From cd2273fdb4219810eee5217917eca7ce2d6c03ae Mon Sep 17 00:00:00 2001
From: Giordon Stark <kratsg@gmail.com>
Date: Thu, 13 Aug 2026 13:09:02 -0500
Subject: [PATCH 1/2] ci: pin GitHub Actions to SHAs

Resolve every action reference in base_builder.yaml to its commit SHA
(with a version comment) via actions-up, so a compromised or retagged
release cannot silently change what the workflow runs. Each action was
also bumped to its latest release; see PR description for the resulting
major version changes.

Assisted-by: Claude (Anthropic)
---
 .github/workflows/base_builder.yaml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/base_builder.yaml b/.github/workflows/base_builder.yaml
index e31385a..2418536 100644
--- a/.github/workflows/base_builder.yaml
+++ b/.github/workflows/base_builder.yaml
@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5.7.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           # list of Docker images to use as base name for tags
           images: |
@@ -31,21 +31,21 @@ jobs:
             type=sha
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.6.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.10.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3.4.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to Harbor Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3.4.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: hub.opensciencegrid.org
           username: ${{ secrets.HARBOR_USERNAME }}
@@ -53,7 +53,7 @@ jobs:
 
       - name: Test build
         if: github.event_name == 'pull_request'
-        uses: docker/build-push-action@v6.15.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: docker/Dockerfile
@@ -68,7 +68,7 @@ jobs:
 
       - name: Build and push
         if: github.event_name != 'pull_request'
-        uses: docker/build-push-action@v6.15.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: docker/Dockerfile
@@ -78,7 +78,7 @@ jobs:
 
       - name: Repository Dispatch
         if: github.event_name != 'pull_request'
-        uses: peter-evans/repository-dispatch@v3.0.0
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.GITOPS_REBUILD_TRIGGER }}
           repository: usatlas/analysisbase-dask-uc

From 78d3d6052fba0f1315def19425a5ed356b3b18f2 Mon Sep 17 00:00:00 2001
From: Giordon Stark <kratsg@gmail.com>
Date: Thu, 13 Aug 2026 13:09:27 -0500
Subject: [PATCH 2/2] ci: add zizmor hardening and dependabot for actions

Address zizmor --persona=pedantic findings on base_builder.yaml:
- artipacked: set persist-credentials: false on the checkout step.
- excessive-permissions: default to permissions: {} at the workflow
  level and grant the job only contents: read (needed by checkout).
- concurrency-limits: add a per-ref concurrency group so overlapping
  runs cancel stale ones instead of racing.
- anonymous-definition: name the job.

Also add .github/dependabot.yml for monthly, 7-day-cooldown, grouped
updates of GitHub Actions, since none existed.

Assisted-by: Claude (Anthropic)
---
 .github/dependabot.yml              | 12 ++++++++++++
 .github/workflows/base_builder.yaml | 11 +++++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..274c097
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/base_builder.yaml b/.github/workflows/base_builder.yaml
index 2418536..aea5cb9 100644
--- a/.github/workflows/base_builder.yaml
+++ b/.github/workflows/base_builder.yaml
@@ -8,12 +8,23 @@ on:
     branches: ["main"]
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
 jobs:
   docker:
+    name: Build and push base image
     runs-on: ubuntu-latest
+    permissions:
+      contents: read  # actions/checkout
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Docker meta
         id: meta