Add explicit workflow permissions and pin Alpine package versions in Dockerfiles

.github/workflows/codeql.yml

@@ -19,6 +19,9 @@ on:
   schedule:
     - cron: '25 21 * * 3'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})

.github/workflows/defender-for-devops.yml

@@ -26,10 +26,17 @@ on:
   schedule:
     - cron: '43 0 * * 0'
 
+permissions:
+  contents: read
+
 jobs:
   MSDO:
     # currently only windows latest is supported
     runs-on: windows-latest
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
 
     steps:
     - uses: actions/checkout@v4

.github/workflows/docker-image.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ "main" ]
 
+permissions:
+  contents: read
+
 jobs:
 
   build:

.github/workflows/npm-publish-github-packages.yml

@@ -7,6 +7,9 @@ on:
   release:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

Dockerfile

@@ -2,7 +2,9 @@ FROM node:20-alpine AS builder
 WORKDIR /app
 
 # Install system dependencies for Prisma (OpenSSL + libc compatibility)
-RUN apk add --no-cache openssl libc6-compat
+RUN apk add --no-cache \
+    openssl=3.* \
+    libc6-compat=1.*
 
 # Environment & NPM tuning
 ENV NPM_CONFIG_LOGLEVEL=warn \
@@ -57,7 +59,11 @@ WORKDIR /app
 ENV NODE_ENV=production \
     NEXT_TELEMETRY_DISABLED=1
 
-RUN apk add --no-cache openssl libc6-compat wget su-exec
+RUN apk add --no-cache \
+    openssl=3.* \
+    libc6-compat=1.* \
+    wget=1.* \
+    su-exec=0.2-r*
 
 # Non-root user for security
 RUN addgroup --system --gid 1001 nodejs && \

Dockerfile.prod

@@ -1,6 +1,8 @@
 FROM node:20-alpine AS builder
 WORKDIR /app
-RUN apk add --no-cache openssl libc6-compat
+RUN apk add --no-cache \
+    openssl=3.* \
+    libc6-compat=1.*
 ENV NPM_CONFIG_LOGLEVEL=warn \
     NPM_CONFIG_REGISTRY=https://registry.npmjs.org \
     NEXT_TELEMETRY_DISABLED=1
@@ -17,7 +19,10 @@ RUN npm prune --production
 FROM node:20-alpine AS runner
 WORKDIR /app
 ENV NODE_ENV=production APP_ENV=production NEXT_TELEMETRY_DISABLED=1
-RUN apk add --no-cache openssl libc6-compat wget
+RUN apk add --no-cache \
+    openssl=3.* \
+    libc6-compat=1.* \
+    wget=1.*
 COPY --from=builder /app/public ./public
 COPY --from=builder /app/.next/standalone ./
 COPY --from=builder /app/.next/static ./.next/static