Harden CI workflows

.github/.kodiak.toml

@@ -15,4 +15,4 @@ strip_html_comments = true # default: false
 always = true # default: false
 
 [approve]
-auto_approve_usernames = ["1gtm", "tamalsaha"]
+auto_approve_usernames = ["tamalsaha", "1gtm", "1gtm-app[bot]"]

.github/workflows/ci.yml

@@ -21,32 +21,27 @@ jobs:
         restic:
           - "0.13.1"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Set up QEMU
         id: qemu
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
         with:
           cache-image: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+      - name: Log in to the GitHub Container registry
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ghcr.io
+          username: 1gtm
+          password: ${{ secrets.LGTM_GITHUB_TOKEN }}
 
       - name: Publish to GitHub Container Registry
         env:
           REGISTRY: ghcr.io/stashed
-          DOCKER_TOKEN: ${{ secrets.LGTM_GITHUB_TOKEN }}
-          USERNAME: 1gtm
         run: |
-          docker login ghcr.io --username ${USERNAME} --password ${DOCKER_TOKEN}
           make release RELEASE=${{ matrix.restic }}
 
-      - name: Publish to Docker Registry
-        env:
-          REGISTRY: stashed
-          SRC_REG: ghcr.io/stashed
-          DOCKER_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-          USERNAME: 1gtm
-        run: |
-          docker login --username ${USERNAME} --password ${DOCKER_TOKEN}
-          make release RELEASE=${{ matrix.restic }}

Makefile

@@ -7,7 +7,7 @@ RELEASE    ?= 0.13.1
 VERSION    ?= v$(RELEASE)
 SRC_REG    ?=
 
-DOCKER_PLATFORMS := linux/amd64 linux/386 linux/arm64 linux/ppc64le linux/s390x
+DOCKER_PLATFORMS := linux/amd64 linux/386 linux/arm64 linux/s390x
 PLATFORM         ?= $(firstword $(DOCKER_PLATFORMS))
 TAG              = $(VERSION)_$(subst /,_,$(PLATFORM))