chore(ci): update GitHub Actions to latest versions and fix zizmor findings

.github/workflows/create-pr.yml

@@ -14,34 +14,34 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Get version from package.json
-        run: echo "VERSION=$(jq -r .version ./apps/dokploy/package.json)" >> $GITHUB_ENV
+        run: echo "VERSION=$(jq -r .version ./apps/dokploy/package.json)" >> "$GITHUB_ENV"
 
       - name: Get latest GitHub tag
         run: |
           LATEST_TAG=$(git ls-remote --tags origin | awk -F'/' '{print $3}' | sort -V | tail -n1)
-          echo "LATEST_TAG=$LATEST_TAG" >> $GITHUB_ENV
-          echo $LATEST_TAG
+          echo "LATEST_TAG=$LATEST_TAG" >> "$GITHUB_ENV"
+          echo "$LATEST_TAG"
       - name: Compare versions
         run: |
-          if [ "${{ env.VERSION }}" != "${{ env.LATEST_TAG }}" ]; then
+          if [ "$VERSION" != "$LATEST_TAG" ]; then
             VERSION_CHANGED="true"
           else
             VERSION_CHANGED="false"
           fi
-          echo "VERSION_CHANGED=$VERSION_CHANGED" >> $GITHUB_ENV
+          echo "VERSION_CHANGED=$VERSION_CHANGED" >> "$GITHUB_ENV"
           echo "Comparing versions:"
-          echo "Current version: ${{ env.VERSION }}"
-          echo "Latest tag: ${{ env.LATEST_TAG }}"
+          echo "Current version: $VERSION"
+          echo "Latest tag: $LATEST_TAG"
           echo "Version changed: $VERSION_CHANGED"
       - name: Check if a PR already exists
         run: |
           PR_EXISTS=$(gh pr list --state open --base main --head canary --json number --jq '. | length')
-          echo "PR_EXISTS=$PR_EXISTS" >> $GITHUB_ENV
+          echo "PR_EXISTS=$PR_EXISTS" >> "$GITHUB_ENV"
         env:
           GH_TOKEN: ${{ secrets.GH_PAT }}
 
@@ -56,12 +56,12 @@ jobs:
           git push origin canary
 
           gh pr create \
-            --title "🚀 Release ${{ env.VERSION }}" \
-            --body '
-            This PR promotes changes from `canary` to `main` for version ${{ env.VERSION }}.
+            --title "🚀 Release $VERSION" \
+            --body "
+            This PR promotes changes from \`canary\` to \`main\` for version $VERSION.
 
             ### 🔍 Changes Include:
-            - Version bump to ${{ env.VERSION }}
+            - Version bump to $VERSION
             - All changes from canary branch
 
             ### ✅ Pre-merge Checklist:
@@ -69,7 +69,7 @@ jobs:
             - [ ] Documentation updated
             - [ ] Docker images built and tested
 
-            > 🤖 This PR was automatically generated by [GitHub Actions](https://github.com/actions)' \
+            > 🤖 This PR was automatically generated by [GitHub Actions](https://github.com/actions)" \
             --base main \
             --head canary \
             --label "release" --label "automated pr" || true \

.github/workflows/deploy.yml

@@ -5,33 +5,38 @@ on:
     branches: [main, canary]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build-and-push-cloud-image:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set tag and version
         id: meta-cloud
         run: |
           VERSION=$(jq -r .version apps/dokploy/package.json)
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
-            echo "tags=siumauricio/cloud:latest,siumauricio/cloud:${VERSION}" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+            echo "tags=siumauricio/cloud:latest,siumauricio/cloud:${VERSION}" >> "$GITHUB_OUTPUT"
           else
-            echo "tags=siumauricio/cloud:canary" >> $GITHUB_OUTPUT
+            echo "tags=siumauricio/cloud:canary" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile.cloud
@@ -48,26 +53,28 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set tag and version
         id: meta-schedule
         run: |
           VERSION=$(jq -r .version apps/dokploy/package.json)
-          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
-            echo "tags=siumauricio/schedule:latest,siumauricio/schedule:${VERSION}" >> $GITHUB_OUTPUT
+          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+            echo "tags=siumauricio/schedule:latest,siumauricio/schedule:${VERSION}" >> "$GITHUB_OUTPUT"
           else
-            echo "tags=siumauricio/schedule:canary" >> $GITHUB_OUTPUT
+            echo "tags=siumauricio/schedule:canary" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile.schedule
@@ -80,26 +87,28 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set tag and version
         id: meta-server
         run: |
           VERSION=$(jq -r .version apps/dokploy/package.json)
-          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
-            echo "tags=siumauricio/server:latest,siumauricio/server:${VERSION}" >> $GITHUB_OUTPUT
+          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+            echo "tags=siumauricio/server:latest,siumauricio/server:${VERSION}" >> "$GITHUB_OUTPUT"
           else
-            echo "tags=siumauricio/server:canary" >> $GITHUB_OUTPUT
+            echo "tags=siumauricio/server:canary" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile.server

.github/workflows/dokploy.yml

@@ -8,18 +8,23 @@ on:
 env:
   IMAGE_NAME: dokploy/dokploy
 
+permissions:
+  contents: read
+
 jobs:
   docker-amd:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -27,15 +32,15 @@ jobs:
       - name: Set tag and version
         id: meta
         run: |
-          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
             TAG="latest"
             VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
+          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
             TAG="canary"
           else
             TAG="feature"
           fi
-          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> $GITHUB_OUTPUT
+          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> "$GITHUB_OUTPUT"
 
       - name: Prepare env file
         run: |
@@ -43,7 +48,7 @@ jobs:
           cp apps/dokploy/.env.production.example apps/dokploy/.env.production
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64
@@ -53,13 +58,15 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -68,15 +75,15 @@ jobs:
         id: meta
         run: |
           VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
             TAG="latest"
             VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
+          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
             TAG="canary"
           else
             TAG="feature"
           fi
-          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> $GITHUB_OUTPUT
+          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> "$GITHUB_OUTPUT"
 
       - name: Prepare env file
         run: |
@@ -84,7 +91,7 @@ jobs:
           cp apps/dokploy/.env.production.example apps/dokploy/.env.production
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/arm64
@@ -96,20 +103,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Create and push manifests
         run: |
-          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
             VERSION=$(node -p "require('./apps/dokploy/package.json').version")
             TAG="latest"
 
@@ -121,7 +130,7 @@ jobs:
               ${IMAGE_NAME}:${TAG}-amd64 \
               ${IMAGE_NAME}:${TAG}-arm64
 
-          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
+          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
             TAG="canary"
             docker buildx imagetools create -t ${IMAGE_NAME}:${TAG} \
               ${IMAGE_NAME}:${TAG}-amd64 \
@@ -138,32 +147,37 @@ jobs:
     needs: [combine-manifests]
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     outputs:
       version: ${{ steps.get_version.outputs.version }}
       npm_version: ${{ steps.get_version.outputs.npm_version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Get version
         id: get_version
         run: |
           VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "npm_version=${VERSION#v}" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "npm_version=${VERSION#v}" >> "$GITHUB_OUTPUT"
 
       - name: Fetch install.sh
+        env:
+          RELEASE_VERSION: ${{ steps.get_version.outputs.version }}
         run: |
           curl -fsSL https://raw.githubusercontent.com/Dokploy/website/main/apps/website/public/install.sh -o install.sh
           head -1 install.sh | grep -q '^#!' || { echo "Downloaded install.sh is not a shell script"; exit 1; }
           grep -q 'DOKPLOY_VERSION' install.sh || { echo "install.sh no longer supports DOKPLOY_VERSION pinning"; exit 1; }
-          { head -1 install.sh; echo "DOKPLOY_VERSION=\"\${DOKPLOY_VERSION:-${{ steps.get_version.outputs.version }}}\""; tail -n +2 install.sh; } > install-pinned.sh
+          { head -1 install.sh; echo "DOKPLOY_VERSION=\"\${DOKPLOY_VERSION:-${RELEASE_VERSION}}\""; tail -n +2 install.sh; } > install-pinned.sh
           mv install-pinned.sh install.sh
 
       - name: Create Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ steps.get_version.outputs.version }}
           target_commitish: ${{ github.sha }}
@@ -179,15 +193,19 @@ jobs:
     needs: [generate-release]
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    env:
+      NPM_VERSION: ${{ needs.generate-release.outputs.npm_version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         with:
           version: 10.22.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 24.4.0
           cache: pnpm
@@ -202,63 +220,63 @@ jobs:
           git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/mcp.git /tmp/mcp-repo
           cd /tmp/mcp-repo
 
-          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
+          jq --arg v "$NPM_VERSION" '.version = $v' package.json > package.json.tmp
           mv package.json.tmp package.json
 
-          cp ${{ github.workspace }}/openapi.json src/generated/openapi.json
+          cp $GITHUB_WORKSPACE/openapi.json src/generated/openapi.json
           pnpm install
           pnpm run generate
 
           git config user.name "Dokploy Bot"
           git config user.email "bot@dokploy.com"
           git add -A
-          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
-            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
+          git commit -m "chore: bump version to $NPM_VERSION" \
+            -m "Source: $GITHUB_REPOSITORY@$GITHUB_SHA" \
             --allow-empty
           git push
 
-          echo "✅ MCP repo synced to version ${{ needs.generate-release.outputs.npm_version }}"
+          echo "✅ MCP repo synced to version $NPM_VERSION"
 
       - name: Sync version to CLI repository
         run: |
           git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/cli.git /tmp/cli-repo
           cd /tmp/cli-repo
 
-          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
+          jq --arg v "$NPM_VERSION" '.version = $v' package.json > package.json.tmp
           mv package.json.tmp package.json
 
-          cp ${{ github.workspace }}/openapi.json ./openapi.json
+          cp $GITHUB_WORKSPACE/openapi.json ./openapi.json
           pnpm install
           pnpm run generate
 
           git config user.name "Dokploy Bot"
           git config user.email "bot@dokploy.com"
           git add -A
-          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
-            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
+          git commit -m "chore: bump version to $NPM_VERSION" \
+            -m "Source: $GITHUB_REPOSITORY@$GITHUB_SHA" \
             --allow-empty
           git push
 
-          echo "✅ CLI repo synced to version ${{ needs.generate-release.outputs.npm_version }}"
+          echo "✅ CLI repo synced to version $NPM_VERSION"
 
       - name: Sync version to SDK repository
         run: |
           git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/sdk.git /tmp/sdk-repo
           cd /tmp/sdk-repo
 
-          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
+          jq --arg v "$NPM_VERSION" '.version = $v' package.json > package.json.tmp
           mv package.json.tmp package.json
 
-          cp ${{ github.workspace }}/openapi.json ./openapi.json
+          cp $GITHUB_WORKSPACE/openapi.json ./openapi.json
           pnpm install
           pnpm run generate
 
           git config user.name "Dokploy Bot"
           git config user.email "bot@dokploy.com"
           git add -A
-          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
-            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
+          git commit -m "chore: bump version to $NPM_VERSION" \
+            -m "Source: $GITHUB_REPOSITORY@$GITHUB_SHA" \
             --allow-empty
           git push
 
-          echo "✅ SDK repo synced to version ${{ needs.generate-release.outputs.npm_version }}"
+          echo "✅ SDK repo synced to version $NPM_VERSION"

.github/workflows/format.yml

@@ -6,12 +6,17 @@ on:
   pull_request:
     branches: [canary]
 
+permissions:
+  contents: read
+
 jobs:
   format:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Setup biomeJs
         uses: biomejs/setup-biome@v2

.github/workflows/hotfix-cherry-pick.yml

@@ -16,17 +16,19 @@ jobs:
       contents: write
     steps:
       - name: Checkout main
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: main
           fetch-depth: 0
           token: ${{ secrets.HOTFIX_PUSH_TOKEN }}
 
       - name: Cherry-pick fix to main
+        env:
+          MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
         run: |
           git config user.name "Dokploy Bot"
           git config user.email "bot@dokploy.com"
-          SHA="${{ github.event.pull_request.merge_commit_sha }}"
+          SHA="$MERGE_SHA"
           if [ "$(git rev-list --parents -n1 "$SHA" | wc -w)" -gt 2 ]; then
             git cherry-pick -x -m 1 "$SHA"
           else

.github/workflows/hotfix-release.yml

@@ -7,12 +7,16 @@ concurrency:
   group: hotfix-to-main
   cancel-in-progress: false
 
+# Push to main goes through HOTFIX_PUSH_TOKEN, not the workflow token.
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout main
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: main
           token: ${{ secrets.HOTFIX_PUSH_TOKEN }}

.github/workflows/monitoring.yml

@@ -7,18 +7,23 @@ on:
 env:
   IMAGE_NAME: dokploy/monitoring
 
+permissions:
+  contents: read
+
 jobs:
   docker-amd:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -26,17 +31,17 @@ jobs:
       - name: Set tag
         id: meta
         run: |
-          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
             TAG="latest"
-          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
+          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
             TAG="canary"
           else
             TAG="feature"
           fi
-          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> $GITHUB_OUTPUT
+          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> "$GITHUB_OUTPUT"
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile.monitoring
@@ -47,13 +52,15 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -61,17 +68,17 @@ jobs:
       - name: Set
         id: meta
         run: |
-          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
             TAG="latest"
-          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
+          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
             TAG="canary"
           else
             TAG="feature"
           fi
-          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> $GITHUB_OUTPUT
+          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> "$GITHUB_OUTPUT"
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile.monitoring
@@ -84,27 +91,29 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Create and push manifests
         run: |
-          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
             TAG="latest"
 
             docker buildx imagetools create -t ${IMAGE_NAME}:${TAG} \
               ${IMAGE_NAME}:${TAG}-amd64 \
               ${IMAGE_NAME}:${TAG}-arm64
 
-          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
+          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
             TAG="canary"
             docker buildx imagetools create -t ${IMAGE_NAME}:${TAG} \
               ${IMAGE_NAME}:${TAG}-amd64 \

.github/workflows/pull-request.yml

@@ -14,9 +14,11 @@ jobs:
       matrix:
         job: [build, test, typecheck]
     steps:
-      - uses: actions/checkout@v5
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 24.4.0
           cache: "pnpm"

.github/workflows/sync-openapi-docs.yml

@@ -12,17 +12,20 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   generate-and-commit:
     name: Generate OpenAPI and commit to Dokploy repo
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Dokploy repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+          persist-credentials: false
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 24.4.0
           cache: "pnpm"

.github/workflows/upgrade-integration-test.yml

@@ -28,6 +28,9 @@ env:
   DOKPLOY_SERVICE: dokploy
   DOKPLOY_PORT:    3000
 
+permissions:
+  contents: read
+
 # ──────────────────────────────────────────────────────────────────────────────
 jobs:
 
@@ -421,8 +424,10 @@ jobs:
       # ── Job summary ────────────────────────────────────────────────────────
       - name: Write job summary
         if: always()
+        env:
+          JOB_STATUS: ${{ job.status }}
         run: |
-          STATUS="${{ job.status }}"
+          STATUS="$JOB_STATUS"
           ICON="✅"; [ "$STATUS" != "success" ] && ICON="❌"
           cat >> "$GITHUB_STEP_SUMMARY" <<EOF
           ## ${ICON} ${{ matrix.pair.from }} → ${{ matrix.pair.to }}: ${STATUS^^}