From 1d8a8788260304206753eb4e219551f3019f2c96 Mon Sep 17 00:00:00 2001
From: Uladzislau Muraveika <uladzislau.muraveika@protofire.io>
Date: Wed, 1 Jul 2026 19:02:11 +0300
Subject: [PATCH 1/2] refactor(github_ci): fix the proto image workflow, fix
 the Docker.proto file, fix zizmore issues

---
 .../workflows/build-docker-proto-image.yaml   | 40 +++++++++++++++----
 .../legacysync/downloader/Proto.Dockerfile    | 13 +++---
 2 files changed, 41 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/build-docker-proto-image.yaml b/.github/workflows/build-docker-proto-image.yaml
index 3f0090282f..da8997cc28 100644
--- a/.github/workflows/build-docker-proto-image.yaml
+++ b/.github/workflows/build-docker-proto-image.yaml
@@ -3,33 +3,59 @@ name: Build and Push harmony proto Docker Image
 on:
   workflow_dispatch:
 
+permissions: {}
 jobs:
   build_and_push:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout harmony core code
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
         with:
           path: harmony
           ref: ${{ github.ref }}
-          fetch-depth: 0
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Get image version
+        id: image-version
+        run: |
+          set -euo pipefail
+
+          SHORT_SHA="$(git -C harmony rev-parse --short=12 HEAD)"
+          FULL_SHA="$(git -C harmony rev-parse HEAD)"
+
+          echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
+          echo "full_sha=${FULL_SHA}" >> "$GITHUB_OUTPUT"
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 #v4.2.0
+        with:
+          platforms: arm64
+          cache-image: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 #v4.1.0
 
       - name: Login to DockerHub
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee #v4.2.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a #v7.3.0
         with:
           context: ./harmony/api/service/synchronize/legacysync/downloader
           file: ./harmony/api/service/synchronize/legacysync/downloader/Proto.Dockerfile
           push: true
           platforms: linux/amd64,linux/arm64
           tags: |
-            harmonyone/harmony-proto:latest
\ No newline at end of file
+            murme123/harmony-proto:${{ steps.image-version.outputs.short_sha }}
+            murme123/harmony-proto:latest
+          labels: |
+            org.opencontainers.image.revision=${{ steps.image-version.outputs.full_sha }}
+            org.opencontainers.image.version=${{ steps.image-version.outputs.short_sha }}
diff --git a/api/service/synchronize/legacysync/downloader/Proto.Dockerfile b/api/service/synchronize/legacysync/downloader/Proto.Dockerfile
index 5e19c8e084..e154dc0e67 100644
--- a/api/service/synchronize/legacysync/downloader/Proto.Dockerfile
+++ b/api/service/synchronize/legacysync/downloader/Proto.Dockerfile
@@ -1,9 +1,12 @@
 FROM golang:1.24.2-bullseye
 
-RUN apt update
-RUN apt install -y protobuf-compiler
-RUN protoc --version
-RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.30.0
-RUN go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.3
+# hadolint ignore=DL3008
+RUN apt-get update > /dev/null 2>&1 && \
+    apt-get install -y protobuf-compiler --no-install-recommends && \
+    protoc --version && \
+    go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.30.0 && \
+    go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.3 && \
+    apt-get clean > /dev/null 2>&1 && \
+    rm -rf /var/lib/apt/lists/*
 
 ENTRYPOINT ["protoc", "-I=/tmp", "--go_out=/tmp", "--go-grpc_out=/tmp"]

From efc311641aef179d50478a467db31eff0573242a Mon Sep 17 00:00:00 2001
From: Uladzislau Muraveika <uladzislau.muraveika@protofire.io>
Date: Wed, 1 Jul 2026 20:02:54 +0300
Subject: [PATCH 2/2] feat(github_ci): enable zizmor static linter

---
 .github/workflows/zizmor.yaml | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 .github/workflows/zizmor.yaml

diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
new file mode 100644
index 0000000000..a3b4370b49
--- /dev/null
+++ b/.github/workflows/zizmor.yaml
@@ -0,0 +1,35 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+    paths:
+      - '.github/workflows/**/*.yml'
+      - '.github/workflows/**/*.yaml'
+
+  pull_request:
+    branches: ["**"]
+    paths:
+      - '.github/workflows/**/*.yml'
+      - '.github/workflows/**/*.yaml'
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        with:
+          inputs: ./.github/
+          advanced-security: false