Fix actions vulnerabilites (#3)

* Fix checkout of untrusted code in a privileged context

* Fix ci permissions

* Remove search for upstream pr and create an output message step

Author: mirkokurt

.github/workflows/calculate-size-delta.yml

@@ -7,7 +7,6 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   build:
@@ -38,6 +37,10 @@ jobs:
           if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
             echo "Searching for PR from branch '${{ github.ref_name }}'..."
             PR_NUMBER=$(gh pr list --state open --head "${{ github.ref_name }}" --json number --jq '.[0].number // empty')
+            if [ -z "$PR_NUMBER" ]; then
+              echo "Not found in current repo, searching across forks..."
+              PR_NUMBER=$(gh pr list --state open --json number,headRefName,headRepositoryOwner --jq ".[] | select(.headRefName == \"${{ github.ref_name }}\") | .number" | head -n1)
+            fi
           else
             # For issue_comment, the PR number is in the event context
             PR_NUMBER=${{ github.event.issue.number }}
@@ -109,27 +112,57 @@ jobs:
           docker image pull --platform linux/arm64 localhost:5000/app-bricks/python-base:latest
           docker image pull --platform linux/arm64 localhost:5000/app-bricks/python-apps-base:latest
 
+      - name: Calculate image sizes
+        id: sizes
+        run: |
+          SIZE1=$(docker images 'localhost:5000/app-bricks/python-base:latest' --format '{{.Size}}')
+          SIZE2=$(docker images 'localhost:5000/app-bricks/python-apps-base:latest' --format '{{.Size}}')
+          echo "python_base_size=$SIZE1" >> $GITHUB_OUTPUT
+          echo "python_apps_base_size=$SIZE2" >> $GITHUB_OUTPUT
+
       - name: Add image sizes to Job Summary
         run: |
           echo "## Docker Image Sizes" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "| Image | Size |" >> $GITHUB_STEP_SUMMARY
           echo "|-------|------|" >> $GITHUB_STEP_SUMMARY
-          echo "| app-bricks/python-base | $(docker images 'localhost:5000/app-bricks/python-base:latest' --format '{{.Size}}') |" >> $GITHUB_STEP_SUMMARY
-          echo "| app-bricks/python-apps-base | $(docker images 'localhost:5000/app-bricks/python-apps-base:latest' --format '{{.Size}}') |" >> $GITHUB_STEP_SUMMARY
-
+          echo "| app-bricks/python-base | ${{ steps.sizes.outputs.python_base_size }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| app-bricks/python-apps-base | ${{ steps.sizes.outputs.python_apps_base_size }} |" >> $GITHUB_STEP_SUMMARY
+    outputs:
+      python_base_size: ${{ steps.sizes.outputs.python_base_size }}
+      python_apps_base_size: ${{ steps.sizes.outputs.python_apps_base_size }}
+      pr_number: ${{ steps.pr_info.outputs.pr_number }}
+  comment-results:
+    runs-on: ubuntu-latest
+    needs: build
+    if: needs.build.outputs.pr_number != ''
+    permissions:
+      pull-requests: write
+    steps:
       - name: Comment on PR with image sizes
-        if: steps.pr_info.outputs.pr_number != ''
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          SIZE1=$(docker images 'localhost:5000/app-bricks/python-base:latest' --format '{{.Size}}')
-          SIZE2=$(docker images 'localhost:5000/app-bricks/python-apps-base:latest' --format '{{.Size}}')
-          gh pr comment ${{ steps.pr_info.outputs.pr_number }} --body-file - <<EOF
+          gh pr comment ${{ needs.build.outputs.pr_number }} --repo ${{ github.repository }} --body-file - <<EOF
           ## Docker Image Sizes
 
           | Image | Size |
           |-------|------|
-          | app-bricks/python-base | $SIZE1 |
-          | app-bricks/python-apps-base | $SIZE2 |
+          | app-bricks/python-base | ${{ needs.build.outputs.python_base_size }} |
+          | app-bricks/python-apps-base | ${{ needs.build.outputs.python_apps_base_size }} |
           EOF
+  notify-no-pr:
+    runs-on: ubuntu-latest
+    needs: build
+    if: needs.build.outputs.pr_number == ''
+    permissions: {}
+    
+    steps:
+      - name: Notify to check Job Summary
+        run: |
+          echo "ℹ️ No PR found for this workflow run."
+          echo "📊 Image sizes are available in the Job Summary of the 'build' job."
+          echo ""
+          echo "To view:"
+          echo "1. Go to the 'build' job above"
+          echo "2. Scroll to the bottom to see the Job Summary"

.github/workflows/ci_checks.yml

@@ -3,6 +3,9 @@ name: Run Tests and Check Documentation
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   ci-checks:
     runs-on: ubuntu-latest