Prod deploy

.github/dependabot.yml

@@ -8,6 +8,10 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+  - package-ecosystem: "gomod"
+    directory: "pkg"
+    schedule:
+      interval: "daily"
   - package-ecosystem: "npm"
     directory: "/"
     schedule:

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - develop
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test

.github/workflows/deploy-check.yml

@@ -1,7 +1,7 @@
 name: Check Deploy
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - reopened
@@ -10,6 +10,9 @@ on:
     branches:
       - main
 
+permissions: 
+  contents: read
+
 jobs:
   check:
     if: github.head_ref != 'develop'

.github/workflows/fast-forward.yml

@@ -27,6 +27,9 @@ jobs:
   publish:
     needs:
       - approved
+    permissions:
+      contents: write
+      packages: write
     # Call workflow explicitly because events from actions cannot trigger more actions
     uses: ./.github/workflows/release.yml
     secrets: inherit

.github/workflows/install.yml

@@ -14,6 +14,9 @@ on:
       - 'package.json'
       - 'scripts/**'
 
+permissions:
+  contents: write
+
 jobs:
   pack:
     runs-on: ubuntu-latest
@@ -99,7 +102,8 @@ jobs:
 
       - run: npm install -g pnpm
       - run: pnpm init
-      - run: pnpm i --save-dev ./supabase-1.28.0.tgz
+      # https://github.com/pnpm/pnpm/issues/9124#issuecomment-2663021284
+      - run: pnpm i --save-dev ./supabase-1.28.0.tgz --allow-build=supabase
       - run: pnpm supabase --version
 
   bun:

.github/workflows/mirror-image.yml

@@ -13,6 +13,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   mirror:
     runs-on: ubuntu-latest

.github/workflows/mirror.yml

@@ -19,6 +19,9 @@ on:
       - submitted
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     runs-on: ubuntu-latest
@@ -46,6 +49,10 @@ jobs:
   publish:
     needs:
       - setup
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     if: ${{ needs.setup.outputs.tags != needs.setup.outputs.curr }}
     strategy:
       matrix:

.github/workflows/pg-prove.yml

@@ -3,6 +3,9 @@ name: Publish pg_prove
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   settings:
     runs-on: ubuntu-latest

.github/workflows/publish-migra.yml

@@ -3,6 +3,9 @@ name: Publish migra
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   settings:
     runs-on: ubuntu-latest
@@ -70,9 +73,9 @@ jobs:
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Merge multi-arch manifests
         run: |
-          docker buildx imagetools create -t ${{ needs.settings.outputs.image_tag }} \
-          ${{ needs.settings.outputs.image_tag }}_amd64 \
-          ${{ needs.settings.outputs.image_tag }}_arm64
+          docker buildx imagetools create -t "${{ needs.settings.outputs.image_tag }}" \
+          "${{ needs.settings.outputs.image_tag }}_amd64" \
+          "${{ needs.settings.outputs.image_tag }}_arm64"
 
   publish:
     needs:

.github/workflows/release-beta.yml

@@ -6,6 +6,9 @@ on:
       - develop
   workflow_dispatch:
 
+permissions:
+  contents: write
+
 jobs:
   release:
     name: semantic-release

.github/workflows/release.yml

@@ -6,6 +6,10 @@ on:
       - main
   workflow_call:
 
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   settings:
     runs-on: ubuntu-latest

.github/workflows/tag-npm.yml

@@ -13,6 +13,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   tag:
     name: Move latest tag