From b5a1f948fee68ca87bce733e37c160b874c92afd Mon Sep 17 00:00:00 2001
From: root <root@pve.fritz.box>
Date: Sat, 3 Oct 2026 06:13:54 +0200
Subject: [PATCH] ci: update actions to current majors, minimal permissions,
 Node matrix, avoid expression injection in release

Trivy (vuln+secret, HIGH/CRITICAL) and npm audit: 0 findings before and after.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XNi42F9voFf5YMVC5xbsk7
---
 .github/workflows/ci.yml      | 19 ++++++++++++++++---
 .github/workflows/release.yml | 24 +++++++++++++++---------
 2 files changed, 31 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 884f9d0..6c94c64 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,18 +6,31 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   validate:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ['20', '22', '24']
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '22'
+          node-version: ${{ matrix.node }}
+          cache: npm
+          cache-dependency-path: cli-tool/package-lock.json
 
       - name: Install dependencies
         run: npm ci
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 312ecb8..89efaff 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,18 +17,20 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Validate version format
+        env:
+          VERSION: ${{ inputs.version }}
         run: |
-          if [[ ! "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "❌ Invalid version format: ${{ inputs.version }}"
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "❌ Invalid version format: $VERSION"
             echo "Expected: X.Y.Z (e.g. 0.3.0)"
             exit 1
           fi
@@ -38,7 +40,9 @@ jobs:
         working-directory: cli-tool
 
       - name: Set version in package.json
-        run: npm version ${{ inputs.version }} --no-git-tag-version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: npm version "$VERSION" --no-git-tag-version
         working-directory: cli-tool
 
       - name: Install dependencies
@@ -82,17 +86,19 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create git tag and release commit
+        env:
+          VERSION: ${{ inputs.version }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add cli-tool/package.json cli-tool/package-lock.json cli-tool/templates/
-          git commit -m "release: v${{ inputs.version }}" || true
-          git tag -a "v${{ inputs.version }}" -m "v${{ inputs.version }}"
+          git commit -m "release: v$VERSION" || true
+          git tag -a "v$VERSION" -m "v$VERSION"
           git push origin main
-          git push origin "v${{ inputs.version }}"
+          git push origin "v$VERSION"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: v${{ inputs.version }}
           name: v${{ inputs.version }}