chore: secure github actions (#31)

vrsandeep · web-flow · commit 02207911476b · 2026-07-10T19:33:53.000+05:30
based on learnings from https://snarky.ca/how-to-publish-to-pypi-using-github-actions-securely/
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/docker-edge.yml b/.github/workflows/docker-edge.yml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -5,12 +5,16 @@ on:
     tags:
       - 'v*.*.*'
 
+permissions: {}
+
 env:
   GO_VERSION: '1.26.2'
 
 jobs:
   build:
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       matrix:
         include:
@@ -29,7 +33,9 @@ jobs:
             cc: clang
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Install dependencies (Ubuntu)
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.arch == 'amd64' }}
@@ -70,15 +76,14 @@ jobs:
           brew install sqlite
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: ${{ env.GO_VERSION }}
-          cache: true
-          cache-dependency-path: go.sum
-
+          # Disabled to avoid cache poisoning on publish workflows.
+          cache: false
 
       - name: Install esbuild
-        run: npm install -g esbuild
+        run: npm install -g esbuild@0.28.1
 
       - name: Build assets
         run: make assets
@@ -87,40 +92,48 @@ jobs:
         run: |
           mkdir -p build
           go build \
-            -ldflags="-s -w -X main.version=${{ github.ref_name }} -X main.commit=${{ github.sha }} -X main.date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-            -o build/mango-go-${{ matrix.os }}-${{ matrix.arch }} \
+            -ldflags="-s -w -X main.version=${VERSION} -X main.commit=${COMMIT} -X main.date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            -o "build/mango-go-${OS_NAME}-${ARCH}" \
             .
         env:
+          VERSION: ${{ github.ref_name }}
+          COMMIT: ${{ github.sha }}
+          OS_NAME: ${{ matrix.os }}
+          ARCH: ${{ matrix.arch }}
           GOOS: ${{ matrix.os == 'ubuntu-latest' && 'linux' || 'darwin' }}
           CGO_ENABLED: 1
           GOARCH: ${{ matrix.arch }}
           CC: ${{ matrix.cc }}
 
       - name: Create release archive
         run: |
-          tar -czf build/mango-go-${{ matrix.os }}-${{ matrix.arch }}.tar.gz \
-            build/mango-go-${{ matrix.os }}-${{ matrix.arch }} \
+          tar -czf "build/mango-go-${OS_NAME}-${ARCH}.tar.gz" \
+            "build/mango-go-${OS_NAME}-${ARCH}" \
             README.md LICENSE
+        env:
+          OS_NAME: ${{ matrix.os }}
+          ARCH: ${{ matrix.arch }}
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: mango-go-${{ matrix.os }}-${{ matrix.arch }}
           path: build/mango-go-${{ matrix.os }}-${{ matrix.arch }}.tar.gz
           retention-days: 7
 
   release:
     runs-on: ubuntu-latest
+    needs: build
     permissions:
       contents: write
-      packages: write
-    needs: build
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 
       - name: Create checksums and rename files
         run: |
@@ -155,15 +168,15 @@ jobs:
           done
 
       - name: Create Release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: |
-            renamed/*.tar.gz
-            checksums.txt
-          generate_release_notes: true
-          tag_name: ${{ github.ref_name }}
-          draft: false
-          prerelease: false
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          gh release create "$TAG_NAME" \
+            renamed/*.tar.gz \
+            checksums.txt \
+            --generate-notes \
+            --title "$TAG_NAME"
 
   docker:
     runs-on: ubuntu-latest
@@ -173,32 +186,34 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
             type=semver,pattern={{version}}
             type=raw,value=latest
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -6,21 +6,27 @@ on:
   pull_request:
     branches: [ "master" ]
 
+permissions: {}
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: '1.26.2'
 
       - name: Install esbuild
-        run: npm install -g esbuild
+        run: npm install -g esbuild@0.28.1
 
       - name: Install dependencies
         run: |
@@ -31,3 +37,57 @@ jobs:
 
       - name: Run tests
         run: go test ./...
+
+  # Publishes the :dev edge image after tests pass on master.
+  # Kept in this workflow (instead of workflow_run) to avoid the dangerous trigger.
+  release-edge-image:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        with:
+          platforms: linux/amd64,linux/arm64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=raw,value=dev
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: |
+            type=gha
+            type=registry,ref=ghcr.io/${{ github.repository }}:cache
+          cache-to: |
+            type=gha,mode=max
+            type=registry,ref=ghcr.io/${{ github.repository }}:cache,mode=max
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
@@ -0,0 +1,26 @@
+name: GitHub Actions Security Analysis with zizmor
+
+on:
+  push:
+    branches: ["master"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
