improve permissions + small sec stuff

.github/workflows/docker-publish.yml

@@ -4,18 +4,28 @@ on:
   push:
     tags:
       - 'v*'
-  workflow_dispatch:
 
 env:
   REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
+
+permissions:
+  contents: read
 
 jobs:
   build-backstage-dll:
     runs-on: windows-latest
+    permissions:
+      contents: read
     steps:
+      - name: Validate Release Tag
+        shell: pwsh
+        run: |
+          if ($env:GITHUB_REF_NAME -notmatch '^v\d+\.\d+\.\d+$') {
+            throw "Ref must be a strict release tag like v1.2.3; got '$env:GITHUB_REF_NAME'"
+          }
+
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Build BackstageInjection DLL with MSVC
         shell: cmd
@@ -26,7 +36,7 @@ jobs:
         run: call build-backstage-capture-dll.bat
 
       - name: Upload HVNC DLLs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: hvnc-dll
           path: |
@@ -44,10 +54,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Download HVNC DLLs
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: hvnc-dll
           path: Overlord-Server/dist-clients
@@ -84,10 +94,13 @@ jobs:
           echo "minor=$minor" >> "$GITHUB_OUTPUT"
 
       - name: Validate Tag Matches Source Version
-        if: startsWith(github.ref, 'refs/tags/v')
         shell: bash
         run: |
           set -euo pipefail
+          if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Ref must be a strict release tag like v1.2.3; got ${GITHUB_REF_NAME}" >&2
+            exit 1
+          fi
           tag_version="${GITHUB_REF_NAME#v}"
           src_version="${{ steps.srcver.outputs.version }}"
           if [[ "$tag_version" != "$src_version" ]]; then
@@ -96,13 +109,13 @@ jobs:
           fi
 
       - name: Normalize image name
-        run: echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
+        run: printf 'IMAGE_NAME=%s\n' "${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -110,7 +123,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -120,7 +133,7 @@ jobs:
             type=raw,value=latest
 
       - name: Build and push server image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
           file: ./Dockerfile