From 1c64c564d96a2370d5dbfa19c958d928a23eb7b1 Mon Sep 17 00:00:00 2001
From: mdheller <21163552+mdheller@users.noreply.github.com>
Date: Sat, 4 Jul 2026 21:19:16 -0400
Subject: [PATCH] =?UTF-8?q?chore(ci):=20harden=20supply=20chain=20?=
 =?UTF-8?q?=E2=80=94=20pin=20actions=20to=20SHA=20+=20least-privilege=20pe?=
 =?UTF-8?q?rmissions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pin GitHub Actions to full commit SHA (floating tags are a supply-chain injection
vector), add least-privilege permissions, and add dependabot to maintain the pins.
---
 .github/dependabot.yml       |  6 ++++++
 .github/workflows/images.yml | 11 +++++------
 2 files changed, 11 insertions(+), 6 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..5ace460
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
index 6d654e1..277676a 100644
--- a/.github/workflows/images.yml
+++ b/.github/workflows/images.yml
@@ -18,11 +18,11 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: docker/setup-qemu-action@v3
-    - uses: docker/setup-buildx-action@v3
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+    - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+    - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
     - name: Login to GHCR
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         registry: ${{ env.REGISTRY }}
         username: ${{ github.actor }}
@@ -37,8 +37,7 @@ jobs:
         docker buildx build --platform $PLATFORMS --push -t $REGISTRY/$ORG/porter-shim:$TAG -f artifacts/porter-shim/Dockerfile .
 
     - name: Install cosign
-      uses: sigstore/cosign-installer@v3.6.0
-
+      uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
     - name: Cosign sign (keyless)
       run: |
         TAG=${GITHUB_SHA::7}