mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
c1ce13758f
Pin three third-party actions to full commit SHAs with version comments so dependabot can update them in place without exposing the pipeline to upstream tag tampering: - aquasecurity/trivy-action@v0.35.0 - peter-evans/create-pull-request@v8.1.1 - googleapis/release-please-action@v4.4.0 Add a workflow-level permissions: contents: read default to ci.yml, with update-screenshots keeping its explicit contents: write + pull-requests: write override. Add the same default to docker-publish.yml (single job). Expand .dockerignore to explicitly exclude .env*, *.key, *.pem, .github/, docs/, website/, e2e/, tests/, test-results/, and playwright-report/ as defense in depth against accidental build-context leaks. None of these paths are read by any COPY step in Dockerfile.