'pnpm' @@ -118,9 +117,9 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 22 cache: 'pnpm' @@ -140,6 +139,9 @@ jobs: name: Release Docker images if: ${{ github.event.inputs.release_docker || github.event_name == 'push'}} runs-on: ubuntu-latest + permissions: + contents: read + packages: write steps: - name: Get release version from tag if: ${{ github.event_name == 'push' }} @@ -155,26 +157,26 @@ jobs: uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Build and push root Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: ./Dockerfile @@ -187,7 +189,7 @@ jobs: ghcr.io/corentinth/enclosed:${{ env.RELEASE_VERSION}} - name: Build and push rootless Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: ./Dockerfile.rootless