chore(ci): pin the supply chain and surface build provenance

Every workflow action is pinned to a commit SHA, dependabot auto-merge is limited to patch and minor updates behind the now-required status checks on main, and the audit, Trivy and ESLint gates block instead of warning. The published image finally carries its build SHA and build timestamp so the version endpoint can prove which commit is running. The API-token HMAC key fails closed under 32 characters, compose pins the database minor and denies privilege escalation, and the changelog drops working-note references in favour of neutral wording.
2026-11-10 05:12:14 +00:00 · 2026-06-10 15:05:05 +02:00
1 parent aabc7915cb
commit d7bf0df10b
@@ -12,11 +12,11 @@ jobs:
    if: github.actor == 'dependabot[bot]'

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: "pnpm"
@@ -27,7 +27,34 @@ jobs:

      - run: pnpm test

-      - run: gh pr merge --auto --squash "$PR_URL"
+      # Auto-merge is gated on the Dependabot-declared update type:
+      # patch and minor bumps merge once required checks pass; major
+      # bumps get a comment and wait for the maintainer. A major bump
+      # routinely carries breaking changes the unit suite alone cannot
+      # vouch for.
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge (patch / minor only)
+        if: >-
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Flag major update for manual review
+        if: steps.metadata.outputs.update-type == 'version-update:semver-major'
+        run: >-
+          gh pr comment "$PR_URL" --body
+          "Major version bump (${DEP_NAMES}) — auto-merge is intentionally
+          disabled for semver-major updates. Review the upstream changelog
+          and merge manually."
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          DEP_NAMES: ${{ steps.metadata.outputs.dependency-names }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -20,6 +20,11 @@ on:
    branches: [main]
  workflow_dispatch:

+# Default for any job that doesn't declare its own block; both jobs
+# below elevate to packages:write explicitly.
+permissions:
+  contents: read
+
 env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
@@ -72,10 +77,10 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      # GHCR rejects repository refs with uppercase letters. `IMAGE_NAME`
      # is derived from `github.repository`, which preserves the case of
@@ -93,7 +98,7 @@ jobs:
      # Image is built but not pushed in that case.
      - name: Log in to GitHub Container Registry
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -101,7 +106,7 @@ jobs:

      - name: Compute image labels
        id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: ${{ env.IMAGE_REF }}
          labels: |
@@ -181,6 +186,19 @@ jobs:
          asn_size="$(stat -c%s assets/geolite2/GeoLite2-ASN.mmdb)"
          echo "::notice::GeoLite2 MMDBs verified — GeoLite2-City.mmdb ${city_size} bytes; GeoLite2-ASN.mmdb ${asn_size} bytes."

+      # Build provenance for /api/version: the short commit SHA and an
+      # ISO-8601 build timestamp travel into the image as build-args
+      # (NEXT_PUBLIC_APP_BUILD_SHA / NEXT_PUBLIC_APP_BUILT_AT) so the
+      # deploy runbook can verify which commit a running container
+      # actually carries — the `:latest` pull is the source of truth,
+      # not the queued deploy status. 12 hex chars is plenty to be
+      # unambiguous in this repository.
+      - name: Resolve build provenance
+        id: provenance
+        run: |
+          echo "build_sha=${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
+          echo "built_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+
      # Per-ref + per-platform gha cache scope. Tag builds warm-start
      # off main's last good layer set for the same platform; tag and
      # main builds at the same SHA do not contend on writes, and
@@ -188,7 +206,7 @@ jobs:
      # arm64 layer never poisons an amd64 build).
      - name: Build & push by digest
        id: build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          file: ./Dockerfile
@@ -203,6 +221,8 @@ jobs:
          # can never survive a cache hit into the new image.
          build-args: |
            NEXT_PUBLIC_APP_VERSION=${{ github.ref_name }}
+            NEXT_PUBLIC_APP_BUILD_SHA=${{ steps.provenance.outputs.build_sha }}
+            NEXT_PUBLIC_APP_BUILT_AT=${{ steps.provenance.outputs.built_at }}
          outputs: |
            type=image,name=${{ env.IMAGE_REF }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
          cache-from: |
@@ -224,7 +244,7 @@ jobs:

      - name: Upload digest artifact
        if: github.event_name != 'pull_request'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: digest-${{ matrix.cache_scope }}
          path: /tmp/digests/*
@@ -251,14 +271,14 @@ jobs:

    steps:
      - name: Download digest artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: /tmp/digests
          pattern: digest-*
          merge-multiple: true

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      # GHCR requires the repository ref to be lowercase. See the same
      # step in the `build` job above for the longer rationale.
@@ -267,7 +287,7 @@ jobs:
          echo "IMAGE_REF=${REGISTRY}/${IMAGE_NAME,,}" >> "$GITHUB_ENV"

      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -275,7 +295,7 @@ jobs:

      - name: Compute image tags & labels
        id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: ${{ env.IMAGE_REF }}
          tags: |
@@ -6,6 +6,9 @@ on:
  push:
    branches: [main]

+permissions:
+  contents: read
+
 # Cancel in-progress runs when a new commit lands on the same PR.
 concurrency:
  group: e2e-${{ github.workflow }}-${{ github.ref }}
@@ -41,11 +44,11 @@ jobs:
      NODE_ENV: production

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: pnpm
@@ -57,7 +60,7 @@ jobs:
      - run: pnpm db:migrate:deploy

      - name: Cache Playwright browsers
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
@@ -74,7 +77,7 @@ jobs:

      - name: Upload Playwright HTML report on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report
          path: playwright-report/
@@ -25,13 +25,13 @@ jobs:
    timeout-minutes: 5
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

      - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: pnpm
@@ -6,16 +6,19 @@ on:
  push:
    branches: [main]

+permissions:
+  contents: read
+
 jobs:
  integration:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: pnpm
@@ -16,11 +16,11 @@ jobs:
    timeout-minutes: 10

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: pnpm
@@ -19,7 +19,7 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Scan src/ for TODO/FIXME/XXX/HACK markers
        run: |
@@ -70,7 +70,7 @@ jobs:
          fi

      - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -15,11 +15,11 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: "pnpm"
@@ -28,12 +28,10 @@ jobs:

      - run: pnpm db:generate

+      # Blocking since v1.15.20 — the settings-split refactor that kept
+      # this warn-only is long done and the tree lints clean.
      - name: ESLint
        run: pnpm lint
-        # Non-blocking on the existing settings page monolith — its set-state-
-        # in-effect violations need the 1.4.0 settings-split refactor to fix
-        # cleanly. Will flip to blocking once settings/page.tsx is broken up.
-        continue-on-error: true

      - name: TypeScript strict check
        run: pnpm typecheck
@@ -62,32 +60,37 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: "pnpm"

      - run: pnpm install --frozen-lockfile

+      # Blocking since v1.15.20 — a HIGH/CRITICAL advisory against a
+      # production dependency fails the build. If an advisory has no
+      # upstream fix yet, pin an `auditConfig.ignoreCves` entry in
+      # package.json (pnpm's documented suppression mechanism) with a
+      # comment referencing the tracking issue, rather than flipping
+      # this step back to warn-only.
      - name: Audit for known vulnerabilities
        run: pnpm audit --prod --audit-level=high
-        continue-on-error: true

  secret-scan:
    name: Secret Scanning
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0

      - name: Gitleaks secret scan
-        uses: gitleaks/gitleaks-action@v3
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

@@ -97,7 +100,7 @@ jobs:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Build Docker image
        run: docker build -t healthlog:scan .
@@ -109,6 +112,12 @@ jobs:
          echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee /etc/apt/sources.list.d/trivy.list
          sudo apt-get update && sudo apt-get install -y trivy

+      # Blocking since v1.15.20 — a HIGH/CRITICAL finding in the built
+      # image fails the job. For a finding without an upstream fix
+      # (e.g. a base-image CVE Alpine has not patched yet), add the CVE
+      # id to a `.trivyignore` file at the repository root — Trivy reads
+      # it automatically — one CVE per line, each with a comment naming
+      # the tracking issue and the re-check condition. Never suppress a
+      # finding that has a fixed version available; bump instead.
      - name: Trivy container scan
        run: trivy image --format table --severity CRITICAL,HIGH --exit-code 1 healthlog:scan
-        continue-on-error: true