chore: security upgrades 2026-09

[nickmarden]

Collapses the two open Dependabot PRs onto one branch and fixes the coverage
flake that was making one of them look red.

Closes #31
Closes #32

What is here

• build(deps): step-security/harden-runner v2.21.0 -> v2.21.1,
  golangci/golangci-lint-action v7 -> v9.3.0,
  github/codeql-action/upload-sarif v4.37.9 -> v4.38.0 (build(deps): bump the actions-all group with 3 updates #32)
• build(deps): alpine 3.23.5 -> 3.24.1 in both Dockerfiles (build(deps): bump alpine from 3.23.5 to 3.24.1 #31)
• fix(test): make both Server.Shutdown error branches deterministic

The coverage flake

PR #31 touched nothing but the two Dockerfiles and still failed test with:

ERROR: Uncovered code without coverage:ignore comments:

internal/server/server.go:124

That is the HTTP shutdown error branch, and it is not something an alpine bump
can reach. TestServer_Shutdown_ErrorPaths gave both servers the same handler
and closed a single handlerStarted channel from a sync.Once, so it waited
for whichever of the two requests arrived first and then shut down. The server
that had not started yet had no connection in flight, Shutdown returned nil
for it, and its error branch never ran.

Whichever side lost the race was the uncovered one, and that varied by machine.
The coverage:ignore added in 0.2.15 sat on the HTTPS branch, so it covered
exactly one of the two symmetric outcomes and did nothing on a run where HTTP
was the short one.

Each server now gets its own handler and its own started channel, the test waits
for both, and it asserts the joined error names both servers. Both branches run
every time, so the ignore is gone and internal/server reports a real 100%
instead of 98.5%.

Verified with 8 clean runs plus 6 more under CPU contention at -cpu=1; both
blocks report covered in every one.

Survey notes

• govulncheck is clean. The one module-level finding, GO-2026-5932
  (x/crypto/openpgp unmaintained), has Fixed in: N/A and nothing here
  imports openpgp.
• go list -u -m reports no direct module updates outstanding.
• Every uses: is pinned to a full SHA, and every setup-go job already
  allowlists release-assets.githubusercontent.com:443.
• All six workflows are active; none has been disabled for inactivity since
  snyk.yml was switched back on last pass.
• Dependabot security updates are still disabled at the repo level, though
  .github/dependabot.yml covers all three ecosystems, which is what opened
  build(deps): bump alpine from 3.23.5 to 3.24.1 #31 and build(deps): bump the actions-all group with 3 updates #32.

make check is green on the committed tree: lint 0 issues, coverage 99.0% with
every uncovered line carrying a marker, both binaries build.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

Docker Images Built

Images are available for testing:

# gatekeeperd
docker pull ghcr.io/tight-line/gatekeeperd:pr-33-a6f85fb

# gatekeeper-relay
docker pull ghcr.io/tight-line/gatekeeper-relay:pr-33-a6f85fb

docker-compose.yml

GATEKEEPERD_IMAGE=ghcr.io/tight-line/gatekeeperd:pr-33-a6f85fb \
RELAY_IMAGE=ghcr.io/tight-line/gatekeeper-relay:pr-33-a6f85fb \
docker-compose --profile relay up

Helm (values override)

image:
  repository: ghcr.io/tight-line/gatekeeperd  # or gatekeeper-relay
  tag: "pr-33-a6f85fb"

Images expire ~15 days after PR closes.