mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-10-28 14:08:45 -04:00
Thibaud-Vdb
9f00a04b11
* Pin the docker and pages actions to full commits The docker-publish workflow logs into Docker Hub and pushes the official images, and its actions were referenced by version tags. A tag is a movable pointer, whoever controls an action repository can point it at different code after review, which is how the tj-actions/changed-files incident (CVE-2025-30066) leaked CI secrets at scale. A full commit cannot be retargeted. setup-ruby and dockerhub-description were already pinned this way here, this extends the same practice to the rest. Each pin keeps the version as a trailing comment for review against the action's releases page, versions stay exactly where they were, and dependabot bumps commit pins the same way it bumps tags. * Declare token permissions on the tests and description workflows Both ran with the repository's default token grants and neither writes through the GitHub token, the Docker Hub description update authenticates with its own credentials. They drop to a read only token, matching what docker-publish and the pages workflow already declare.