From c606f8c662661fca95546bec0c6e202cef335eb7 Mon Sep 17 00:00:00 2001 From: KingKDot Date: Mon, 8 Jun 2026 12:42:11 -0500 Subject: [PATCH] improve permissions + small sec stuff --- .github/workflows/desktop-release.yml | 84 ++++++++++++++++----------- .github/workflows/docker-publish.yml | 37 ++++++++---- .github/workflows/tests.yml | 18 +++--- 3 files changed, 86 insertions(+), 53 deletions(-) diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml index a663b3b..24a2142 100644 --- a/.github/workflows/desktop-release.yml +++ b/.github/workflows/desktop-release.yml @@ -6,6 +6,9 @@ on: paths: - "Overlord-Desktop/**" +permissions: + contents: read + jobs: build: runs-on: windows-latest @@ -18,35 +21,56 @@ jobs: steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 0 + - name: Get Version + id: version + run: | + $version = (Get-Content package.json | ConvertFrom-Json).version + if ($version -notmatch '^\d+\.\d+\.\d+$') { + throw "package.json version must be strict X.Y.Z SemVer for release tags; got '$version'" + } + "version=$version" >> $env:GITHUB_OUTPUT + shell: pwsh + + - name: Ensure Release Tag Does Not Exist + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + VERSION: ${{ steps.version.outputs.version }} + run: | + set -euo pipefail + tag="Overlord-Desktop-v${VERSION}" + if git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then + echo "Release tag already exists: ${tag}" >&2 + exit 1 + fi + if gh release view "${tag}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then + echo "Release already exists: ${tag}" >&2 + exit 1 + fi + shell: bash + - name: Setup Bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: - bun-version: latest + bun-version: 1.3.14 - name: Setup Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - name: Cache Rust build - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2 with: workspaces: Overlord-Desktop/src-tauri -> target - name: Install Dependencies - run: bun install + run: bun install --frozen-lockfile - name: Vendor frontend assets run: bun run vendor - - name: Get Version - run: | - $version = (Get-Content package.json | ConvertFrom-Json).version - echo "VERSION=$version" >> $env:GITHUB_ENV - shell: pwsh - - name: Build Windows Installer (Tauri NSIS) run: bun run build:win @@ -59,42 +83,34 @@ jobs: echo "INSTALLER_NAME=$($nsis.Name)" >> $env:GITHUB_ENV - name: Upload Build Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: - name: overlord-desktop-${{ env.VERSION }} + name: overlord-desktop-${{ steps.version.outputs.version }} path: ${{ env.INSTALLER }} - - name: Delete Existing Release and Tag - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - # Look up the release by tag_name via the list endpoint (works even if the git tag is gone) - RELEASE_ID=$(gh api /repos/${{ github.repository }}/releases \ - --jq '.[] | select(.tag_name == "Overlord-Desktop-v${{ env.VERSION }}") | .id' \ - 2>/dev/null || true) - if [ -n "$RELEASE_ID" ]; then - gh api --method DELETE /repos/${{ github.repository }}/releases/$RELEASE_ID || true - fi - # Delete the git tag ref if it somehow still exists - gh api --method DELETE /repos/${{ github.repository }}/git/refs/tags/Overlord-Desktop-v${{ env.VERSION }} 2>/dev/null || true - shell: bash - - name: Create and Push Tag + env: + VERSION: ${{ steps.version.outputs.version }} run: | + set -euo pipefail + tag="Overlord-Desktop-v${VERSION}" git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" - git tag -f Overlord-Desktop-v${{ env.VERSION }} - git push origin Overlord-Desktop-v${{ env.VERSION }} --force + git tag "${tag}" + git push origin "${tag}" shell: bash - name: Create Release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + VERSION: ${{ steps.version.outputs.version }} run: | - gh release create Overlord-Desktop-v${{ env.VERSION }} "${{ env.INSTALLER }}" "PLEASE_READ.txt" \ + set -euo pipefail + tag="Overlord-Desktop-v${VERSION}" + gh release create "${tag}" "${INSTALLER}" "PLEASE_READ.txt" \ --verify-tag \ - -t "Overlord Desktop v${{ env.VERSION }}" \ - -n "Automated build release for Overlord Desktop v${{ env.VERSION }}" \ + -t "Overlord Desktop v${VERSION}" \ + -n "Automated build release for Overlord Desktop v${VERSION}" \ --draft=false \ --prerelease=false shell: bash diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index a458e4f..5b23dc2 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -4,18 +4,28 @@ on: push: tags: - 'v*' - workflow_dispatch: env: REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }} + +permissions: + contents: read jobs: build-backstage-dll: runs-on: windows-latest + permissions: + contents: read steps: + - name: Validate Release Tag + shell: pwsh + run: | + if ($env:GITHUB_REF_NAME -notmatch '^v\d+\.\d+\.\d+$') { + throw "Ref must be a strict release tag like v1.2.3; got '$env:GITHUB_REF_NAME'" + } + - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Build BackstageInjection DLL with MSVC shell: cmd @@ -26,7 +36,7 @@ jobs: run: call build-backstage-capture-dll.bat - name: Upload HVNC DLLs - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hvnc-dll path: | @@ -44,10 +54,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Download HVNC DLLs - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: hvnc-dll path: Overlord-Server/dist-clients @@ -84,10 +94,13 @@ jobs: echo "minor=$minor" >> "$GITHUB_OUTPUT" - name: Validate Tag Matches Source Version - if: startsWith(github.ref, 'refs/tags/v') shell: bash run: | set -euo pipefail + if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + echo "Ref must be a strict release tag like v1.2.3; got ${GITHUB_REF_NAME}" >&2 + exit 1 + fi tag_version="${GITHUB_REF_NAME#v}" src_version="${{ steps.srcver.outputs.version }}" if [[ "$tag_version" != "$src_version" ]]; then @@ -96,13 +109,13 @@ jobs: fi - name: Normalize image name - run: echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV + run: printf 'IMAGE_NAME=%s\n' "${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -110,7 +123,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | @@ -120,7 +133,7 @@ jobs: type=raw,value=latest - name: Build and push server image - uses: docker/build-push-action@v5 + uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5 with: context: . file: ./Dockerfile diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 0ce4377..058c4e5 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -5,20 +5,24 @@ on: push: workflow_dispatch: +permissions: + contents: read + jobs: changes: runs-on: ubuntu-latest permissions: + contents: read pull-requests: read outputs: server: ${{ steps.filter.outputs.server }} client: ${{ steps.filter.outputs.client }} steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Detect changed paths - uses: dorny/paths-filter@v3 + uses: dorny/paths-filter@6852f92c20ea7fd3b0c25de3b5112db3a98da050 # v3 id: filter with: filters: | @@ -42,12 +46,12 @@ jobs: working-directory: Overlord-Server steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Setup Bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: - bun-version: latest + bun-version: 1.3.14 - name: Install server dependencies run: bun install --frozen-lockfile @@ -68,10 +72,10 @@ jobs: working-directory: Overlord-Client steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Setup Go - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: Overlord-Client/go.mod cache: true