mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
c1ce13758f
Pin three third-party actions to full commit SHAs with version comments so dependabot can update them in place without exposing the pipeline to upstream tag tampering: - aquasecurity/trivy-action@v0.35.0 - peter-evans/create-pull-request@v8.1.1 - googleapis/release-please-action@v4.4.0 Add a workflow-level permissions: contents: read default to ci.yml, with update-screenshots keeping its explicit contents: write + pull-requests: write override. Add the same default to docker-publish.yml (single job). Expand .dockerignore to explicitly exclude .env*, *.key, *.pem, .github/, docs/, website/, e2e/, tests/, test-results/, and playwright-report/ as defense in depth against accidental build-context leaks. None of these paths are read by any COPY step in Dockerfile.
28 lines
454 B
Plaintext
28 lines
454 B
Plaintext
**/node_modules
|
|
**/dist
|
|
.git
|
|
.gitignore
|
|
.DS_Store
|
|
|
|
# Docs and non-runtime content. Not needed in the image, bloats build context.
|
|
plans/
|
|
Product Requirements Document
|
|
*.md
|
|
docs/
|
|
website/
|
|
|
|
# Tests and reports. Never shipped in the image.
|
|
e2e/
|
|
tests/
|
|
test-results/
|
|
playwright-report/
|
|
|
|
# CI config runs on GitHub Actions, not inside the image.
|
|
.github/
|
|
|
|
# Secrets and key material. Defense in depth against accidental context leaks.
|
|
.env
|
|
.env.*
|
|
*.key
|
|
*.pem
|