improve permissions + small sec stuff

2026-06-08 12:42:11 -05:00
parent c3f34753c6
commit c606f8c662
3 changed files with 86 additions and 53 deletions
@@ -6,6 +6,9 @@ on:
    paths:
      - "Overlord-Desktop/**"

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: windows-latest
@@ -18,35 +21,56 @@ jobs:

    steps:
      - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

+      - name: Get Version
+        id: version
+        run: |
+          $version = (Get-Content package.json | ConvertFrom-Json).version
+          if ($version -notmatch '^\d+\.\d+\.\d+$') {
+            throw "package.json version must be strict X.Y.Z SemVer for release tags; got '$version'"
+          }
+          "version=$version" >> $env:GITHUB_OUTPUT
+        shell: pwsh
+
+      - name: Ensure Release Tag Does Not Exist
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          set -euo pipefail
+          tag="Overlord-Desktop-v${VERSION}"
+          if git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
+            echo "Release tag already exists: ${tag}" >&2
+            exit 1
+          fi
+          if gh release view "${tag}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
+            echo "Release already exists: ${tag}" >&2
+            exit 1
+          fi
+        shell: bash
+
      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
-          bun-version: latest
+          bun-version: 1.3.14

      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Cache Rust build
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
        with:
          workspaces: Overlord-Desktop/src-tauri -> target

      - name: Install Dependencies
-        run: bun install
+        run: bun install --frozen-lockfile

      - name: Vendor frontend assets
        run: bun run vendor

-      - name: Get Version
-        run: |
-          $version = (Get-Content package.json | ConvertFrom-Json).version
-          echo "VERSION=$version" >> $env:GITHUB_ENV
-        shell: pwsh
-
      - name: Build Windows Installer (Tauri NSIS)
        run: bun run build:win

@@ -59,42 +83,34 @@ jobs:
          echo "INSTALLER_NAME=$($nsis.Name)" >> $env:GITHUB_ENV

      - name: Upload Build Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
-          name: overlord-desktop-${{ env.VERSION }}
+          name: overlord-desktop-${{ steps.version.outputs.version }}
          path: ${{ env.INSTALLER }}

-      - name: Delete Existing Release and Tag
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Look up the release by tag_name via the list endpoint (works even if the git tag is gone)
-          RELEASE_ID=$(gh api /repos/${{ github.repository }}/releases \
-            --jq '.[] | select(.tag_name == "Overlord-Desktop-v${{ env.VERSION }}") | .id' \
-            2>/dev/null || true)
-          if [ -n "$RELEASE_ID" ]; then
-            gh api --method DELETE /repos/${{ github.repository }}/releases/$RELEASE_ID || true
-          fi
-          # Delete the git tag ref if it somehow still exists
-          gh api --method DELETE /repos/${{ github.repository }}/git/refs/tags/Overlord-Desktop-v${{ env.VERSION }} 2>/dev/null || true
-        shell: bash
-
      - name: Create and Push Tag
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
        run: |
+          set -euo pipefail
+          tag="Overlord-Desktop-v${VERSION}"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -f Overlord-Desktop-v${{ env.VERSION }}
-          git push origin Overlord-Desktop-v${{ env.VERSION }} --force
+          git tag "${tag}"
+          git push origin "${tag}"
        shell: bash

      - name: Create Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
        run: |
-          gh release create Overlord-Desktop-v${{ env.VERSION }} "${{ env.INSTALLER }}" "PLEASE_READ.txt" \
+          set -euo pipefail
+          tag="Overlord-Desktop-v${VERSION}"
+          gh release create "${tag}" "${INSTALLER}" "PLEASE_READ.txt" \
            --verify-tag \
-            -t "Overlord Desktop v${{ env.VERSION }}" \
-            -n "Automated build release for Overlord Desktop v${{ env.VERSION }}" \
+            -t "Overlord Desktop v${VERSION}" \
+            -n "Automated build release for Overlord Desktop v${VERSION}" \
            --draft=false \
            --prerelease=false
        shell: bash
@@ -4,18 +4,28 @@ on:
  push:
    tags:
      - 'v*'
-  workflow_dispatch:

 env:
  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
+
+permissions:
+  contents: read

 jobs:
  build-backstage-dll:
    runs-on: windows-latest
+    permissions:
+      contents: read
    steps:
+      - name: Validate Release Tag
+        shell: pwsh
+        run: |
+          if ($env:GITHUB_REF_NAME -notmatch '^v\d+\.\d+\.\d+$') {
+            throw "Ref must be a strict release tag like v1.2.3; got '$env:GITHUB_REF_NAME'"
+          }
+
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Build BackstageInjection DLL with MSVC
        shell: cmd
@@ -26,7 +36,7 @@ jobs:
        run: call build-backstage-capture-dll.bat

      - name: Upload HVNC DLLs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: hvnc-dll
          path: |
@@ -44,10 +54,10 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Download HVNC DLLs
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: hvnc-dll
          path: Overlord-Server/dist-clients
@@ -84,10 +94,13 @@ jobs:
          echo "minor=$minor" >> "$GITHUB_OUTPUT"

      - name: Validate Tag Matches Source Version
-        if: startsWith(github.ref, 'refs/tags/v')
        shell: bash
        run: |
          set -euo pipefail
+          if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Ref must be a strict release tag like v1.2.3; got ${GITHUB_REF_NAME}" >&2
+            exit 1
+          fi
          tag_version="${GITHUB_REF_NAME#v}"
          src_version="${{ steps.srcver.outputs.version }}"
          if [[ "$tag_version" != "$src_version" ]]; then
@@ -96,13 +109,13 @@ jobs:
          fi

      - name: Normalize image name
-        run: echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
+        run: printf 'IMAGE_NAME=%s\n' "${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -110,7 +123,7 @@ jobs:

      - name: Extract metadata
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
@@ -120,7 +133,7 @@ jobs:
            type=raw,value=latest

      - name: Build and push server image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
        with:
          context: .
          file: ./Dockerfile
@@ -5,20 +5,24 @@ on:
  push:
  workflow_dispatch:

+permissions:
+  contents: read
+
 jobs:
  changes:
    runs-on: ubuntu-latest
    permissions:
+      contents: read
      pull-requests: read
    outputs:
      server: ${{ steps.filter.outputs.server }}
      client: ${{ steps.filter.outputs.client }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Detect changed paths
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@6852f92c20ea7fd3b0c25de3b5112db3a98da050 # v3
        id: filter
        with:
          filters: |
@@ -42,12 +46,12 @@ jobs:
        working-directory: Overlord-Server
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
-          bun-version: latest
+          bun-version: 1.3.14

      - name: Install server dependencies
        run: bun install --frozen-lockfile
@@ -68,10 +72,10 @@ jobs:
        working-directory: Overlord-Client
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version-file: Overlord-Client/go.mod
          cache: true