From f8d560c5c9ce67b63d42188d841bca03f7028277 Mon Sep 17 00:00:00 2001
From: phil <phil@keiailab.com>
Date: Tue, 6 Oct 2026 10:06:56 +0900
Subject: [PATCH] ci: pin actions by SHA, scope release perms

Mutable tags (@v3, @v6, @v0.36.0) let an upstream retag change what
runs with packages:write and id-token:write. Pin every uses: to its
commit SHA, tag kept as a comment for Dependabot.

release.yml granted write scopes workflow-wide; move them to the
release job so the top level stays contents: read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: phil <phil@keiailab.com>
---
 .github/workflows/ci.yml      |  8 ++++----
 .github/workflows/release.yml | 22 ++++++++++++----------
 2 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d243f60..1b67e2a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,8 +21,8 @@ jobs:
     name: fmt + vet + test + build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: go.mod
           cache: true
@@ -42,8 +42,8 @@ jobs:
     name: chart lint + secret isolation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: azure/setup-helm@v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
       - name: Install kubeconform
         run: |
           set -euo pipefail
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f873010..937793b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,8 +23,6 @@ on:
 
 permissions:
   contents: read
-  packages: write   # ghcr push
-  id-token: write   # cosign keyless (Fulcio OIDC)
 
 env:
   IMG: ghcr.io/keiailab/nodevitals
@@ -33,8 +31,12 @@ env:
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write   # ghcr push
+      id-token: write   # cosign keyless (Fulcio OIDC)
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Read versions from Chart.yaml (SSOT)
         id: ver
@@ -46,7 +48,7 @@ jobs:
           echo "app=$APP chart=$CHART"
 
       - name: Log in to ghcr
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -61,13 +63,13 @@ jobs:
             echo "exists=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
         if: steps.img.outputs.exists == 'false'
 
       # Fail-closed: 취약점 스캔은 push 전에 로컬 이미지로 (ADR-0002).
       - name: Build (local, for scan)
         if: steps.img.outputs.exists == 'false'
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           platforms: linux/amd64
@@ -80,7 +82,7 @@ jobs:
 
       - name: Trivy scan (HIGH/CRITICAL block)
         if: steps.img.outputs.exists == 'false'
-        uses: aquasecurity/trivy-action@v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: ${{ env.IMG }}:scan
           severity: HIGH,CRITICAL
@@ -89,7 +91,7 @@ jobs:
 
       - name: Push image (provenance + sbom)
         if: steps.img.outputs.exists == 'false'
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           platforms: linux/amd64
@@ -100,7 +102,7 @@ jobs:
           build-args: |
             VERSION=${{ steps.ver.outputs.app }}
 
-      - uses: sigstore/cosign-installer@v3
+      - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
         if: steps.img.outputs.exists == 'false'
 
       - name: Cosign sign (keyless, by digest)
@@ -113,7 +115,7 @@ jobs:
             --certificate-oidc-issuer=https://token.actions.githubusercontent.com >/dev/null
           echo "signed $IMG@$DIG"
 
-      - uses: azure/setup-helm@v4
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
 
       - name: Push chart (skip if published)
         run: |