fix: Publishes images only from main

Every pushed ref built and pushed images, with the tag derived from the ref
name. A branch named "latest" or a git tag named "main" therefore
overwrote the production image, and ref names were interpolated into shell
scripts unquoted (script injection).

- images are only pushed for pushes to refs/heads/main
- other refs are built and tested with a ci-<sha> tag, never pushed
- registry login happens only when publishing, after the compose test
- main additionally pushes an immutable sha-<sha> tag for pinning
- expression values are passed to scripts via env

The registry credentials still need to be restricted to main on the
Forgejo side, since a pushed branch can modify this workflow.

.forgejo/workflows/images.yml

@@ -4,6 +4,16 @@ on:
   push:
   workflow_dispatch:
 
+# Images are only published for pushes to the main branch. All other refs (branches,
+# renovate branches, tags) are built and tested locally, but never pushed.
+#
+# Note: a workflow run for a pushed ref uses the workflow file from that ref, so this
+# condition alone does not stop someone with push access from publishing images. The
+# registry credentials must additionally be restricted to the protected main branch.
+
+env:
+  IMAGE_PREFIX: git.hamburg.ccc.de/ccchh/sunders
+
 jobs:
   build:
     runs-on: docker
@@ -14,44 +24,61 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Set image tags
+        id: vars
+        env:
+          COMMIT_SHA: ${{ github.sha }}
+          PUBLISH: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+        run: |
+          if [ "$PUBLISH" = "true" ]; then
+            echo "tag=latest" >> "$GITHUB_OUTPUT"
+          else
+            # Never derive tags from ref names: they are attacker-controlled and may collide with `latest`.
+            echo "tag=ci-${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
+          fi
+          echo "sha_tag=sha-${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
+
+      - name: Build web image
+        env:
+          TAG: ${{ steps.vars.outputs.tag }}
+        run: |
+          docker build -f ./Containerfile -t "$IMAGE_PREFIX/web:$TAG" .
+        working-directory: ./web
+
+      - name: Build data_handler image
+        env:
+          TAG: ${{ steps.vars.outputs.tag }}
+        run: |
+          docker build -f ./Containerfile -t "$IMAGE_PREFIX/data_handler:$TAG" .
+        working-directory: ./data_handler
+
+      - name: Update docker-compose.yml image tags
+        env:
+          TAG: ${{ steps.vars.outputs.tag }}
+        run: |
+          sed -i "s/:latest/:${TAG}/g" docker-compose.yml
+
+      - name: Start Docker Compose services
+        run: |
+          docker compose up -d --wait
+          docker compose down
+
       - name: Login to Container Registry
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         uses: docker/login-action@v3
         with:
           registry: git.hamburg.ccc.de
           username: ${{ secrets.REGISTRY_USERNAME }}
           password: ${{ secrets.REGISTRY_TOKEN }}
-      
-      - name: Set image tags
-        id: vars
-        run: |
-          if [ "${{ github.ref_name }}" = "main" ] && [ "${{ github.event_name }}" = "push" ]; then
-            echo "tag=latest" >> $GITHUB_OUTPUT
-          else
-            # renovate creates sub branches with `/`; these break the tagging in the build process
-            echo tag=$(echo "${{ github.ref_name }}" | sed 's/[^a-zA-Z0-9._-]/_/g') >> $GITHUB_OUTPUT
-          fi
-
-      - name: Build web image
-        run: |
-          docker build -f ./Containerfile -t git.hamburg.ccc.de/ccchh/sunders/web:${{ steps.vars.outputs.tag }} .
-        working-directory: ./web
-
-      - name: Build data_handler image
-        run: |
-          docker build -f ./Containerfile -t git.hamburg.ccc.de/ccchh/sunders/data_handler:${{ steps.vars.outputs.tag }} .
-        working-directory: ./data_handler
 
       - name: Push images to Container Registry
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        env:
+          TAG: ${{ steps.vars.outputs.tag }}
+          SHA_TAG: ${{ steps.vars.outputs.sha_tag }}
         run: |
-          docker push git.hamburg.ccc.de/ccchh/sunders/web:${{ steps.vars.outputs.tag }}
-          docker push git.hamburg.ccc.de/ccchh/sunders/data_handler:${{ steps.vars.outputs.tag }}
-        if: github.event_name == 'push'
-
-      - name: Update docker-compose.yml image tags
-        run: |
-          sed -i "s/:latest/:${{ steps.vars.outputs.tag }}/g" docker-compose.yml
-
-      - name: Start Docker Compose services
-        run: |
-          docker compose up -d --wait
-          docker compose down 
+          for image in web data_handler; do
+            docker tag "$IMAGE_PREFIX/$image:$TAG" "$IMAGE_PREFIX/$image:$SHA_TAG"
+            docker push "$IMAGE_PREFIX/$image:$TAG"
+            docker push "$IMAGE_PREFIX/$image:$SHA_TAG"
+          done