fix(deps): SCA pass — close all fixable vulns across source, images and CI pins

.github/dependabot.yml

@@ -65,11 +65,17 @@ updates:
 
   # ── Docker: VERSION only ────────────────────────────────────────────────
   # Production images built from the 5 root *.Dockerfile files (caddy,
-  # cloud-helpers.aws, github-actions, github-actions-staging, kubectl).
-  # Dependabot only scans the configured directory level, so the example
-  # Dockerfiles under docs/ are implicitly out of scope.
+  # cloud-helpers.aws, github-actions, github-actions-staging, kubectl),
+  # plus the user-facing example Dockerfiles under docs/ (see below).
   - package-ecosystem: docker
-    directory: /
+    # The user-facing example Dockerfiles under docs/ are part of the tracked
+    # Docker surface per docs/DEPENDENCIES.md, but a bare `directory: /` only
+    # scans the root level — so their digests went unwatched and drifted onto
+    # caddy 2.11.3 and node 22.22.3 (both with HIGH CVEs) until the 2026-08 SCA
+    # pass caught them by hand. `directories:` with a glob closes that gap.
+    directories:
+      - /
+      - /docs/docs/examples/**
     schedule:
       interval: weekly
       day: monday

.github/workflows/branch-preview.yaml

@@ -31,7 +31,7 @@ jobs:
         run: |
           echo "::error title=branch-preview.yaml requires a branch ref::Got github.ref=$GITHUB_REF; this workflow signs preview artifacts under the preview trust root (refs/heads/* only). Re-dispatch from a branch."
           exit 1
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Get next version
@@ -56,7 +56,7 @@ jobs:
       cicd-bot-telegram-token: ${{ steps.telegram-secrets.outputs.cicd-bot-telegram-token }}
       cicd-bot-telegram-chat-id: ${{ steps.telegram-secrets.outputs.cicd-bot-telegram-chat-id }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - uses: fregante/setup-git-user@024bc0b8e177d7e77203b48dab6fb45666854b35  # v2.0.2
@@ -145,7 +145,7 @@ jobs:
           - os: darwin
             arch: amd64
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Go with Blacksmith caching
@@ -212,7 +212,7 @@ jobs:
       - name: SLSA build provenance for sc-${{ matrix.os }}-${{ matrix.arch }}
         id: slsa_tarball
         continue-on-error: true
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8  # v4.2.2
         with:
           subject-path: .sc/stacks/dist/bundle/sc-${{ matrix.os }}-${{ matrix.arch }}-v${{ needs.prepare.outputs.version }}.tar.gz
       - name: Materialize SLSA provenance bundle next to tarball
@@ -251,7 +251,7 @@ jobs:
             cmd: cloud-helpers
             output: dist/cloud-helpers
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Go with Blacksmith caching
@@ -279,7 +279,7 @@ jobs:
     runs-on: blacksmith-8vcpu-ubuntu-2204
     needs: [prepare, build-setup]
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Go with Blacksmith caching
@@ -302,17 +302,22 @@ jobs:
       matrix:
         include:
           - target: github-actions
+            cache_scope: github-actions
             binary: github-actions
             dockerfile: github-actions.Dockerfile
             image_repo: simplecontainer/github-actions
             tag_prefix: "simplecontainer/github-actions:"
           - target: cloud-helpers
+            # matches push.yaml's `image: cloud-helpers-aws` so the prod
+            # cache fallback above resolves; the artifact/tag names stay
+            # `cloud-helpers`.
+            cache_scope: cloud-helpers-aws
             binary: cloud-helpers
             dockerfile: cloud-helpers.aws.Dockerfile
             image_repo: simplecontainer/cloud-helpers
             tag_prefix: "simplecontainer/cloud-helpers:aws-"
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: download ${{ matrix.target }} binary
@@ -331,7 +336,7 @@ jobs:
           EOF
           sc secrets reveal
       - name: Setup Docker Buildx with advanced caching
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
         with:
           driver-opts: |
             image=moby/buildkit:buildx-stable-1
@@ -342,15 +347,21 @@ jobs:
           sc stack secret-get -s dist dockerhub-cicd-token | docker login --username simplecontainer --password-stdin
       - name: Build and push preview ${{ matrix.target }} image
         id: build_and_push
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: .
           file: ${{ matrix.dockerfile }}
           platforms: linux/amd64
           tags: ${{ matrix.tag_prefix }}${{ needs.prepare.outputs.version }}
           push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          # Writes its own preview tier; reads prod as a warm fallback.
+          # Reading a higher-trust scope is safe, writing one is not.
+          # matrix.cache_scope (not matrix.target) so the prod fallback
+          # actually matches push.yaml's image names.
+          cache-from: |
+            type=gha,scope=preview-${{ matrix.cache_scope }}
+            type=gha,scope=prod-${{ matrix.cache_scope }}
+          cache-to: type=gha,mode=max,scope=preview-${{ matrix.cache_scope }}
           provenance: false
       # Phase 2 attestation (mirrors push.yaml). Preview builds get the SAME
       # security guarantees as production releases so consumers pin-testing a
@@ -410,7 +421,7 @@ jobs:
     permissions:
       contents: write  # welder deploy reads release artifacts + updates dist
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: download all sc platform artifacts
@@ -481,7 +492,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -537,7 +548,7 @@ jobs:
       - publish-git-tag
       - docker-build
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: ${{ always() }}
         with:
           persist-credentials: false

.github/workflows/branch.yaml

@@ -46,7 +46,7 @@ jobs:
       cicd-bot-telegram-token: ${{ steps.telegram-secrets.outputs.cicd-bot-telegram-token }}
       cicd-bot-telegram-chat-id: ${{ steps.telegram-secrets.outputs.cicd-bot-telegram-chat-id }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - uses: fregante/setup-git-user@024bc0b8e177d7e77203b48dab6fb45666854b35  # v2.0.2
@@ -131,7 +131,7 @@ jobs:
           - os: darwin
             arch: amd64
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Go with Blacksmith caching
@@ -173,7 +173,7 @@ jobs:
             cmd: cloud-helpers
             output: dist/cloud-helpers
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Go with Blacksmith caching
@@ -200,7 +200,7 @@ jobs:
     runs-on: blacksmith-8vcpu-ubuntu-2204
     needs: build-setup
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Go with Blacksmith caching
@@ -223,7 +223,7 @@ jobs:
     runs-on: blacksmith-8vcpu-ubuntu-2204
     needs: build-setup
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Go with Blacksmith caching
@@ -256,7 +256,7 @@ jobs:
       - build-github-actions-staging
       - test
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: ${{ always() }}
         with:
           persist-credentials: false

.github/workflows/build-staging.yml

@@ -37,7 +37,7 @@ jobs:
           exit 1
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -61,7 +61,7 @@ jobs:
           echo "🏷️ Set VERSION: $VERSION"
 
       - name: Cache CLI tools (SC + Welder)
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v4.3.0 (Automatically uses Blacksmith cache on Blacksmith runners)
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0 (Automatically uses Blacksmith cache on Blacksmith runners)
         with:
           path: |
             ~/.local/bin/sc
@@ -90,7 +90,7 @@ jobs:
           echo "cicd-bot-telegram-chat-id=$(sc stack secret-get -s dist cicd-bot-telegram-chat-id)" >> $GITHUB_OUTPUT
 
       - name: Setup Docker Buildx with advanced caching
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
         with:
           driver-opts: |
             image=moby/buildkit:buildx-stable-1
@@ -106,7 +106,7 @@ jobs:
 
       - name: Build and push github-actions staging image
         id: build_gha_staging
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: .
           file: github-actions-staging.Dockerfile
@@ -115,13 +115,15 @@ jobs:
             simplecontainer/github-actions:staging
             simplecontainer/github-actions:${{ github.ref_name }}
           push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: |
+            type=gha,scope=staging-github-actions
+            type=gha,scope=prod-github-actions
+          cache-to: type=gha,mode=max,scope=staging-github-actions
           provenance: false
 
       - name: Build and push caddy staging image
         id: build_caddy_staging
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: .
           file: caddy.Dockerfile
@@ -130,8 +132,10 @@ jobs:
             simplecontainer/caddy:staging
             simplecontainer/caddy:${{ steps.version.outputs.version }}
           push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: |
+            type=gha,scope=staging-caddy
+            type=gha,scope=prod-caddy
+          cache-to: type=gha,mode=max,scope=staging-caddy
           provenance: false
 
       # Phase 2: sign + SBOM + SLSA provenance for staging images. Staging has
@@ -227,7 +231,7 @@ jobs:
     needs:
       - build-staging
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: ${{ always() }}
         with:
           persist-credentials: false

.github/workflows/codeql.yml

@@ -58,7 +58,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -67,13 +67,13 @@ jobs:
       # directive), which fails the compile and surfaces as a CI red
       # rather than a real finding (gemini round-1 P2).
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version-file: go.mod
           cache: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3  # v4.37.6
         with:
           languages: ${{ matrix.language }}
           # security-extended adds queries beyond the default "security
@@ -83,9 +83,9 @@ jobs:
           queries: security-extended
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4
+        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3  # v4.37.6
 
       - name: Perform analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3  # v4.37.6
         with:
           category: /language:${{ matrix.language }}

.github/workflows/coverage.yml

@@ -31,12 +31,12 @@ jobs:
       actions: read          # list + download the main baseline artifact
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Go (matching go.mod)
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version-file: go.mod
           cache: true

.github/workflows/dco.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout PR commits
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           # Pull enough history to walk back to the merge base. PRs
           # against main may sit on top of dozens of base-branch commits.

.github/workflows/fuzz.yml

@@ -63,12 +63,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version-file: go.mod
           # No build cache here — fuzz needs a clean, reproducible

.github/workflows/govulncheck.yml

@@ -81,7 +81,7 @@ jobs:
       GOGC: "25"
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -115,7 +115,7 @@ jobs:
 
       - name: Set up Go
         if: steps.gate.outputs.scan == 'true'
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version-file: go.mod
           cache: true