From 51b4ac6fd87e0373f7b5f04472dd14779341576b Mon Sep 17 00:00:00 2001
From: Todd Baert <todd.baert@dynatrace.com>
Date: Fri, 24 Jul 2026 12:07:36 -0400
Subject: [PATCH] chore: minor security hardening

Signed-off-by: Todd Baert <todd.baert@dynatrace.com>
---
 .github/workflows/ci.yml             |  2 +-
 .github/workflows/release-please.yml | 12 ++++++------
 flagd/Dockerfile                     |  5 +++++
 3 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1a569ac..bac8dec 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
 
       - name: Node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-      - run: npm ci
+      - run: npm ci --ignore-scripts
 
       - name: Lint Gherkin
         run: npm run gherkin-lint
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 681872a..1a13e1d 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     # Release-please creates a PR that tracks all changes
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
         id: release
         with:
           config-file: .release-please-config.json
@@ -39,25 +39,25 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ needs.release-please.outputs.release_created }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           ref: ${{ needs.release-please.outputs.release_tag_name }}
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Build and push flagd-testbed Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: flagd/Dockerfile
diff --git a/flagd/Dockerfile b/flagd/Dockerfile
index d22918e..ec677b1 100644
--- a/flagd/Dockerfile
+++ b/flagd/Dockerfile
@@ -42,6 +42,11 @@ COPY --from=certs custom-root-cert.crt /ssl/
 
 RUN mkdir "flags"
 
+# run as non-root
+RUN adduser -D -H -u 10001 testbed \
+    && chown -R testbed:testbed /flags /rawflags /configs /ssl
+USER testbed
+
 
 LABEL org.opencontainers.image.source="https://github.com/open-feature/flagd-testbed"