From 85931aac61d8a6c5ebb72995ab95f123f598e434 Mon Sep 17 00:00:00 2001 From: erwan-joly Date: Sun, 30 Aug 2026 20:43:41 +1200 Subject: [PATCH 1/3] ci: modernize deploy actions, pin ecs-deploy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit checkout@v2 and the v1 AWS actions run on retired node runtimes, the image output used the removed ::set-output syntax for an output nothing consumes, and ecs-deploy was tracked at master — an unpinned third-party action running with AWS credentials. Pinned to its v0.3.0 release; also dropped --no-cache, which only slowed the build. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/dotnet.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index 1a88e29..46904f9 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -9,7 +9,7 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 - name: Setup .NET uses: actions/setup-dotnet@v4 with: @@ -23,7 +23,7 @@ jobs: - name: Configure AWS Credentials if: github.ref == 'refs/heads/master' - uses: aws-actions/configure-aws-credentials@v1 + uses: aws-actions/configure-aws-credentials@v4 with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} @@ -32,7 +32,7 @@ jobs: - name: Login to Amazon ECR if: github.ref == 'refs/heads/master' id: login-ecr - uses: aws-actions/amazon-ecr-login@v1 + uses: aws-actions/amazon-ecr-login@v2 - name: Build, tag, and push image to Amazon ECR if: github.ref == 'refs/heads/master' @@ -43,14 +43,13 @@ jobs: IMAGE_TAG: latest run: | - docker build -f ./src/NosCoreBot/dockerfile -t noscorebot:$IMAGE_TAG --no-cache . + docker build -f ./src/NosCoreBot/dockerfile -t noscorebot:$IMAGE_TAG . docker tag noscorebot:$IMAGE_TAG $ECR_REGISTRY/noscorebot:$IMAGE_TAG docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG - echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" - name: Deploy to Amazon ECS if: github.ref == 'refs/heads/master' - uses: donaldpiret/ecs-deploy@master + uses: donaldpiret/ecs-deploy@v0.3.0 with: cluster: discordbot-cluster target: noscorebot From dfb1e96aebd8582f2106bc6913b29d952833bcac Mon Sep 17 00:00:00 2001 From: erwan-joly Date: Sun, 30 Aug 2026 21:24:41 +1200 Subject: [PATCH 2/3] ci: no credential persistence on checkout, pin ecs-deploy by commit The tag pin still trusts the tag ref, which can be moved; the commit sha cannot. Sha verified as the commit v0.3.0 points to. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/dotnet.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index 46904f9..8fad436 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -10,6 +10,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Setup .NET uses: actions/setup-dotnet@v4 with: @@ -49,7 +51,7 @@ jobs: - name: Deploy to Amazon ECS if: github.ref == 'refs/heads/master' - uses: donaldpiret/ecs-deploy@v0.3.0 + uses: donaldpiret/ecs-deploy@1ecf7b109ad634c6391b486298b9ddeebca378cd # v0.3.0 with: cluster: discordbot-cluster target: noscorebot From b8899ec135dca61a70e83a6cd998449f7f7048e3 Mon Sep 17 00:00:00 2001 From: erwan-joly Date: Sun, 30 Aug 2026 21:30:43 +1200 Subject: [PATCH 3/3] ci: pin ecs-deploy to the current master commit instead of v0.3.0 Deploys have been running master; the release tag is five commits behind it, all dependency CVE fixes. Pinning the commit master resolves to today keeps the deploy byte-identical while making the ref immutable. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/dotnet.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index 8fad436..089fd9b 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -51,7 +51,7 @@ jobs: - name: Deploy to Amazon ECS if: github.ref == 'refs/heads/master' - uses: donaldpiret/ecs-deploy@1ecf7b109ad634c6391b486298b9ddeebca378cd # v0.3.0 + uses: donaldpiret/ecs-deploy@b4c35d42b679ca60f35fa383cfbd71bcc9248a06 # master 2026-08 (v0.3.0 + dep CVE bumps) with: cluster: discordbot-cluster target: noscorebot