fix(sonar): addressing reliability/security issues (#202)

.github/workflows/build.yml

@@ -23,13 +23,13 @@ jobs:
     env:
       BUILD_WRAPPER_OUT_DIR: bw-output
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           fetch-depth: 0
           submodules: recursive
 
       - name: Set up Python 3.14
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.14'
 
@@ -106,7 +106,7 @@ jobs:
             -C "$GITHUB_WORKSPACE" .
 
       - name: Upload analysis input
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: sonar-input
           path: /tmp/workspace.tar.gz

.github/workflows/build_bin.yml

@@ -33,14 +33,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           submodules: recursive
 
       - name: Setup Python 3.14
         id: python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.14"
           architecture: "x64"
@@ -104,7 +104,7 @@ jobs:
             -Force
 
       - name: Upload Windows build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: maszyna-windows-x64-${{ env.CONFIG_WIN }}
           path: |
@@ -113,7 +113,7 @@ jobs:
           retention-days: 14
 
       - name: Upload Windows debug symbols
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: maszyna-windows-x64-symbols-${{ env.CONFIG_WIN }}
           path: |
@@ -133,14 +133,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           submodules: recursive
 
       - name: Setup Python 3.14
         id: python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.14"
 
@@ -244,7 +244,7 @@ jobs:
           cp -R shaders/. build/bin/shaders/
 
       - name: Upload Linux build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: maszyna-linux-x64-${{ env.CONFIG_LINUX }}
           path: |

.github/workflows/sonar.yml

@@ -64,15 +64,13 @@ jobs:
     if: github.event.action == 'completed' && github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-24.04
     permissions:
-      contents: read      # checkout trusted config
+      contents: read      # fetch trusted config
       actions: read       # download artifact from the Build run
       statuses: write     # post the commit status
       pull-requests: read # verify PR head sha via the API
     env:
       BUILD_WRAPPER_OUT_DIR: bw-output
-      # .trusted/ holds the checkout of master used to restore the scanner config;
-      # it is not part of the analysed change.
-      SONAR_EXCLUSIONS: betterRenderer/**,ref/**,imgui/**,stb/**,build/**,bw-output/**,.trusted/**
+      SONAR_EXCLUSIONS: betterRenderer/**,ref/**,imgui/**,stb/**,build/**,bw-output/**
       SONAR_SCANNER_JAVA_OPTS: -Xmx5g
     steps:
       - name: Post pending status
@@ -85,16 +83,23 @@ jobs:
             -f description="Analysis in progress" \
             -f target_url="$RUN_URL"
 
-      # Trusted copy of the repo config, used to overwrite anything the PR
-      # might have tampered with (sonar-project.properties etc).
-      - name: Checkout trusted config from master
-        uses: actions/checkout@v5
-        with:
-          ref: master
-          path: .trusted
+      # Trusted copy of the scanner config, used to overwrite anything the PR
+      # might have tampered with. Fetched as a single file through the API rather
+      # than with actions/checkout: nothing gets checked out in this privileged
+      # context. Kept outside the workspace, so the archive can't overwrite it.
+      - name: Fetch trusted config from master
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          url="repos/${{ github.repository }}/contents/sonar-project.properties?ref=master"
+          if ! gh api -H "Accept: application/vnd.github.raw" "$url" > /tmp/trusted-sonar-project.properties; then
+            echo "::warning::no sonar-project.properties on master"
+            rm -f /tmp/trusted-sonar-project.properties
+          fi
 
       - name: Download analysis input
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: sonar-input
           path: /tmp/sonar-input
@@ -104,13 +109,7 @@ jobs:
       - name: Unpack analysis input
         run: |
           set -euo pipefail
-          # The archive holds the whole PR workspace and is unpacked over this one,
-          # .trusted/ included. Move the trusted config out of reach first, or a PR
-          # carrying its own .trusted/sonar-project.properties would have it planted
-          # here and restored below as if it came from master.
-          if [ -f "$GITHUB_WORKSPACE/.trusted/sonar-project.properties" ]; then
-            cp "$GITHUB_WORKSPACE/.trusted/sonar-project.properties" /tmp/trusted-sonar-project.properties
-          fi
+          # The archive holds the whole PR workspace and is unpacked over this one.
           # Nothing may be written outside the workspace: reject absolute members and
           # any member reaching through a parent directory before unpacking anything.
           tar -tzf /tmp/sonar-input/workspace.tar.gz > /tmp/archive-members.txt