fix(ci/security): implement read-only docker files and secure action SHAs

Author: Lidianacosta

.github/workflows/ci.yml

@@ -25,13 +25,15 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e1148c96885b84ce963966bbcc8dd0ffba2907
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+        with:
+          enable-cache: true
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af6904029667666629302957144f8f4090488
         with:
           python-version: "3.12"
 

Dockerfile

@@ -12,17 +12,16 @@ FROM python:3.12-slim-bookworm
 
 WORKDIR /app
 
-RUN useradd -m -u 1000 appuser && \
-    chown appuser:appuser /app
+RUN useradd -m -u 1000 appuser
 
-COPY --from=builder --chown=appuser:appuser --chmod=555 /app/.venv /app/.venv
+COPY --from=builder --chmod=555 /app/.venv /app/.venv
 
 ENV PATH="/app/.venv/bin:$PATH"
 
-COPY --chown=appuser:appuser --chmod=555 src/ ./src/
-COPY --chown=appuser:appuser --chmod=555 migrations/ ./migrations/
-COPY --chown=appuser:appuser --chmod=555 alembic.ini pyproject.toml uv.lock ./
-COPY --chown=appuser:appuser --chmod=555 scripts/ ./scripts/
+COPY --chmod=555 src/ ./src/
+COPY --chmod=555 migrations/ ./migrations/
+COPY --chmod=555 alembic.ini pyproject.toml uv.lock ./
+COPY --chmod=555 scripts/ ./scripts/
 
 USER appuser