From 4b2d7ece3865551feb054ff7b5ca735bc8c34291 Mon Sep 17 00:00:00 2001 From: Charles GTE Date: Sat, 1 Aug 2026 21:40:44 +0200 Subject: [PATCH 1/3] fix: Workflow inlines user input into a shell script --- .github/workflows/release.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a75f411f..acf4dee5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,8 +19,9 @@ jobs: steps: - name: Determine if release should be skipped id: set-skip + env: + TITLE: ${{ github.event.pull_request.title }} run: | - TITLE="${{ github.event.pull_request.title }}" echo "PR title: $TITLE" if [[ "$TITLE" == *"[skip-release]"* ]]; then From 30cc8c1910cb357aa25117903a21185a8a9bafff Mon Sep 17 00:00:00 2001 From: Charles GTE Date: Sat, 1 Aug 2026 22:05:50 +0200 Subject: [PATCH 2/3] fix: Third-party actions pinned by commit SHA --- .github/workflows/discord.yml | 3 +++ .github/workflows/docker.yml | 13 ++++++++----- .github/workflows/e2e.yml | 8 ++++---- .github/workflows/ghcr.yml | 12 ++++++------ .github/workflows/helm.yml | 6 +++++- .github/workflows/plumber.yml | 20 ++++++++++++++++++++ .github/workflows/release.yml | 2 +- .github/workflows/security.yml | 7 +++++-- 8 files changed, 52 insertions(+), 19 deletions(-) create mode 100644 .github/workflows/plumber.yml diff --git a/.github/workflows/discord.yml b/.github/workflows/discord.yml index 74e32ee2..c9814aec 100644 --- a/.github/workflows/discord.yml +++ b/.github/workflows/discord.yml @@ -21,6 +21,9 @@ on: GH_TOKEN: required: true +permissions: + contents: read + jobs: notify-discord: runs-on: ubuntu-latest diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index e0e9ff45..f66f6a6d 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -31,6 +31,9 @@ on: DOCKER_PASSWORD: required: true +permissions: + contents: read + jobs: build: name: Build architectures @@ -47,10 +50,10 @@ jobs: fetch-depth: 0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Login to Docker - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} @@ -64,7 +67,7 @@ jobs: - name: Build and push image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: ${{ inputs.dockerfile }} @@ -100,7 +103,7 @@ jobs: path: /tmp/digests/arm64 - name: Login to Docker - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} @@ -124,7 +127,7 @@ jobs: - name: Extract Docker metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 with: images: ${{ inputs.image_name }} tags: | diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index f0400795..7737fd61 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -23,17 +23,17 @@ jobs: run: echo "ref=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/portabase:${GITHUB_SHA}" >> "$GITHUB_OUTPUT" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Log in to GHCR - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build and push Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: ./docker/dockerfile/Dockerfile @@ -45,7 +45,7 @@ jobs: run-e2e: if: github.event.pull_request.head.repo.full_name == github.repository needs: build-image - uses: portabase/e2e-tests/.github/workflows/run-e2e.yml@main + uses: portabase/e2e-tests/.github/workflows/run-e2e.yml@20a78d9134357c074c01aa3196c54220d9a615fc # main with: server_image: ${{ needs.build-image.outputs.image }} secrets: diff --git a/.github/workflows/ghcr.yml b/.github/workflows/ghcr.yml index 99fc9805..8de3e557 100644 --- a/.github/workflows/ghcr.yml +++ b/.github/workflows/ghcr.yml @@ -49,10 +49,10 @@ jobs: fetch-depth: 1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Log in to GHCR - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ github.actor }} @@ -60,7 +60,7 @@ jobs: - name: Build and push by digest id: build - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: ${{ inputs.dockerfile }} @@ -103,10 +103,10 @@ jobs: merge-multiple: true - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Log in to GHCR - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ github.actor }} @@ -114,7 +114,7 @@ jobs: - name: Extract Docker metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 with: images: ${{ steps.prep.outputs.image }} tags: | diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml index 03a07779..5a3dcc9a 100644 --- a/.github/workflows/helm.yml +++ b/.github/workflows/helm.yml @@ -9,6 +9,10 @@ on: GH_TOKEN: required: true +permissions: + contents: read + packages: write + jobs: publish-helm: runs-on: ubuntu-latest @@ -18,7 +22,7 @@ jobs: fetch-depth: 0 - name: Set up Helm - uses: azure/setup-helm@v4 + uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4 - name: Package Helm chart run: | diff --git a/.github/workflows/plumber.yml b/.github/workflows/plumber.yml new file mode 100644 index 00000000..8082c719 --- /dev/null +++ b/.github/workflows/plumber.yml @@ -0,0 +1,20 @@ +name: Plumber + +on: + pull_request: + push: + branches: [ main ] + +permissions: + contents: read + security-events: write + id-token: write + +jobs: + plumber: + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@v6 + - uses: getplumber/plumber@7ad9d267ee5a00163cec9e5c749a088d5f565167 # v0.4.26 + with: + score-push: true \ No newline at end of file diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index acf4dee5..6ac12285 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -51,7 +51,7 @@ jobs: token: ${{ steps.app-token.outputs.token }} ref: main - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 - uses: actions/setup-node@v4 with: node-version: "lts/*" diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index d9a26bbf..dd8b61b8 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -4,12 +4,15 @@ on: push: branches: [ main ] +permissions: + contents: read + jobs: sca-deps: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: aquasecurity/trivy-action@v0.35.0 + - uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0 with: scan-type: 'fs' format: 'table' @@ -23,7 +26,7 @@ jobs: - uses: actions/checkout@v4 with: fetch-depth: 0 - - uses: gitleaks/gitleaks-action@v2 + - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} From e64c8727a49913e103bd18c07c29f5db44c34801 Mon Sep 17 00:00:00 2001 From: Charles GTE Date: Sat, 1 Aug 2026 22:25:43 +0200 Subject: [PATCH 3/3] fix: plumber score in README.md --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 5d716558..7c7d2599 100644 --- a/README.md +++ b/README.md @@ -11,6 +11,7 @@

+[![Plumber Score](https://score.getplumber.io/github.com/Portabase/portabase.svg)](https://score.getplumber.io/github.com/Portabase/portabase) [![License: Apache](https://img.shields.io/badge/License-apache-yellow.svg)](LICENSE) [![Docker Pulls](https://img.shields.io/docker/pulls/portabase/portabase?color=brightgreen)](https://hub.docker.com/r/portabase/portabase) [![Helm Chart](https://img.shields.io/badge/Helm-Kubernetes-326ce5?logo=helm&logoColor=white)](https://github.com/Portabase/portabase/pkgs/container/charts%2Fportabase) @@ -36,6 +37,7 @@ [![ShadcnUI][ShadcnUI]][ShadcnUI-url] [![Docker][Docker]][Docker-url] +

Website •