From ceabb94fc55ebb959550754431b8940255d35fd9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Mon, 1 Jun 2026 12:16:07 +0200 Subject: [PATCH 1/6] github/dependabot: Set cooldown to 7 days --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5ace460..6cc0071 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,3 +4,5 @@ updates: directory: "/" schedule: interval: "weekly" + cooldown: + default-days: 7 From 8bc9d6f5fc50d9ab636fcd8d4acb31dc275b4f81 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Mon, 1 Jun 2026 12:16:20 +0200 Subject: [PATCH 2/6] github/dependabot: Prefix commit message with 'ci:' --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6cc0071..bc1d356 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,3 +6,5 @@ updates: interval: "weekly" cooldown: default-days: 7 + commit-message: + prefix: "ci" From df42200d6f5827734babffceea5185ef56f07625 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Mon, 1 Jun 2026 12:18:16 +0200 Subject: [PATCH 3/6] github/workflows/php-fpm-ttrss: Fix quotes --- .github/workflows/php-fpm-ttrss.yml | 32 ++++++++++++++--------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/php-fpm-ttrss.yml b/.github/workflows/php-fpm-ttrss.yml index a833ce0..0c2bbb4 100644 --- a/.github/workflows/php-fpm-ttrss.yml +++ b/.github/workflows/php-fpm-ttrss.yml @@ -7,21 +7,21 @@ env: on: pull_request: branches: - - main + - "main" paths: - - 'php-fpm-ttrss/**' - - '.github/workflows/php-fpm-ttrss.yml' + - "php-fpm-ttrss/**" + - ".github/workflows/php-fpm-ttrss.yml" push: branches: - - main + - "main" paths: - - 'php-fpm-ttrss/**' - - '.github/workflows/php-fpm-ttrss.yml' + - "php-fpm-ttrss/**" + - ".github/workflows/php-fpm-ttrss.yml" schedule: - - cron: '0 0 * * MON' + - cron: "0 0 * * MON" workflow_dispatch: -permissions: read-all +permissions: "read-all" # Prevent multiple workflow runs from racing to ensure that pushes are made # sequentialy for the main branch. Also cancel in progress workflow runs for @@ -32,19 +32,19 @@ concurrency: jobs: build-push-image: - runs-on: ubuntu-24.04 + runs-on: "ubuntu-24.04" container: - image: quay.io/travier/podman-action + image: "quay.io/travier/podman-action" options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/kvm --device=/dev/fuse" steps: - - name: Fixup GitHub homedir + - name: "Fixup GitHub homedir" run: | mkdir -p /github/home/.docker/ - - name: Checkout repo + - name: "Checkout repo" uses: actions/checkout@v6 - - name: Build container image + - name: "Build container image" uses: redhat-actions/buildah-build@v2 with: context: ${{ env.NAME }} @@ -54,7 +54,7 @@ jobs: layers: false oci: true - - name: Push to Container Registry + - name: "Push to Container Registry" uses: redhat-actions/push-to-registry@v2 id: push if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main' @@ -68,7 +68,7 @@ jobs: --compression-format=zstd:chunked --compression-level=19 - - name: Login to Container Registry + - name: "Login to Container Registry" uses: redhat-actions/podman-login@v1 if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main' with: @@ -80,7 +80,7 @@ jobs: - uses: sigstore/cosign-installer@v3.10.0 if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main' - - name: Sign container image + - name: "Sign container image" if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main' run: | cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ env.REGISTRY }}/${{ env.NAME }}@${{ steps.push.outputs.digest }} From 613d711c7e4975b3cf5ca0d221dd755efbce169a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Mon, 1 Jun 2026 12:19:48 +0200 Subject: [PATCH 4/6] github/workflows: Pin all actions by sha --- .github/actions/build-push/action.yml | 8 ++++---- .github/workflows/nginx.yml | 4 +++- .github/workflows/php-fpm-ttrss.yml | 12 +++++++----- .github/workflows/toolbox-cloud-cli.yml | 4 +++- .github/workflows/toolbox-kdedev.yml | 4 +++- .github/workflows/toolbox.yml | 4 +++- .github/workflows/unbound.yml | 4 +++- 7 files changed, 26 insertions(+), 14 deletions(-) diff --git a/.github/actions/build-push/action.yml b/.github/actions/build-push/action.yml index 1abd0d6..a5dff92 100644 --- a/.github/actions/build-push/action.yml +++ b/.github/actions/build-push/action.yml @@ -43,7 +43,7 @@ runs: run: rm -rf "/run/host/usr/local/lib/android" - name: "Build container image" - uses: redhat-actions/buildah-build@v2 + uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2 with: context: ${{ inputs.name }} image: ${{ inputs.name }} @@ -56,7 +56,7 @@ runs: --volume /__w/containerfiles/containerfiles:/run/src - name: "Push to Container Registry" - uses: redhat-actions/push-to-registry@v2 + uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 id: "push" if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main' with: @@ -70,7 +70,7 @@ runs: --compression-level=19 - name: "Login to Container Registry" - uses: redhat-actions/podman-login@v1 + uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1 if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main' with: username: ${{ inputs.username }} @@ -79,7 +79,7 @@ runs: auth_file_path: "/tmp/auth.json" - name: "Install cosign" - uses: sigstore/cosign-installer@v3.10.0 + uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main' - name: "Sign container image" diff --git a/.github/workflows/nginx.yml b/.github/workflows/nginx.yml index 65325c0..5676f7b 100644 --- a/.github/workflows/nginx.yml +++ b/.github/workflows/nginx.yml @@ -38,7 +38,9 @@ jobs: options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/kvm --device=/dev/fuse" steps: - name: "Checkout repo" - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: "Build and push container image" uses: ./.github/actions/build-push diff --git a/.github/workflows/php-fpm-ttrss.yml b/.github/workflows/php-fpm-ttrss.yml index 0c2bbb4..4ee9afa 100644 --- a/.github/workflows/php-fpm-ttrss.yml +++ b/.github/workflows/php-fpm-ttrss.yml @@ -42,10 +42,12 @@ jobs: mkdir -p /github/home/.docker/ - name: "Checkout repo" - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: "Build container image" - uses: redhat-actions/buildah-build@v2 + uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2 with: context: ${{ env.NAME }} image: ${{ env.NAME }} @@ -55,7 +57,7 @@ jobs: oci: true - name: "Push to Container Registry" - uses: redhat-actions/push-to-registry@v2 + uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 id: push if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main' with: @@ -69,7 +71,7 @@ jobs: --compression-level=19 - name: "Login to Container Registry" - uses: redhat-actions/podman-login@v1 + uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1 if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main' with: registry: ${{ env.REGISTRY }} @@ -77,7 +79,7 @@ jobs: password: ${{ secrets.BOT_SECRET }} auth_file_path: /tmp/auth.json - - uses: sigstore/cosign-installer@v3.10.0 + - uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main' - name: "Sign container image" diff --git a/.github/workflows/toolbox-cloud-cli.yml b/.github/workflows/toolbox-cloud-cli.yml index 1952a06..4acde6b 100644 --- a/.github/workflows/toolbox-cloud-cli.yml +++ b/.github/workflows/toolbox-cloud-cli.yml @@ -36,7 +36,9 @@ jobs: options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/kvm --device=/dev/fuse --volume /:/run/host:rw" steps: - name: "Checkout repo" - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: "Build and push container image" uses: ./.github/actions/build-push diff --git a/.github/workflows/toolbox-kdedev.yml b/.github/workflows/toolbox-kdedev.yml index 5ea967c..198d4be 100644 --- a/.github/workflows/toolbox-kdedev.yml +++ b/.github/workflows/toolbox-kdedev.yml @@ -38,7 +38,9 @@ jobs: options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/kvm --device=/dev/fuse --volume /:/run/host:rw" steps: - name: "Checkout repo" - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: "Build and push container image" uses: ./.github/actions/build-push diff --git a/.github/workflows/toolbox.yml b/.github/workflows/toolbox.yml index 00e3e15..72eae0a 100644 --- a/.github/workflows/toolbox.yml +++ b/.github/workflows/toolbox.yml @@ -38,7 +38,9 @@ jobs: options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/kvm --device=/dev/fuse --volume /:/run/host:rw" steps: - name: "Checkout repo" - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: "Build and push container image" uses: ./.github/actions/build-push diff --git a/.github/workflows/unbound.yml b/.github/workflows/unbound.yml index 8b5bcbb..ab51487 100644 --- a/.github/workflows/unbound.yml +++ b/.github/workflows/unbound.yml @@ -38,7 +38,9 @@ jobs: options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/kvm --device=/dev/fuse" steps: - name: "Checkout repo" - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: "Build and push container image" uses: ./.github/actions/build-push From 501bd5bc95094fb75148c27ab3bd0dad030c957c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Mon, 1 Jun 2026 12:20:30 +0200 Subject: [PATCH 5/6] github/workflows: Fix potential template injection --- .github/actions/build-push/action.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/actions/build-push/action.yml b/.github/actions/build-push/action.yml index a5dff92..2021c08 100644 --- a/.github/actions/build-push/action.yml +++ b/.github/actions/build-push/action.yml @@ -86,7 +86,10 @@ runs: if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main' shell: "bash" run: | - cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ inputs.registry }}/${{ inputs.name }}@${{ steps.push.outputs.digest }} + cosign sign -y --key env://COSIGN_PRIVATE_KEY "${REGISTRY}/${NAME}@${DIGEST}" env: COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ inputs.cosign-private-key }} + REGISTRY: ${{ inputs.registry }} + NAME: ${{ inputs.name }} + DIGEST: ${{ steps.push.outputs.digest }} From 7b41aa6abe9550f6083a38b045fa0a63a93bf439 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Mon, 1 Jun 2026 12:20:56 +0200 Subject: [PATCH 6/6] github/workflows: Ignore unpinned container image --- .github/workflows/nginx.yml | 2 +- .github/workflows/php-fpm-ttrss.yml | 2 +- .github/workflows/toolbox-cloud-cli.yml | 2 +- .github/workflows/toolbox-kdedev.yml | 2 +- .github/workflows/toolbox.yml | 2 +- .github/workflows/unbound.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/nginx.yml b/.github/workflows/nginx.yml index 5676f7b..38c4131 100644 --- a/.github/workflows/nginx.yml +++ b/.github/workflows/nginx.yml @@ -34,7 +34,7 @@ jobs: build-push-image: runs-on: "ubuntu-24.04" container: - image: "quay.io/travier/podman-action" + image: "quay.io/travier/podman-action" # zizmor: ignore[unpinned-images] options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/kvm --device=/dev/fuse" steps: - name: "Checkout repo" diff --git a/.github/workflows/php-fpm-ttrss.yml b/.github/workflows/php-fpm-ttrss.yml index 4ee9afa..2304be7 100644 --- a/.github/workflows/php-fpm-ttrss.yml +++ b/.github/workflows/php-fpm-ttrss.yml @@ -34,7 +34,7 @@ jobs: build-push-image: runs-on: "ubuntu-24.04" container: - image: "quay.io/travier/podman-action" + image: "quay.io/travier/podman-action" # zizmor: ignore[unpinned-images] options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/kvm --device=/dev/fuse" steps: - name: "Fixup GitHub homedir" diff --git a/.github/workflows/toolbox-cloud-cli.yml b/.github/workflows/toolbox-cloud-cli.yml index 4acde6b..771d5b9 100644 --- a/.github/workflows/toolbox-cloud-cli.yml +++ b/.github/workflows/toolbox-cloud-cli.yml @@ -32,7 +32,7 @@ jobs: build-push-image: runs-on: "ubuntu-24.04" container: - image: "quay.io/travier/podman-action" + image: "quay.io/travier/podman-action" # zizmor: ignore[unpinned-images] options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/kvm --device=/dev/fuse --volume /:/run/host:rw" steps: - name: "Checkout repo" diff --git a/.github/workflows/toolbox-kdedev.yml b/.github/workflows/toolbox-kdedev.yml index 198d4be..93497e5 100644 --- a/.github/workflows/toolbox-kdedev.yml +++ b/.github/workflows/toolbox-kdedev.yml @@ -34,7 +34,7 @@ jobs: build-push-image: runs-on: "ubuntu-24.04" container: - image: "quay.io/travier/podman-action" + image: "quay.io/travier/podman-action" # zizmor: ignore[unpinned-images] options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/kvm --device=/dev/fuse --volume /:/run/host:rw" steps: - name: "Checkout repo" diff --git a/.github/workflows/toolbox.yml b/.github/workflows/toolbox.yml index 72eae0a..c14df05 100644 --- a/.github/workflows/toolbox.yml +++ b/.github/workflows/toolbox.yml @@ -34,7 +34,7 @@ jobs: build-push-image: runs-on: "ubuntu-24.04" container: - image: "quay.io/travier/podman-action" + image: "quay.io/travier/podman-action" # zizmor: ignore[unpinned-images] options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/kvm --device=/dev/fuse --volume /:/run/host:rw" steps: - name: "Checkout repo" diff --git a/.github/workflows/unbound.yml b/.github/workflows/unbound.yml index ab51487..56a7abf 100644 --- a/.github/workflows/unbound.yml +++ b/.github/workflows/unbound.yml @@ -34,7 +34,7 @@ jobs: build-push-image: runs-on: "ubuntu-24.04" container: - image: "quay.io/travier/podman-action" + image: "quay.io/travier/podman-action" # zizmor: ignore[unpinned-images] options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/kvm --device=/dev/fuse" steps: - name: "Checkout repo"