[StepSecurity] ci: Harden GitHub Actions

.github/workflows/dependabot-auto-merge.yml

@@ -10,7 +10,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: dependabot-metadata
-        uses: dependabot/[email protected]
+        uses: dependabot/fetch-metadata@5ef00187930bafb52d529e0b9c3dff045dfa9851 # v1.3.5
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Enable auto-merge for Dependabot PRs

.github/workflows/docker.yml

@@ -25,13 +25,16 @@ concurrency:
   group: ${{ github.ref_name }}-ci
   cancel-in-progress: true
 
+permissions:  # added using https://github.com/step-security/secure-workflows
+  contents: read
+
 jobs:
     build-docker:
       name: Build Docker Image
       runs-on: ubuntu-20.04
       steps:
         - name: Checkout Repository
-          uses: actions/checkout@v3
+          uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
 
         - name: Output Variables
           id: var
@@ -44,25 +47,25 @@ jobs:
             echo "::set-output name=njs_version::$njs"
 
         - name: Setup QEMU
-          uses: docker/setup-qemu-action@v2
+          uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0
           with:
             platforms: arm,arm64,ppc64le,s390x
           if: github.event_name != 'pull_request'
 
         - name: Docker Buildx
-          uses: docker/setup-buildx-action@v2
+          uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2.2.1
           with:
             buildkitd-flags: --debug
 
         - name: DockerHub Login
-          uses: docker/login-action@v2
+          uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
           with:
             username: ${{ secrets.DOCKER_USERNAME }}
             password: ${{ secrets.DOCKER_PASSWORD }}
           if: github.event_name != 'pull_request'
 
         - name: Login to GitHub Container Registry
-          uses: docker/login-action@v2
+          uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
           with:
             registry: ghcr.io
             username: ${{ github.repository_owner }}
@@ -71,7 +74,7 @@ jobs:
 
         - name: Docker meta
           id: meta
-          uses: docker/metadata-action@v4
+          uses: docker/metadata-action@57396166ad8aefe6098280995947635806a0e6ea # v4.1.1
           with:
             images: |
               nginxcontrib/nginx-ubi
@@ -80,7 +83,7 @@ jobs:
               type=raw,value=${{ steps.var.outputs.nginx_version }}
 
         - name: Build from source
-          uses: docker/build-push-action@v3
+          uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v3.2.0
           id: build
           with:
             pull: true
@@ -97,7 +100,7 @@ jobs:
               NJS=${{ steps.var.outputs.njs_version }}
 
         - name: Build prebuilt
-          uses: docker/build-push-action@v3
+          uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v3.2.0
           id: build-prebuilt
           with:
             pull: true

.github/workflows/dockerhub-description.yml

@@ -10,10 +10,10 @@ jobs:
   dockerHubDescription:
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
 
       - name: Docker Hub Description
-        uses: peter-evans/dockerhub-description@v3
+        uses: peter-evans/dockerhub-description@93b93397c27ed52b4055b8c6b2f8d92456ab3c56 # v3.1.2
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}

.github/workflows/update-docker-images.yml

@@ -19,7 +19,7 @@ jobs:
       nginx_version: ${{ steps.version.outputs.nginx_version }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
       - name: Set Base image version
         id: version
         run: |
@@ -35,12 +35,12 @@ jobs:
     steps:
       - name: Check if update available
         id: update
-        uses: lucacome/docker-image-update-checker@v1
+        uses: lucacome/docker-image-update-checker@93aeebde51b01e63284197bae89f9a1d6dd1921f # v1.1.1
         with:
           base-image: ${{ needs.variables.outputs.ubi_version }}
           image: nginxcontrib/nginx-ubi:${{ needs.variables.outputs.nginx_version }}
       - name: Repository Dispatch
-        uses: peter-evans/repository-dispatch@v2
+        uses: peter-evans/repository-dispatch@f2696244ec00ed5c659a5cc77f7138ad0302dffb # v2.1.0
         with:
           token: ${{ secrets.REPO_ACCESS_TOKEN }}
           event-type: update