fix(security): implement docker non-root user, explicit COPY and secure ci actions

Author: Lidianacosta

.github/workflows/ci.yml

@@ -25,15 +25,15 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@857947113170757f49551c65d6484e5088f117c0 # v4.2.0
         with:
           enable-cache: true
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@f6742a91b3c2a4176985474360e200155b9e0f6b # v5.1.1
         with:
           python-version: "3.12"
 

Dockerfile

@@ -12,11 +12,19 @@ FROM python:3.12-slim-bookworm
 
 WORKDIR /app
 
-COPY --from=builder /app/.venv /app/.venv
+RUN useradd -m -u 1000 appuser && \
+    chown appuser:appuser /app
+
+COPY --from=builder --chown=appuser:appuser /app/.venv /app/.venv
 
 ENV PATH="/app/.venv/bin:$PATH"
 
-COPY . .
+COPY --chown=appuser:appuser src/ ./src/
+COPY --chown=appuser:appuser migrations/ ./migrations/
+COPY --chown=appuser:appuser alembic.ini pyproject.toml uv.lock ./
+COPY --chown=appuser:appuser scripts/ ./scripts/
+
+USER appuser
 
 EXPOSE 8000
 

tests/conftest.py

@@ -48,7 +48,7 @@ async def override_get_session():
         "Content-Type": "application/json",
     }
     async with AsyncClient(
-        base_url="http://test",
+        base_url="https://test",
         transport=transport,
         headers=headers,
     ) as client: