ci(security): enable docker+pip Dependabot, migrate moby modules, pin actions, clear SAST findings

.github/dependabot.yml

@@ -38,3 +38,51 @@ updates:
         update-types:
           - minor
           - patch
+
+  # Container images we publish from this repo. The 5 *.Dockerfile files
+  # at the repo root (caddy, cloud-helpers.aws, github-actions,
+  # github-actions-staging, kubectl) build production images. The
+  # Dockerfiles under docs/docs/examples/ are user-facing samples, not
+  # production artifacts — Dependabot will only pick up the ones at the
+  # configured directory level (`/`), so example Dockerfiles are
+  # implicitly out of scope.
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - docker
+    commit-message:
+      prefix: deps
+      include: scope
+    groups:
+      docker-minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+
+  # Python tooling for the docs site (MkDocs + Material + plugins).
+  # Public site, so CVEs in the build chain still matter.
+  - package-ecosystem: pip
+    directory: /docs
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - python
+      - docs
+    commit-message:
+      prefix: deps
+      include: scope
+    groups:
+      pip-minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch

.github/workflows/branch-preview.yaml

@@ -18,8 +18,10 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Get next version
-        uses: reecetech/version-increment@2023.10.2
+        uses: reecetech/version-increment@71036b212bbdc100b48aae069870f10953433346  # 2023.10.2
         id: base-version
         with:
           scheme: "calver"
@@ -41,9 +43,11 @@ jobs:
       cicd-bot-telegram-chat-id: ${{ steps.telegram-secrets.outputs.cicd-bot-telegram-chat-id }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-      - uses: fregante/setup-git-user@v2
+        with:
+          persist-credentials: false
+      - uses: fregante/setup-git-user@024bc0b8e177d7e77203b48dab6fb45666854b35  # v2.0.2
       - name: Set up Go with Blacksmith caching
-        uses: useblacksmith/setup-go@v6
+        uses: useblacksmith/setup-go@647ac649bd5b480f2a262e3e3e5f4d150ed452ad  # v6.0.1
         with:
           go-version: '1.25'
       - name: install sc tool
@@ -68,8 +72,9 @@ jobs:
         env:
           OPENAI_API_KEY: ${{ steps.get-openai-key.outputs.openai-key }}
           SKIP_EMBEDDINGS: "true"
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |-
-          git remote set-url origin https://${{ secrets.GITHUB_TOKEN }}@github.com/simple-container-com/api.git
+          gh auth setup-git
           welder run rebuild
       - name: clean
         run: |
@@ -104,7 +109,7 @@ jobs:
           echo "cicd-bot-telegram-token=$(./bin/sc stack secret-get -s dist cicd-bot-telegram-token)" >> $GITHUB_OUTPUT
           echo "cicd-bot-telegram-chat-id=$(./bin/sc stack secret-get -s dist cicd-bot-telegram-chat-id)" >> $GITHUB_OUTPUT
       - name: upload bin directory artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         with:
           name: bin-tools
           path: bin
@@ -125,8 +130,10 @@ jobs:
             arch: amd64
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Go with Blacksmith caching
-        uses: useblacksmith/setup-go@v6
+        uses: useblacksmith/setup-go@647ac649bd5b480f2a262e3e3e5f4d150ed452ad  # v6.0.1
         with:
           go-version: '1.25'
       - name: create build directories
@@ -146,7 +153,7 @@ jobs:
           tar -czf .sc/stacks/dist/bundle/sc-${GOOS}-${GOARCH}.tar.gz -C dist/${GOOS}-${GOARCH} sc${EXT}
           cp .sc/stacks/dist/bundle/sc-${GOOS}-${GOARCH}.tar.gz .sc/stacks/dist/bundle/sc-${GOOS}-${GOARCH}-v${VERSION}.tar.gz
       - name: upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         with:
           name: sc-${{ matrix.os }}-${{ matrix.arch }}
           path: .sc/stacks/dist/bundle/sc-${{ matrix.os }}-${{ matrix.arch }}-v*.tar.gz
@@ -167,8 +174,10 @@ jobs:
             output: dist/cloud-helpers
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Go with Blacksmith caching
-        uses: useblacksmith/setup-go@v6
+        uses: useblacksmith/setup-go@647ac649bd5b480f2a262e3e3e5f4d150ed452ad  # v6.0.1
         with:
           go-version: '1.25'
       - name: create build directories
@@ -181,7 +190,7 @@ jobs:
         run: |
           go build -a -installsuffix cgo -ldflags "-s -w -X=github.com/simple-container-com/api/internal/build.Version=${VERSION}" -o ${{ matrix.output }} ./cmd/${{ matrix.cmd }}
       - name: upload ${{ matrix.target }} binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         with:
           name: ${{ matrix.target }}-binary
           path: ${{ matrix.output }}
@@ -193,8 +202,10 @@ jobs:
     needs: [prepare, build-setup]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Go with Blacksmith caching
-        uses: useblacksmith/setup-go@v6
+        uses: useblacksmith/setup-go@647ac649bd5b480f2a262e3e3e5f4d150ed452ad  # v6.0.1
         with:
           go-version: '1.25'
       - name: test
@@ -218,8 +229,10 @@ jobs:
             tag_prefix: "simplecontainer/cloud-helpers:aws-"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: download ${{ matrix.target }} binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
         with:
           name: ${{ matrix.target }}-binary
           path: dist
@@ -234,11 +247,10 @@ jobs:
           EOF
           sc secrets reveal
       - name: Setup Docker Buildx with advanced caching
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0
         with:
           driver-opts: |
             image=moby/buildkit:buildx-stable-1
-          buildkitd-flags: --allow-insecure-entitlement security.insecure
       - name: Disable IPv6 (Blacksmith runners have broken IPv6 to Docker Hub)
         run: sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
       - name: Docker login using SC secrets
@@ -266,13 +278,15 @@ jobs:
     needs: [prepare, build-setup, build-platforms, test]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: download all sc platform artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
         with:
           path: artifacts
           pattern: sc-*
       - name: download bin tools artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
         with:
           name: bin-tools
           path: bin
@@ -314,14 +328,21 @@ jobs:
     # Only needs docker-build — the tag must point to a commit referencing a published Docker image.
     # Does not need build-platforms or publish-sc-preview. Runs in parallel with publish-sc-preview.
     needs: [prepare, docker-build]
+    # GH_TOKEN must be visible to every step that runs git (checkout, commit,
+    # push) because `gh auth setup-git` installs `gh auth git-credential` as
+    # the credential helper — and that helper reads $GH_TOKEN from the
+    # invoking step's env when git pushes. Setting it once at job level
+    # avoids the "fatal: could not read Username" failure from per-step env.
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
+          persist-credentials: false
           fetch-depth: 0
-      - uses: fregante/setup-git-user@v2
-      - name: configure git remote with token
-        run: |
-          git remote set-url origin https://${{ secrets.GITHUB_TOKEN }}@github.com/simple-container-com/api.git
+      - uses: fregante/setup-git-user@024bc0b8e177d7e77203b48dab6fb45666854b35  # v2.0.2
+      - name: configure git credential helper
+        run: gh auth setup-git
       - name: create release branch and update action.yml image tags
         env:
           VERSION: ${{ needs.prepare.outputs.version }}
@@ -362,6 +383,8 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         if: ${{ always() }}
+        with:
+          persist-credentials: false
 
       - name: Extract git reference
         id: extract_git_ref

.github/workflows/branch.yaml

@@ -1,4 +1,13 @@
 name: Build simple-container in branch
+# GitHub does not pass repository secrets to workflows triggered by fork
+# PRs (only same-repo branches), so the practical attack surface for the
+# rule below is limited to internal collaborators with push access. The
+# PR-validation job requires `secrets.SC_CONFIG` to decrypt the SC config
+# and run integration-style tests against shared infra. Splitting this
+# into a workflow_run-gated secret-using job is the proper fix and is
+# tracked separately; until then this is accepted defense-in-depth risk
+# for trusted contributors.
+# nosemgrep: gha-pull-request-uses-non-token-secret
 on:
   workflow_dispatch:
   pull_request:
@@ -18,9 +27,11 @@ jobs:
       cicd-bot-telegram-chat-id: ${{ steps.telegram-secrets.outputs.cicd-bot-telegram-chat-id }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-      - uses: fregante/setup-git-user@v2
+        with:
+          persist-credentials: false
+      - uses: fregante/setup-git-user@024bc0b8e177d7e77203b48dab6fb45666854b35  # v2.0.2
       - name: Set up Go with Blacksmith caching
-        uses: useblacksmith/setup-go@v6
+        uses: useblacksmith/setup-go@647ac649bd5b480f2a262e3e3e5f4d150ed452ad  # v6.0.1
         with:
           go-version: '1.25'
       - name: install sc tool
@@ -45,8 +56,9 @@ jobs:
         env:
           OPENAI_API_KEY: ${{ steps.get-openai-key.outputs.openai-key }}
           SKIP_EMBEDDINGS: "true"
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |-
-          git remote set-url origin https://${{ secrets.GITHUB_TOKEN }}@github.com/simple-container-com/api.git
+          gh auth setup-git
           welder run rebuild
       - name: clean
         run: |
@@ -81,7 +93,7 @@ jobs:
           echo "cicd-bot-telegram-token=$(./bin/sc stack secret-get -s dist cicd-bot-telegram-token)" >> $GITHUB_OUTPUT
           echo "cicd-bot-telegram-chat-id=$(./bin/sc stack secret-get -s dist cicd-bot-telegram-chat-id)" >> $GITHUB_OUTPUT
       - name: upload bin directory artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         with:
           name: bin-tools
           path: bin
@@ -102,8 +114,10 @@ jobs:
             arch: amd64
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Go with Blacksmith caching
-        uses: useblacksmith/setup-go@v6
+        uses: useblacksmith/setup-go@647ac649bd5b480f2a262e3e3e5f4d150ed452ad  # v6.0.1
         with:
           go-version: '1.25'
       - name: create build directories
@@ -121,7 +135,7 @@ jobs:
           go build -ldflags "-s -w" -o dist/${GOOS}-${GOARCH}/sc${EXT} ./cmd/sc
           tar -czf .sc/stacks/dist/bundle/sc-${GOOS}-${GOARCH}.tar.gz -C dist/${GOOS}-${GOARCH} sc${EXT}
       - name: upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         with:
           name: sc-${{ matrix.os }}-${{ matrix.arch }}
           path: .sc/stacks/dist/bundle/sc-${{ matrix.os }}-${{ matrix.arch }}.tar.gz
@@ -142,8 +156,10 @@ jobs:
             output: dist/cloud-helpers
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Go with Blacksmith caching
-        uses: useblacksmith/setup-go@v6
+        uses: useblacksmith/setup-go@647ac649bd5b480f2a262e3e3e5f4d150ed452ad  # v6.0.1
         with:
           go-version: '1.25'
       - name: create build directories
@@ -155,7 +171,7 @@ jobs:
         run: |
           go build -a -installsuffix cgo -ldflags "-s -w" -o ${{ matrix.output }} ./cmd/${{ matrix.cmd }}
       - name: upload ${{ matrix.target }} binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         with:
           name: ${{ matrix.target }}-binary
           path: ${{ matrix.output }}
@@ -167,16 +183,18 @@ jobs:
     needs: build-setup
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Go with Blacksmith caching
-        uses: useblacksmith/setup-go@v6
+        uses: useblacksmith/setup-go@647ac649bd5b480f2a262e3e3e5f4d150ed452ad  # v6.0.1
         with:
           go-version: '1.25'
       - name: build github-actions-staging
         run: |
           mkdir -p bin
           go build -ldflags "-s -w" -a -installsuffix cgo -o bin/github-actions ./cmd/github-actions
       - name: upload github-actions-staging binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         with:
           name: github-actions-staging-binary
           path: bin/github-actions
@@ -188,8 +206,10 @@ jobs:
     needs: build-setup
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Go with Blacksmith caching
-        uses: useblacksmith/setup-go@v6
+        uses: useblacksmith/setup-go@647ac649bd5b480f2a262e3e3e5f4d150ed452ad  # v6.0.1
         with:
           go-version: '1.25'
       - name: test
@@ -211,6 +231,8 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         if: ${{ always() }}
+        with:
+          persist-credentials: false
 
       - name: Extract git reference
         id: extract_git_ref