ci(workflows): improve security of all workflows & update action (#7133)

.github/workflows/chore-lock-closed-issues-discussions-and-prs.yml

@@ -4,6 +4,11 @@ on:
   schedule:
     - cron: '0 1 * * *'
 
+permissions:
+  issues: write
+  discussions: write
+  pull-requests: write
+
 jobs:
   lock-threads:
     runs-on: ubuntu-latest
@@ -13,5 +18,5 @@ jobs:
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           issue-inactive-days: '30'
-          pr-inactive-days: '30'
           discussion-inactive-days: '30'
+          pr-inactive-days: '30'

.github/workflows/chore-manage-stale-issues-and-prs.yml

@@ -4,6 +4,10 @@ on:
   schedule:
     - cron: '0 2 * * *'
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   manage-stale:
     runs-on: ubuntu-latest

.github/workflows/chore-pr-comments.yml

@@ -3,20 +3,13 @@ on:
   pull_request_target:
     types:
       - labeled
+
+permissions:
+  pull-requests: write
+
 jobs:
   add-comment:
     runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-      contents: read
-      actions: none
-      checks: none
-      deployments: none
-      issues: none
-      packages: none
-      repository-projects: none
-      security-events: none
-      statuses: none
     strategy:
       matrix:
         include:

.github/workflows/chore-remove-labels-and-assignees-on-close.yml

@@ -8,6 +8,10 @@ on:
   pull_request_target:
     types: [closed]
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   remove-labels-and-assignees:
     runs-on: ubuntu-latest

.github/workflows/claude-code-review.yml

@@ -1,79 +0,0 @@
-name: Claude Code Review
-
-on:
-  pull_request:
-    types: [opened, synchronize]
-    # Optional: Only run on specific file changes
-    # paths:
-    #   - "src/**/*.ts"
-    #   - "src/**/*.tsx"
-    #   - "src/**/*.js"
-    #   - "src/**/*.jsx"
-
-jobs:
-  claude-review:
-    if: false
-    # Optional: Filter by PR author
-    # if: |
-    #   github.event.pull_request.user.login == 'external-contributor' ||
-    #   github.event.pull_request.user.login == 'new-developer' ||
-    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
-    
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-    
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code Review
-        id: claude-review
-        uses: anthropics/claude-code-action@beta
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-
-          # Optional: Specify model (defaults to Claude Sonnet 4, uncomment for Claude Opus 4.1)
-          # model: "claude-opus-4-1-20250805"
-
-          # Direct prompt for automated review (no @claude mention needed)
-          direct_prompt: |
-            Please review this pull request and provide feedback on:
-            - Code quality and best practices
-            - Potential bugs or issues
-            - Performance considerations
-            - Security concerns
-            - Test coverage
-            
-            Be constructive and helpful in your feedback.
-
-          # Optional: Use sticky comments to make Claude reuse the same comment on subsequent pushes to the same PR
-          # use_sticky_comment: true
-          
-          # Optional: Customize review based on file types
-          # direct_prompt: |
-          #   Review this PR focusing on:
-          #   - For TypeScript files: Type safety and proper interface usage
-          #   - For API endpoints: Security, input validation, and error handling
-          #   - For React components: Performance, accessibility, and best practices
-          #   - For tests: Coverage, edge cases, and test quality
-          
-          # Optional: Different prompts for different authors
-          # direct_prompt: |
-          #   ${{ github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' && 
-          #   'Welcome! Please review this PR from a first-time contributor. Be encouraging and provide detailed explanations for any suggestions.' ||
-          #   'Please provide a thorough code review focusing on our coding standards and best practices.' }}
-          
-          # Optional: Add specific tools for running tests or linting
-          # allowed_tools: "Bash(npm run test),Bash(npm run lint),Bash(npm run typecheck)"
-          
-          # Optional: Skip review for certain conditions
-          # if: |
-          #   !contains(github.event.pull_request.title, '[skip-review]') &&
-          #   !contains(github.event.pull_request.title, '[WIP]')
-

.github/workflows/claude.yml

@@ -1,65 +0,0 @@
-name: Claude Code
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && github.event.action == 'labeled' && github.event.label.name == 'Claude') ||
-      (github.event_name == 'pull_request' && github.event.action == 'labeled' && github.event.label.name == 'Claude') ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-      actions: read # Required for Claude to read CI results on PRs
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-
-          # This is an optional setting that allows Claude to read CI results on PRs
-          additional_permissions: |
-            actions: read
-          
-          # Optional: Specify model (defaults to Claude Sonnet 4, uncomment for Claude Opus 4.1)
-          # model: "claude-opus-4-1-20250805"
-          
-          # Optional: Customize the trigger phrase (default: @claude)
-          # trigger_phrase: "/claude"
-          
-          # Optional: Trigger when specific user is assigned to an issue
-          # assignee_trigger: "claude-bot"
-          
-          # Optional: Allow Claude to run specific commands
-          # allowed_tools: "Bash(npm install),Bash(npm run build),Bash(npm run test:*),Bash(npm run lint:*)"
-          
-          # Optional: Add custom instructions for Claude to customize its behavior for your project
-          # custom_instructions: |
-          #   Follow our coding standards
-          #   Ensure all new code has tests
-          #   Use TypeScript for new files
-          
-          # Optional: Custom environment variables for Claude
-          # claude_env: |
-          #   NODE_ENV: test

.github/workflows/cleanup-ghcr-untagged.yml

@@ -1,17 +1,14 @@
 name: Cleanup Untagged GHCR Images
 
 on:
-  workflow_dispatch: # Manual trigger only
+  workflow_dispatch:
 
-env:
+permissions:
-  GITHUB_REGISTRY: ghcr.io
+  packages: write
 
 jobs:
   cleanup-all-packages:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     strategy:
       matrix:
         package: ['coolify', 'coolify-helper', 'coolify-realtime', 'coolify-testing-host']

.github/workflows/coolify-helper-next.yml

@@ -7,6 +7,10 @@ on:
       - .github/workflows/coolify-helper-next.yml
       - docker/coolify-helper/Dockerfile
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   GITHUB_REGISTRY: ghcr.io
   DOCKER_REGISTRY: docker.io
@@ -15,11 +19,10 @@ env:
 jobs:
   amd64:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
@@ -54,11 +57,10 @@ jobs:
             coolify.managed=true
   aarch64:
     runs-on: [ self-hosted, arm64 ]
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
@@ -94,12 +96,12 @@ jobs:
 
   merge-manifest:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     needs: [ amd64, aarch64 ]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
       - uses: docker/setup-buildx-action@v3
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}

.github/workflows/coolify-helper.yml

@@ -7,6 +7,10 @@ on:
       - .github/workflows/coolify-helper.yml
       - docker/coolify-helper/Dockerfile
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   GITHUB_REGISTRY: ghcr.io
   DOCKER_REGISTRY: docker.io
@@ -15,11 +19,10 @@ env:
 jobs:
   amd64:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
@@ -54,11 +57,10 @@ jobs:
             coolify.managed=true
   aarch64:
     runs-on: [ self-hosted, arm64 ]
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
@@ -93,12 +95,11 @@ jobs:
             coolify.managed=true
   merge-manifest:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     needs: [ amd64, aarch64 ]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - uses: docker/setup-buildx-action@v3
 

.github/workflows/coolify-production-build.yml

@@ -14,6 +14,10 @@ on:
       - templates/**
       - CHANGELOG.md
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   GITHUB_REGISTRY: ghcr.io
   DOCKER_REGISTRY: docker.io
@@ -23,7 +27,9 @@ jobs:
   amd64:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
@@ -58,7 +64,9 @@ jobs:
   aarch64:
     runs-on: [self-hosted, arm64]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
@@ -92,12 +100,11 @@ jobs:
 
   merge-manifest:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     needs: [amd64, aarch64]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - uses: docker/setup-buildx-action@v3
 

.github/workflows/coolify-realtime-next.yml

@@ -11,6 +11,10 @@ on:
       - docker/coolify-realtime/package-lock.json
       - docker/coolify-realtime/soketi-entrypoint.sh
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   GITHUB_REGISTRY: ghcr.io
   DOCKER_REGISTRY: docker.io
@@ -19,11 +23,10 @@ env:
 jobs:
   amd64:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
@@ -59,11 +62,11 @@ jobs:
 
   aarch64:
     runs-on: [ self-hosted, arm64 ]
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
@@ -99,12 +102,11 @@ jobs:
 
   merge-manifest:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     needs: [ amd64, aarch64 ]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - uses: docker/setup-buildx-action@v3
 

.github/workflows/coolify-realtime.yml

@@ -11,6 +11,10 @@ on:
       - docker/coolify-realtime/package-lock.json
       - docker/coolify-realtime/soketi-entrypoint.sh
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   GITHUB_REGISTRY: ghcr.io
   DOCKER_REGISTRY: docker.io
@@ -19,11 +23,10 @@ env:
 jobs:
   amd64:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
@@ -59,11 +62,10 @@ jobs:
 
   aarch64:
     runs-on: [ self-hosted, arm64 ]
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
@@ -99,12 +101,11 @@ jobs:
 
   merge-manifest:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     needs: [ amd64, aarch64 ]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - uses: docker/setup-buildx-action@v3
 

.github/workflows/coolify-staging-build.yml

@@ -17,6 +17,10 @@ on:
         - templates/**
         - CHANGELOG.md
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   GITHUB_REGISTRY: ghcr.io
   DOCKER_REGISTRY: docker.io
@@ -34,11 +38,10 @@ jobs:
             platform: linux/aarch64
             runner: ubuntu-24.04-arm
     runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
-      packages: write
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Sanitize branch name for Docker tag
         id: sanitize
@@ -82,11 +85,10 @@ jobs:
   merge-manifest:
     runs-on: ubuntu-24.04
     needs: build-push
-    permissions:
-      contents: read
-      packages: write
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Sanitize branch name for Docker tag
         id: sanitize

.github/workflows/coolify-testing-host.yml

@@ -7,6 +7,10 @@ on:
       - .github/workflows/coolify-testing-host.yml
       - docker/testing-host/Dockerfile
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   GITHUB_REGISTRY: ghcr.io
   DOCKER_REGISTRY: docker.io
@@ -15,11 +19,10 @@ env:
 jobs:
   amd64:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
@@ -50,11 +53,10 @@ jobs:
 
   aarch64:
     runs-on: [ self-hosted, arm64 ]
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
@@ -85,12 +87,11 @@ jobs:
 
   merge-manifest:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     needs: [ amd64, aarch64 ]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - uses: docker/setup-buildx-action@v3
 

.github/workflows/generate-changelog.yml

@@ -16,6 +16,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Generate changelog