ci: add PR quality, security and build checks

.github/dependabot.yml

@@ -1,14 +1,17 @@
 version: 2
 updates:
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
   - package-ecosystem: "composer"
     directory: "/"
     schedule:
       interval: "weekly"
-  - package-ecosystem: "docker"
+  # Keeps the SHA-pinned actions in .github/workflows up to date.
+  - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/container.yml

@@ -0,0 +1,95 @@
+name: Container
+
+# Advisory: builds the application image the same way release.yml does
+# (same Dockerfile, buildah, linux/amd64, OCI) without pushing, then scans it
+# with Trivy. Only the application layer is verified: the build uses the
+# published builder-latest / runtime-latest base images (the Dockerfile
+# defaults), so changes to build/base/** and build/packages/** are not
+# covered here. Until release.yml has published the Wolfi base images and
+# moved builder-latest / runtime-latest to them, those tags still point at the
+# legacy Alpine/nginx images and this build is expected to fail.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  build:
+    name: Container build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    env:
+      # See the Trivy note in pr-checks.yml: official image pinned by digest
+      # instead of the (once tag-hijacked) trivy-action.
+      TRIVY_IMAGE: aquasec/trivy@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c  # 0.76.1
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      # A failing build is real breakage and fails the job.
+      - name: Build Cattr server
+        id: build
+        uses: redhat-actions/buildah-build@719e3c40d8af9790c23eca13f7daa339f2867034  # v3.1.0
+        with:
+          context: .
+          containerfiles: |
+            ./Dockerfile
+          image: server
+          tags: ci
+          # Same as release.yml: Cattr images are linux/amd64 only, OCI format.
+          arch: amd64
+          oci: true
+          build-args: |
+            APP_VERSION=0.0.0-ci
+          layers: true
+
+      - name: Export image
+        env:
+          IMAGE: ${{ steps.build.outputs.image-with-tag }}
+        run: |
+          set -euo pipefail
+          buildah push "${IMAGE}" "oci-archive:${RUNNER_TEMP}/image.tar"
+
+      # The scan is advisory: it never fails the job. Findings (HIGH/CRITICAL
+      # with an available fix) are written to the job summary.
+      - name: Scan image with Trivy
+        continue-on-error: true
+        run: |
+          set -euo pipefail
+
+          docker run --rm -v "${RUNNER_TEMP}:/scan" "${TRIVY_IMAGE}" \
+            image \
+            --input /scan/image.tar \
+            --scanners vuln \
+            --severity HIGH,CRITICAL \
+            --ignore-unfixed \
+            --format json \
+            --output /scan/trivy.json \
+            --exit-code 0 \
+            --no-progress
+
+          docker run --rm -v "${RUNNER_TEMP}:/scan" "${TRIVY_IMAGE}" \
+            convert --scanners vuln --format table --output /scan/trivy.txt /scan/trivy.json
+
+          cat "${RUNNER_TEMP}/trivy.txt"
+
+          {
+            echo '## Trivy image scan (advisory)'
+            echo
+            echo 'HIGH/CRITICAL vulnerabilities with an available fix:'
+            echo
+            echo '```'
+            cat "${RUNNER_TEMP}/trivy.txt"
+            echo '```'
+          } >> "${GITHUB_STEP_SUMMARY}"

.github/workflows/image-scan.yml

@@ -0,0 +1,83 @@
+name: Image scan
+
+# Scheduled Trivy scan of the published images. Wolfi packages in the base
+# images receive CVEs between releases; new alerts here signal that a
+# base-image rebuild (IMAGE_BUILD_REVISION / build/base/rebuild) is due.
+
+on:
+  schedule:
+    - cron: '27 5 * * 1'
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  scan:
+    name: Scan ${{ matrix.name }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write  # Upload SARIF to GitHub code scanning.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Latest stable application release (release.yml tags it `latest`).
+          - name: server
+            image: ghcr.io/cattr-app/server:latest
+          - name: server-runtime
+            image: ghcr.io/cattr-app/server-runtime:runtime-latest
+    env:
+      # See the Trivy note in pr-checks.yml: official image pinned by digest
+      # instead of the (once tag-hijacked) trivy-action.
+      TRIVY_IMAGE: aquasec/trivy@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c  # 0.76.1
+    steps:
+      # upload-sarif resolves the commit and ref from the checkout.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Scan image with Trivy
+        env:
+          IMAGE: ${{ matrix.image }}
+        run: |
+          set -euo pipefail
+
+          docker run --rm -v "${RUNNER_TEMP}:/scan" "${TRIVY_IMAGE}" \
+            image \
+            --image-src remote \
+            --scanners vuln \
+            --severity HIGH,CRITICAL \
+            --ignore-unfixed \
+            --format json \
+            --output /scan/trivy.json \
+            --exit-code 0 \
+            --no-progress \
+            "${IMAGE}"
+
+          docker run --rm -v "${RUNNER_TEMP}:/scan" "${TRIVY_IMAGE}" \
+            convert --format sarif --output /scan/trivy.sarif /scan/trivy.json
+
+          docker run --rm -v "${RUNNER_TEMP}:/scan" "${TRIVY_IMAGE}" \
+            convert --scanners vuln --format table --output /scan/trivy.txt /scan/trivy.json
+
+          {
+            echo "## Trivy scan of \`${IMAGE}\`"
+            echo
+            echo 'HIGH/CRITICAL vulnerabilities with an available fix:'
+            echo
+            echo '```'
+            cat "${RUNNER_TEMP}/trivy.txt"
+            echo '```'
+          } >> "${GITHUB_STEP_SUMMARY}"
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
+        with:
+          sarif_file: ${{ runner.temp }}/trivy.sarif
+          category: trivy-image-${{ matrix.name }}

.github/workflows/pages.yml

@@ -23,12 +23,12 @@ jobs:
       pages: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version-file: .nvmrc
 
@@ -40,13 +40,13 @@ jobs:
 
       - name: Configure GitHub Pages
         id: pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b  # v5.0.0
 
       - name: Build API and developer documentation
         run: pnpm build:pages
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b  # v4.0.0
         with:
           path: pages-dist
 
@@ -64,4 +64,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e  # v4.0.5