From e0f8ad2c37d46fe1284074f4c0f0d54792de752e Mon Sep 17 00:00:00 2001 From: Mark Story Date: Sat, 29 Aug 2026 23:06:02 -0400 Subject: [PATCH] Pin action image and reduce permissions Pin the image revision used for dokku deployments and reduce permissions for deploy jobs. Pinning the image revision reduces the chances of supply chain attacks on images with access to real credentials. --- .github/workflows/deploy_docs_2x.yml | 5 ++++- .github/workflows/deploy_docs_3x.yml | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy_docs_2x.yml b/.github/workflows/deploy_docs_2x.yml index 7a40f69..dee50ba 100644 --- a/.github/workflows/deploy_docs_2x.yml +++ b/.github/workflows/deploy_docs_2x.yml @@ -7,6 +7,9 @@ on: - 2.x workflow_dispatch: +permissions: + contents: read + jobs: deploy: runs-on: ubuntu-latest @@ -17,7 +20,7 @@ jobs: fetch-depth: 0 - name: Push to dokku - uses: dokku/github-action@master + uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0 with: git_remote_url: 'ssh://dokku@apps.cakephp.org:22/authorization-docs-2' ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }} diff --git a/.github/workflows/deploy_docs_3x.yml b/.github/workflows/deploy_docs_3x.yml index 7adece1..5b1aa14 100644 --- a/.github/workflows/deploy_docs_3x.yml +++ b/.github/workflows/deploy_docs_3x.yml @@ -7,6 +7,9 @@ on: - 3.x workflow_dispatch: +permissions: + contents: read + jobs: deploy: runs-on: ubuntu-latest @@ -17,7 +20,7 @@ jobs: fetch-depth: 0 - name: Push to dokku - uses: dokku/github-action@master + uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0 with: git_remote_url: 'ssh://dokku@apps.cakephp.org:22/authorization-docs-3' ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }}