fix: pin build artifacts, base images and workflow actions

.docker/mariadb/Dockerfile

@@ -1,4 +1,4 @@
-FROM mariadb
+FROM mariadb:13.0.2@sha256:54f493ea0d60b621a5bff84e5b20100f8b86b6efa6b79158e04756c5194a5e4d
 
 RUN apt-get update && \
     apt-get install -y \

.docker/wordpress/Dockerfile

@@ -1,7 +1,7 @@
 ARG VERSION_WORDPRESS
 ARG VERSION_PHP
 ARG WORDPRESS_BASE_IMAGE=wordpress:${VERSION_WORDPRESS}-php${VERSION_PHP}-fpm
 FROM ${WORDPRESS_BASE_IMAGE}
 
 RUN apt-get update
 RUN apt-get install -y \
@@ -12,18 +12,18 @@
     yq
 
 # Install PHP Extensions
-ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/
-RUN chmod uga+x /usr/local/bin/install-php-extensions && sync \
-    && install-php-extensions \
+COPY --from=mlocati/php-extension-installer:2.13.2@sha256:4fd45396c16685266d32bf147a24ecd5e81029d3820295895bf4a90131190ac9 /usr/bin/install-php-extensions /usr/local/bin/
+RUN install-php-extensions \
     xdebug \
     intl
 
 # Install wp-cli
-RUN curl https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar --output /usr/bin/wp
+RUN curl -fsSL https://github.com/wp-cli/wp-cli/releases/download/v2.12.0/wp-cli-2.12.0.phar --output /usr/bin/wp \
+    && echo "be928f6b8ca1e8dfb9d2f4b75a13aa4aee0896f8a9a0a1c45cd5d2c98605e6172e6d014dda2e27f88c98befc16c040cbb2bd1bfa121510ea5cdf5f6a30fe8832  /usr/bin/wp" | sha512sum -c -
 RUN chmod +x /usr/bin/wp
 RUN wp --info
 
-COPY --from=composer /usr/bin/composer /usr/bin/composer
+COPY --from=composer:2.11.2@sha256:5bcb28b8d0edc4091125f8218f9d088f998bdfc843f8fbb9a4beb4dcd8625684 /usr/bin/composer /usr/bin/composer
 
 COPY config/php.ini /usr/local/etc/php/conf.d/
 

.github/workflows/bats-tests.yml

@@ -11,9 +11,9 @@ jobs:
     name: Bats infrastructure tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Setup Bats-core
-        uses: bats-core/[email protected]
+        uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
         with:
           support-install: false
           assert-install: false
@@ -22,6 +22,6 @@ jobs:
       - name: Run Bats tests
         run: bats tests/security
       - name: ShellCheck Bats helpers
-        uses: ludeeus/action-shellcheck@master
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
         with:
           scandir: tests/security/helpers

.github/workflows/docker-publish.yml

@@ -29,17 +29,17 @@ jobs:
       packages: write
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Cache Docker layers
         id: docker-cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: /tmp/.buildx-cache
           key: wordpress-buildx-${{ github.sha }}
@@ -48,14 +48,14 @@ jobs:
 
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build container image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .docker/wordpress
           file: .docker/wordpress/Dockerfile
@@ -71,7 +71,7 @@ jobs:
 
       - name: Push container image
         if: github.ref == 'refs/heads/main'
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .docker/wordpress
           file: .docker/wordpress/Dockerfile
@@ -93,7 +93,7 @@ jobs:
 
       - name: Save Docker cache
         if: steps.docker-cache.outputs.cache-hit != 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: /tmp/.buildx-cache
           key: wordpress-buildx-${{ github.sha }}

.github/workflows/shellcheck.yml

@@ -11,8 +11,8 @@ jobs:
     name: Shellcheck
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
     - name: Run ShellCheck
-      uses: ludeeus/action-shellcheck@master
+      uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
       with:
         scandir: .docker/

common-services.yml

@@ -27,7 +27,7 @@ services:
       - "host.docker.internal:host-gateway"
 
   nginx:
-    image: nginx
+    image: nginx:1.31.8@sha256:165ddde8751e75a1c907d24ef10d9f6deb08b57e0fe56caf67512486aff76d82
     restart: unless-stopped
     volumes:
       - ./volumes/wordpress:/var/www/html:ro

renovate.json

@@ -1,10 +1,18 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "enabledManagers": [
-    "custom.regex"
+    "custom.regex",
+    "dockerfile",
+    "docker-compose",
+    "github-actions"
   ],
   "dependencyDashboard": false,
   "separateMinorPatch": true,
+  "docker-compose": {
+    "managerFilePatterns": [
+      "/(^|/)common-services\\.yml$/"
+    ]
+  },
   "customManagers": [
     {
       "customType": "regex",
@@ -32,6 +40,15 @@
         "minor"
       ],
       "enabled": false
+    },
+    {
+      "matchManagers": [
+        "docker-compose"
+      ],
+      "matchPackageNames": [
+        "ghcr.io/librecodecoop/wordpress-docker"
+      ],
+      "enabled": false
     }
   ]
 }

tests/security/build-pins.bats

@@ -0,0 +1,34 @@
+#!/usr/bin/env bats
+
+setup() {
+	cd "$BATS_TEST_DIRNAME/../.."
+}
+
+@test "the WordPress image does not download floating artifacts" {
+	run grep -nE 'releases/latest|gh-pages|^ADD ' .docker/wordpress/Dockerfile
+	[ "${status}" -eq 1 ]
+}
+
+@test "images copied into the WordPress image are pinned by digest" {
+	run grep -nE '^COPY --from=' .docker/wordpress/Dockerfile
+	[ "${status}" -eq 0 ]
+	run grep -nvE '^COPY --from=[^ ]+:[^ @]+@sha256:[a-f0-9]{64} ' <(grep -E '^COPY --from=' .docker/wordpress/Dockerfile)
+	[ "${status}" -eq 1 ]
+}
+
+@test "WP-CLI is downloaded from a release and verified" {
+	grep -qE 'curl -fsSL https://github.com/wp-cli/wp-cli/releases/download/v[0-9.]+/wp-cli-[0-9.]+\.phar' .docker/wordpress/Dockerfile
+	grep -qE 'sha512sum -c' .docker/wordpress/Dockerfile
+}
+
+@test "nginx and MariaDB images are pinned" {
+	grep -qE '^    image: nginx:[0-9.]+@sha256:[a-f0-9]{64}$' common-services.yml
+	grep -qE '^FROM mariadb:[0-9.]+@sha256:[a-f0-9]{64}$' .docker/mariadb/Dockerfile
+}
+
+@test "workflow actions are pinned by commit" {
+	run grep -hnE '^\s*-?\s*uses: ' .github/workflows/*.yml
+	[ "${status}" -eq 0 ]
+	run grep -hE '^\s*-?\s*uses: ' .github/workflows/*.yml
+	! printf '%s\n' "${output}" | grep -vE 'uses: [^@]+@[a-f0-9]{40} # v?[0-9]+\.[0-9]+\.[0-9]+$'
+}