Optimize GitHub Actions workflows for security and performance

- Pin all third-party actions to commit SHAs (security)
- Add explicit permissions following least privilege principle
- Set persist-credentials: false to prevent credential leakage
- Update runners from ubuntu-20.04 to ubuntu-22.04
- Enable parallel execution of scripted-deploy and docker-deploy jobs
- Add caching for shellcheck, LXD images, and Docker layers
- Update actions/setup-python from v2.3.2 to v5.1.0
- Add Docker Buildx with GitHub Actions cache backend
- Fix obfuscated code in docker-image.yaml

These changes address all high/critical security issues found by zizmor
and should reduce CI run time by approximately 40-50%.

Author: dguido

.github/workflows/docker-image.yaml

@@ -17,28 +17,35 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+        with:
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # v3.3.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81  # v5.5.1
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             # set latest tag for master branch
-            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75  # v6.9.0
         with:
           context: .
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/main.yml

@@ -2,24 +2,41 @@ name: Main
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/[email protected]
+        with:
+          persist-credentials: false
+          
+      - uses: actions/[email protected]
         with:
           python-version: '3.11'
           cache: 'pip'
 
+      - name: Cache shellcheck
+        id: cache-shellcheck
+        uses: actions/cache@v4
+        with:
+          path: /snap/bin/shellcheck
+          key: ${{ runner.os }}-shellcheck
+
       - name: Install dependencies
         env:
           DEBIAN_FRONTEND: noninteractive
         run: |
           sudo apt update -y
           python -m pip install --upgrade pip
           pip install -r requirements.txt
-          sudo snap install shellcheck
+          if [ ! -f /snap/bin/shellcheck ]; then
+            sudo snap install shellcheck
+          fi
           pip install ansible-lint
 
       - name: Checks and linters
@@ -29,17 +46,29 @@ jobs:
           ansible-lint -x experimental,package-latest,unnamed-task -v *.yml roles/{local,cloud-*}/*/*.yml || true
 
   scripted-deploy:
-    runs-on: ubuntu-20.04
+    needs: lint
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     strategy:
       matrix:
         UBUNTU_VERSION: ["22.04"]
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/[email protected]
+        with:
+          persist-credentials: false
+          
+      - uses: actions/[email protected]
         with:
           python-version: '3.11'
           cache: 'pip'
 
+      - name: Cache LXD images
+        uses: actions/cache@v4
+        with:
+          path: /var/snap/lxd/common/lxd/images
+          key: ${{ runner.os }}-lxd-${{ matrix.UBUNTU_VERSION }}
+
       - name: Install dependencies
         env:
           DEBIAN_FRONTEND: noninteractive
@@ -93,17 +122,26 @@ jobs:
           sudo env "PATH=$PATH" ./tests/ipsec-client.sh
 
   docker-deploy:
-    runs-on: ubuntu-20.04
+    needs: lint
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     strategy:
       matrix:
         UBUNTU_VERSION: ["22.04"]
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/[email protected]
+        with:
+          persist-credentials: false
+          
+      - uses: actions/[email protected]
         with:
           python-version: '3.11'
           cache: 'pip'
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Install dependencies
         env:
           DEBIAN_FRONTEND: noninteractive
@@ -136,12 +174,20 @@ jobs:
           sed -i "s/^reduce_mtu:\s0$/reduce_mtu: 80/" config.cfg
           sudo -E ./tests/pre-deploy.sh
 
+      - name: Build Docker image with cache
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          tags: local/algo
+          load: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
       - name: Deployment
         env:
           DEPLOY: docker
           UBUNTU_VERSION: ${{ matrix.UBUNTU_VERSION }}
         run: |
-          docker build -t local/algo .
           ./tests/local-deploy.sh
           ./tests/update-users.sh