fix(OVH): harden security

.github/workflows/deploy.yml

@@ -9,13 +9,37 @@ on:
   workflow_dispatch:
 
 jobs:
+  check-approval:
+    runs-on: ubuntu-latest
+    outputs:
+      approved: ${{ steps.check.outputs.approved }}
+    steps:
+      - id: check
+        env:
+          IS_PUSH_OR_DISPATCH: ${{ contains(fromJSON('["push", "workflow_dispatch"]'), github.event_name) }}
+          AUTHOR_TRUSTED: ${{ contains(fromJSON('["MEMBER","OWNER","COLLABORATOR","CONTRIBUTOR"]'), github.event.pull_request.author_association) }}
+          HAS_APPROVAL_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'preview-approved') }}
+        run: |
+          if [ "$IS_PUSH_OR_DISPATCH" = "true" ] || [ "$AUTHOR_TRUSTED" = "true" ] || [ "$HAS_APPROVAL_LABEL" = "true" ]; then
+            echo "approved=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "approved=false" >> "$GITHUB_OUTPUT"
+          fi
+
   deploy:
-    if: github.event_name == 'push' || (github.event.action != 'closed' && github.event.action != 'labeled')
+    needs: [check-approval]
+    if: |
+      github.event_name == 'push' || github.event_name == 'workflow_dispatch' || (
+        github.event.action != 'closed' &&
+        (github.event.action != 'labeled' || github.event.label.name == 'preview-approved')
+      )
     uses: ./.github/workflows/ovh.yaml
     with:
       environment_name: ${{ contains(fromJSON('["push", "workflow_dispatch"]'), github.event_name) && 'production' || format('pull/{0}', github.event.pull_request.number) }}
       url: ${{ contains(fromJSON('["push", "workflow_dispatch"]'), github.event_name) && format('https://{0}', vars.MAIN_WEBSITE) || format('https://{0}/pr/{1}', vars.PREVIEW_WEBSITE, github.event.pull_request.number) }}
       target: ${{ contains(fromJSON('["push", "workflow_dispatch"]'), github.event_name) && 'www' || format('pulls/pr/{0}', github.event.pull_request.number) }}
+      ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      approval_required: ${{ needs.check-approval.outputs.approved == 'false' }}
       action: deploy
     secrets: inherit
 

.github/workflows/ovh.yaml

@@ -17,6 +17,13 @@ on:
         required: false
         type: string
         default: 'deploy' # Or 'teardown'
+      ref:
+        required: false
+        type: string
+      approval_required:
+        required: false
+        type: boolean
+        default: false
     secrets:
       OVH_USERNAME:
         required: true
@@ -34,6 +41,11 @@ jobs:
       name: ${{ inputs.environment_name }}
       url: ${{ inputs.url }}
     steps:
+    - name: Require maintainer approval
+      if: ${{ inputs.action != 'teardown' && inputs.approval_required }}
+      run: |
+        echo "::error::Preview deploy requires a maintainer to add the 'preview-approved' label on this pull request."
+        exit 1
     - name: Forbid tearing down production
       if: ${{ inputs.target == 'www' && inputs.action == 'teardown' }}
       run: |
@@ -44,6 +56,7 @@ jobs:
       uses: actions/checkout@v4.2.2
       with:
         fetch-depth: 0
+        ref: ${{ inputs.ref }}
     - name: Set up Python
       if: ${{ inputs.action != 'teardown' }}
       uses: actions/setup-python@v6
@@ -70,8 +83,18 @@ jobs:
         mkdir -p ${HOME}/.ssh/
         ssh-keyscan "${OVH_HOSTNAME}" >> "${HOME}/.ssh/known_hosts"
         cat > .htaccess <<EOF
-        Options -Indexes
+        Options -ExecCGI -Indexes
         ErrorDocument 403 https://${MAIN_WEBSITE}
+
+        RemoveHandler .php .phtml .phar .cgi .pl .py
+        RemoveType .php .phtml .phar
+
+        <FilesMatch "\.(php|phtml|phar|cgi|pl|py)$">
+            Require all denied
+        </FilesMatch>
+        <IfModule mod_php.c>
+            php_flag engine off
+        </IfModule>
         EOF
         lftp --env-password -u ${OVH_USERNAME} sftp://${OVH_HOSTNAME} \
           -e "put .htaccess -o /home/${OVH_USERNAME}/pulls/.htaccess"