From f138effeed975456f6cf0d305200af9e50027801 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9mi=20BUISSON?= Date: Fri, 3 Jul 2026 16:16:53 +0200 Subject: [PATCH 1/2] fix(docker): pin alpine base image and run as non-root --- Dockerfile | 4 +++- buildx.Dockerfile | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 8644ec7..bec040d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine +FROM alpine:3.24.1 RUN apk --no-cache --no-progress add git ca-certificates tzdata make \ && update-ca-certificates \ @@ -6,5 +6,7 @@ RUN apk --no-cache --no-progress add git ca-certificates tzdata make \ COPY ./dist/linux/amd64/plugin-service . +USER 65534 + ENTRYPOINT ["/plugin-service"] EXPOSE 80 diff --git a/buildx.Dockerfile b/buildx.Dockerfile index 9fdf0d9..46a939e 100644 --- a/buildx.Dockerfile +++ b/buildx.Dockerfile @@ -1,4 +1,4 @@ -FROM alpine +FROM alpine:3.24.1 RUN apk --no-cache --no-progress add git ca-certificates tzdata make \ && update-ca-certificates \ @@ -7,5 +7,7 @@ RUN apk --no-cache --no-progress add git ca-certificates tzdata make \ ARG TARGETPLATFORM COPY ./dist/$TARGETPLATFORM/plugin-service . +USER 65534 + ENTRYPOINT ["/plugin-service"] EXPOSE 80 From 065f28e4c9ad1993376b75edde7dd142afb26bfa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9mi=20BUISSON?= Date: Fri, 3 Jul 2026 16:24:12 +0200 Subject: [PATCH 2/2] ci: stop persisting github token on actions/checkout --- .github/workflows/ci.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index fd848a8..1325759 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -27,6 +27,8 @@ jobs: GOLANGCI_LINT_VERSION: 'v2.3.0' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' @@ -48,6 +50,8 @@ jobs: if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.draft }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' @@ -69,6 +73,8 @@ jobs: id-token: write steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod'