improve permissions + small sec stuff

.github/workflows/desktop-release.yml

@@ -6,6 +6,9 @@ on:
     paths:
       - "Overlord-Desktop/**"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: windows-latest
@@ -18,35 +21,56 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
 
+      - name: Get Version
+        id: version
+        run: |
+          $version = (Get-Content package.json | ConvertFrom-Json).version
+          if ($version -notmatch '^\d+\.\d+\.\d+$') {
+            throw "package.json version must be strict X.Y.Z SemVer for release tags; got '$version'"
+          }
+          "version=$version" >> $env:GITHUB_OUTPUT
+        shell: pwsh
+
+      - name: Ensure Release Tag Does Not Exist
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          set -euo pipefail
+          tag="Overlord-Desktop-v${VERSION}"
+          if git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
+            echo "Release tag already exists: ${tag}" >&2
+            exit 1
+          fi
+          if gh release view "${tag}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
+            echo "Release already exists: ${tag}" >&2
+            exit 1
+          fi
+        shell: bash
+
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: latest
+          bun-version: 1.3.14
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
       - name: Cache Rust build
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
         with:
           workspaces: Overlord-Desktop/src-tauri -> target
 
       - name: Install Dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Vendor frontend assets
         run: bun run vendor
 
-      - name: Get Version
-        run: |
-          $version = (Get-Content package.json | ConvertFrom-Json).version
-          echo "VERSION=$version" >> $env:GITHUB_ENV
-        shell: pwsh
-
       - name: Build Windows Installer (Tauri NSIS)
         run: bun run build:win
 
@@ -59,42 +83,34 @@ jobs:
           echo "INSTALLER_NAME=$($nsis.Name)" >> $env:GITHUB_ENV
 
       - name: Upload Build Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: overlord-desktop-${{ env.VERSION }}
+          name: overlord-desktop-${{ steps.version.outputs.version }}
           path: ${{ env.INSTALLER }}
 
-      - name: Delete Existing Release and Tag
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Look up the release by tag_name via the list endpoint (works even if the git tag is gone)
-          RELEASE_ID=$(gh api /repos/${{ github.repository }}/releases \
-            --jq '.[] | select(.tag_name == "Overlord-Desktop-v${{ env.VERSION }}") | .id' \
-            2>/dev/null || true)
-          if [ -n "$RELEASE_ID" ]; then
-            gh api --method DELETE /repos/${{ github.repository }}/releases/$RELEASE_ID || true
-          fi
-          # Delete the git tag ref if it somehow still exists
-          gh api --method DELETE /repos/${{ github.repository }}/git/refs/tags/Overlord-Desktop-v${{ env.VERSION }} 2>/dev/null || true
-        shell: bash
-
       - name: Create and Push Tag
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
+          set -euo pipefail
+          tag="Overlord-Desktop-v${VERSION}"
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -f Overlord-Desktop-v${{ env.VERSION }}
+          git tag "${tag}"
-          git push origin Overlord-Desktop-v${{ env.VERSION }} --force
+          git push origin "${tag}"
         shell: bash
 
       - name: Create Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
-          gh release create Overlord-Desktop-v${{ env.VERSION }} "${{ env.INSTALLER }}" "PLEASE_READ.txt" \
+          set -euo pipefail
+          tag="Overlord-Desktop-v${VERSION}"
+          gh release create "${tag}" "${INSTALLER}" "PLEASE_READ.txt" \
             --verify-tag \
-            -t "Overlord Desktop v${{ env.VERSION }}" \
+            -t "Overlord Desktop v${VERSION}" \
-            -n "Automated build release for Overlord Desktop v${{ env.VERSION }}" \
+            -n "Automated build release for Overlord Desktop v${VERSION}" \
             --draft=false \
             --prerelease=false
         shell: bash

.github/workflows/docker-publish.yml

@@ -4,18 +4,28 @@ on:
   push:
     tags:
       - 'v*'
-  workflow_dispatch:
 
 env:
   REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
+
+permissions:
+  contents: read
 
 jobs:
   build-backstage-dll:
     runs-on: windows-latest
+    permissions:
+      contents: read
     steps:
+      - name: Validate Release Tag
+        shell: pwsh
+        run: |
+          if ($env:GITHUB_REF_NAME -notmatch '^v\d+\.\d+\.\d+$') {
+            throw "Ref must be a strict release tag like v1.2.3; got '$env:GITHUB_REF_NAME'"
+          }
+
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Build BackstageInjection DLL with MSVC
         shell: cmd
@@ -26,7 +36,7 @@ jobs:
         run: call build-backstage-capture-dll.bat
 
       - name: Upload HVNC DLLs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: hvnc-dll
           path: |
@@ -44,10 +54,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Download HVNC DLLs
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: hvnc-dll
           path: Overlord-Server/dist-clients
@@ -84,10 +94,13 @@ jobs:
           echo "minor=$minor" >> "$GITHUB_OUTPUT"
 
       - name: Validate Tag Matches Source Version
-        if: startsWith(github.ref, 'refs/tags/v')
         shell: bash
         run: |
           set -euo pipefail
+          if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Ref must be a strict release tag like v1.2.3; got ${GITHUB_REF_NAME}" >&2
+            exit 1
+          fi
           tag_version="${GITHUB_REF_NAME#v}"
           src_version="${{ steps.srcver.outputs.version }}"
           if [[ "$tag_version" != "$src_version" ]]; then
@@ -96,13 +109,13 @@ jobs:
           fi
 
       - name: Normalize image name
-        run: echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
+        run: printf 'IMAGE_NAME=%s\n' "${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -110,7 +123,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -120,7 +133,7 @@ jobs:
             type=raw,value=latest
 
       - name: Build and push server image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
           file: ./Dockerfile

.github/workflows/tests.yml

@@ -5,20 +5,24 @@ on:
   push:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: read
     outputs:
       server: ${{ steps.filter.outputs.server }}
       client: ${{ steps.filter.outputs.client }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Detect changed paths
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@6852f92c20ea7fd3b0c25de3b5112db3a98da050 # v3
         id: filter
         with:
           filters: |
@@ -42,12 +46,12 @@ jobs:
         working-directory: Overlord-Server
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: latest
+          bun-version: 1.3.14
 
       - name: Install server dependencies
         run: bun install --frozen-lockfile
@@ -68,10 +72,10 @@ jobs:
         working-directory: Overlord-Client
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version-file: Overlord-Client/go.mod
           cache: true