ci: apply the repo standard and separate scan failures from findings (EN-214)

.github/CODEOWNERS

@@ -1,3 +1,4 @@
+* @UnlockedLabs/reviewers
 backend/**/* @UnlockedLabs/reviewers 
 config/**/* @UnlockedLabs/reviewers
 frontend/**/* @UnlockedLabs/reviewers

.github/PULL_REQUEST_TEMPLATE.md

@@ -6,6 +6,7 @@
 - [ ] Functions according to **ticket specifications**
 - [ ] Tested manually where applicable
 - [ ] Branch rebased with latest main
+- [ ] PR title and every commit are conventional commits (`feat:`, `fix:`, `docs:`...); a squash merge lands under the PR title
 - [ ] No business logic exists within the database layer
 - [ ] DB migrations (if any) are backward-compatible and online-safe — see [Database Migrations](https://github.com/UnlockedLabs/unlocked-core/blob/main/CONTRIBUTING.md#database-migrations) in CONTRIBUTING.md
 
@@ -15,6 +16,11 @@ Please provide a brief description of the changes included in this PR.
 
 - **Related issues**: Link to related JIRA ticket that this closes.
 
+## Release
+
+- **Changelog type**: `feat` (minor bump), `fix` (patch bump), or none (`chore`, `docs`, `ci`, `test`, `refactor`).
+- **Breaking change?**: yes / no. If yes, add `!` to the title (`feat!:`). For a merge or rebase merge, also add `!` to a breaking commit subject. List what consumers must change.
+
 ## Screenshot(s)
 
 If the PR includes changes to the UI:

.github/scan-result.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Classify a dependency scan: clean, vulnerabilities_found or scan_failed.
+# Usage: scan-result.sh <go|yarn> <exit-code> [yarn-output-file]
+set -uo pipefail
+
+tool="${1:-}"
+code="${2:-}"
+out="${3:-}"
+
+case "$code" in
+  ''|*[!0-9]*) echo scan_failed; exit 0 ;;
+esac
+
+case "$tool" in
+  go)
+    # govulncheck: 0 clean, 3 vulnerabilities, anything else is a tool or network failure
+    case "$code" in
+      0) echo clean ;;
+      3) echo vulnerabilities_found ;;
+      *) echo scan_failed ;;
+    esac
+    ;;
+  yarn)
+    # yarn 1 exits with a bitmask (8 high, 16 critical, lower bits set whatever --level says)
+    if [ "$code" -gt 31 ]; then
+      echo scan_failed
+    elif [ "$code" -eq 0 ]; then
+      echo clean
+    elif [ $((code & 24)) -ne 0 ]; then
+      echo vulnerabilities_found
+    elif [ -f "$out" ] && grep -q 'Packages audited' "$out"; then
+      echo clean
+    else
+      echo scan_failed
+    fi
+    ;;
+  *) echo scan_failed ;;
+esac

.github/scan-result_test.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+here="$(cd "$(dirname "$0")" && pwd)"
+script="$here/scan-result.sh"
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+
+completed="$tmp/completed.txt"
+failed="$tmp/failed.txt"
+printf '188 vulnerabilities found - Packages audited: 493\n' > "$completed"
+printf 'error An unexpected error occurred: "getaddrinfo ENOTFOUND"\n' > "$failed"
+
+fails=0
+check() {
+  local want="$1"; shift
+  local got
+  got="$("$script" "$@" 2>/dev/null)"
+  if [ "$got" != "$want" ]; then
+    echo "FAIL: scan-result.sh $* -> '$got', want '$want'"
+    fails=$((fails + 1))
+  fi
+}
+
+check clean go 0
+check vulnerabilities_found go 3
+for code in 1 2 4 127 137 255 abc ""; do
+  check scan_failed go "$code"
+done
+
+check clean yarn 0 "$completed"
+check vulnerabilities_found yarn 8 "$completed"
+check vulnerabilities_found yarn 16 "$completed"
+check vulnerabilities_found yarn 24 "$completed"
+check vulnerabilities_found yarn 30 "$completed"
+check vulnerabilities_found yarn 31 "$completed"
+check vulnerabilities_found yarn 8 "$failed"
+check vulnerabilities_found yarn 8 "$tmp/missing.txt"
+check vulnerabilities_found yarn 9 "$completed"
+for code in 1 2 4 6 7; do
+  check clean yarn "$code" "$completed"
+  check scan_failed yarn "$code" "$failed"
+  check scan_failed yarn "$code" "$tmp/missing.txt"
+done
+for code in 32 127 137 255 abc ""; do
+  check scan_failed yarn "$code" "$completed"
+done
+check scan_failed yarn 1
+check scan_failed rust 0
+
+if [ "$fails" -ne 0 ]; then
+  echo "$fails failed"
+  exit 1
+fi
+echo "all passed"

.github/workflows/add-needs-verification-label.yml

@@ -21,7 +21,7 @@ jobs:
 
       - name: Add Needs Verification Label
         if: ${{ env.is_moved }} == 1
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
         with:
           script: |
             const { owner, repo } = context.repo;

.github/workflows/container_builds.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Check duplicate migration files
         run: |
@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set Image Version
         run: |
@@ -60,18 +60,18 @@ jobs:
           fi
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
           aws-region: us-west-2
           mask-aws-account-id: true
 
       - name: Log in to Amazon ECR
         id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v2
+        uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2
 
       - name: Expose GitHub runtime for the build cache
         uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124 # v3.1.0
@@ -132,7 +132,7 @@ jobs:
           permission-contents: write
 
       - name: Checkout unlocked-platform
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           repository: UnlockedLabs/unlocked-platform
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/conventional-commits.yml

@@ -0,0 +1,43 @@
+# Every commit on a branch must be a conventional commit: release-please builds
+# versions and the changelog from commit subjects. Merge commits are skipped.
+# Same check as the other UnlockEd repos (see docs/repo-standard.md in
+# unlocked-core).
+name: conventional commits
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+
+permissions:
+  contents: read
+
+jobs:
+  commits:
+    name: conventional commits
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Check commit subjects
+        env:
+          BASE: ${{ github.event.pull_request.base.sha }}
+          HEAD: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          # the loop reads git log through process substitution, so a bad range would pass silently
+          git rev-list "$BASE..$HEAD" > /dev/null
+          pattern='^(feat|fix|chore|docs|refactor|test|ci|build|perf|revert|style)(\([a-z0-9._/-]+\))?!?: .+'
+          bad=0
+          while IFS= read -r subject; do
+            if ! printf '%s' "$subject" | grep -Eq "$pattern"; then
+              echo "::error::not a conventional commit: $subject"
+              if [[ $subject == 'Revert "'* ]]; then
+                inner=${subject#Revert \"}
+                echo "::error::reword it to: revert: ${inner%\"}"
+              fi
+              bad=1
+            fi
+          done < <(git log --no-merges --format=%s "$BASE..$HEAD")
+          exit $bad

.github/workflows/eslint.yml

@@ -2,13 +2,16 @@ name: Run ESLint and build frontend
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   frontend:
     name: Lint and build JS
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
           cache: 'yarn'

.github/workflows/go_test.yml

@@ -2,14 +2,16 @@ name: Go Tests
 on:
   pull_request:
     branches: ["main", "release/**"]
+permissions:
+  contents: read
 jobs:
   tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: "1.26.10"
 

.github/workflows/golint.yml

@@ -15,8 +15,8 @@ jobs:
     outputs:
       modules: ${{ steps.set-modules.outputs.modules }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: ${{ env.GO_VERSION }}
       - id: set-modules
@@ -31,12 +31,12 @@ jobs:
       matrix:
         modules: ${{ fromJSON(needs.detect-modules.outputs.modules) }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: golangci-lint ${{ matrix.modules }}
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8
         with:
           version: ${{ env.GOLANGCI_LINT_VERSION }}
           working-directory: ${{ matrix.modules }}

.github/workflows/labeler.yml

@@ -9,4 +9,4 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5

.github/workflows/pr-title.yml

@@ -1,10 +1,9 @@
-name: PR title
-
 # Squash and merge lands a multi-commit PR on main under its title, so the
-# title must be a conventional commit too (commit.yml checks the commits).
-# Same check as unlocked-hiset-ai (EN-214). When release-please is added here
-# (EN-181), run it with the release bot's app token, as unlocked-hiset-ai
-# does, so its release PRs start this check.
+# title must be a conventional commit too. The "conventional commits" job in
+# conventional-commits.yml checks the commits; keep the two patterns in sync. Same check as
+# the other UnlockEd repos (see docs/repo-standard.md in unlocked-core).
+name: pr title
+
 on:
   pull_request:
     types: [opened, edited, reopened, synchronize]
@@ -25,5 +24,9 @@ jobs:
           pattern='^(feat|fix|chore|docs|refactor|test|ci|build|perf|revert|style)(\([a-z0-9._/-]+\))?!?: .+'
           if ! printf '%s' "$TITLE" | grep -Eq "$pattern"; then
             echo "::error::PR title is not a conventional commit: $TITLE"
+            if [[ $TITLE == 'Revert "'* ]]; then
+              inner=${TITLE#Revert \"}
+              echo "::error::rename the PR to: revert: ${inner%\"}"
+            fi
             exit 1
           fi

.github/workflows/project-status-update.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set project item to "In Review"
         env: