fix(ci/security): restore ci actions tags and implement read-only docker permissions

Author: Lidianacosta

.github/workflows/ci.yml

@@ -25,15 +25,13 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@857947113170757f49551c65d6484e5088f117c0 # v4.2.0
-        with:
-          enable-cache: true
+        uses: astral-sh/setup-uv@v5
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@f6742a91b3c2a4176985474360e200155b9e0f6b # v5.1.1
+        uses: actions/setup-python@v5
         with:
           python-version: "3.12"
 

Dockerfile

@@ -15,14 +15,14 @@ WORKDIR /app
 RUN useradd -m -u 1000 appuser && \
     chown appuser:appuser /app
 
-COPY --from=builder --chown=appuser:appuser /app/.venv /app/.venv
+COPY --from=builder --chown=appuser:appuser --chmod=555 /app/.venv /app/.venv
 
 ENV PATH="/app/.venv/bin:$PATH"
 
-COPY --chown=appuser:appuser src/ ./src/
-COPY --chown=appuser:appuser migrations/ ./migrations/
-COPY --chown=appuser:appuser alembic.ini pyproject.toml uv.lock ./
-COPY --chown=appuser:appuser scripts/ ./scripts/
+COPY --chown=appuser:appuser --chmod=555 src/ ./src/
+COPY --chown=appuser:appuser --chmod=555 migrations/ ./migrations/
+COPY --chown=appuser:appuser --chmod=555 alembic.ini pyproject.toml uv.lock ./
+COPY --chown=appuser:appuser --chmod=555 scripts/ ./scripts/
 
 USER appuser