[julianknutsen]

Fixes the actionable OpenSSF Scorecard code-scanning alerts in this repo. No GHSA/CVE IDs: these are Scorecard supply-chain hardening findings.

Alerts fixed

• TokenPermissions (top-level write): ci: move workflows to Blacksmith runners #14 (codeql.yml security-events), docs: sync org TESTING.md testing standard #17 (image.yml packages), feat(auth): SSO-asserted registry-staff role → registry admin #26 (promote.yml packages), feat(auth): GitHub-only product login + /staff SSO entry (kc_idp_hint) #27 (update-registry.yml actions), ci: publish main-<epoch> + apex-main-<epoch> tags for Flux auto-bump #28 (update-registry.yml contents). Each write scope now sits on the job that uses it; the workflow top level is read-only. Job permissions are unchanged in effect.
• PinnedDependencies, actions: fix(ci): authenticate registry auto-update to GitHub Packages (+ refresh catalog) #18-harden(registry): gate publish approval on proven source-repo ownership #24 (image.yml). actions/checkout and the docker/* actions are pinned to full commit SHAs at the latest release of the major version already in use (checkout v4.4.0, setup-buildx v3.12.0, login v3.7.0, metadata v5.10.0, build-push v6.19.2). The open Dependabot major-bump PRs (chore(deps): bump docker/build-push-action from 6 to 7 #29-chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 #32, chore(deps): bump docker/metadata-action from 5 to 6 #40) will need a rebase after this.
• PinnedDependencies, containerImage: feat: registry on the shared @gascity/shell chrome (B1) #11, ci: authenticate to GitHub Packages for @gascity/* (fix red CI) #13, chore(deps): bump docker/login-action from 3 to 4 #30 (Dockerfile). golang:1.26.10-alpine and oven/bun:1.4.4 / oven/bun:1.4.4-alpine are pinned by digest. 1.4.4 is what oven/bun:1 resolves to today (same digests) and what CI tests since ci: test on Bun 1.4.4, the Bun that ships (eMudhra CA compromise) #614. Dependabot now tracks the docker ecosystem so the digests keep getting bumped.

Test

scripts/supply-chain-pins.test.ts runs as part of test:unit. It fails if a workflow has a top-level write permission, a non-local action isn't pinned to a 40-hex SHA, or a Dockerfile base image has no @sha256: digest. Against origin/main it fails 6 tests, one per alert group above. With this change it passes.

Verified locally

• bun run test:unit: 480 pass, 0 fail
• bun run typecheck and bun run generate:check are clean
• actionlint shows no new findings. The only output is the existing runner-label and SC2129 notes.
• docker build of the full Dockerfile succeeds with the pinned digests, and the image runs Bun 1.4.4

Not in this PR (process/false-positive items, see the triage report): #7 CodeReview, #8 CII badge, #9 Fuzzing, and the CodeQL js/insufficient-password-hash alerts #1 and #10. Those two are false positives: they flag SHA-256 over 256-bit random API/session tokens and an HMAC over signed state.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[gascity-eddie]

This PR has been added to the review queue.

Track progress: https://factory.gascity.com/city/maintainer-city/runs/gcg--9223372036837046432

[julianknutsen]

Max-effort review: approve and merge

Verdict: clean. This PR fixes all 15 targeted Scorecard alerts and introduces no new ones. Every job's effective token is unchanged, and all pins resolve to exactly what the floating refs gave yesterday, so CI and the shipped image behave identically. I pushed two commits (listed below) and found no blocking defects. All checks are green on the final head 557b311: verify, CI / required, image, and CodeQL for actions and JS/TS. CI ran 483 unit, 169 Postgres and 33 Playwright tests.

Alerts

• The live list has exactly the 15 targeted alerts open: feat: registry on the shared @gascity/shell chrome (B1) #11, ci: authenticate to GitHub Packages for @gascity/* (fix red CI) #13, ci: move workflows to Blacksmith runners #14, docs: sync org TESTING.md testing standard #17, fix(ci): authenticate registry auto-update to GitHub Packages (+ refresh catalog) #18-harden(registry): gate publish approval on proven source-repo ownership #24, feat(auth): SSO-asserted registry-staff role → registry admin #26-ci: publish main-<epoch> + apex-main-<epoch> tags for Flux auto-bump #28 and chore(deps): bump docker/login-action from 3 to 4 #30. There are 0 open Dependabot and 0 secret-scanning alerts.
• I built Scorecard v5.3.0, the version ossf/scorecard-action@v2.4.3 pins, and ran it locally with the action's default policy.yml (Token-Permissions and Pinned-Dependencies):
  • main: 15 SARIF results, at the same files and lines as the open alerts.
  • this branch: 0 results. Both rules are still present in the run, so GitHub will mark all 15 as fixed on the next Scorecard run.
• Token-Permissions still logs job-level Warns for promote.yml (packages), update-registry.yml (contents and actions). The check still scores 10 because only top-level writes reduce the score. SARIF only emits results for checks below the policy's 10, so these produce no new alerts.

Permissions, traced per job

Each of the four workflows has a single job, and a job-level permissions block replaces the workflow-level one. So the effective GITHUB_TOKEN of every job is identical to before. The token block in the update-registry run log already shows exactly these scopes.

Job	Scope	Used by
update-registry/update	contents: write	checkout, git push --force (built-in-token path), gh pr close --delete-branch, gh pr merge
	pull-requests: write	gh pr list/create/close/merge
	actions: write	gh workflow run ci.yml (built-in-token path), gh run list/watch
	packages: read	bun install of @gascity/* via NODE_AUTH_TOKEN
promote/promote	contents: read	gh api .../commits/main, .../commits/$SHA
	actions: read	gh api .../actions/workflows/{ci,image,production-smoke}.yml/runs
	packages: write	docker login ghcr.io and buildx imagetools create (re-tag)
image/image	contents: read	checkout, metadata-action repo lookup
	packages: write	login and push to GHCR; the BuildKit gh_token secret reads @gascity/*
codeql/analyze	security-events: write	CodeQL SARIF upload
	contents: read, actions: read	checkout; actions: read is only required on private repos (harmless)

Pins

• Actions: checked with git ls-remote and GraphQL. Every SHA is a commit in the canonical repo and is the target of its claimed tag: checkout v4.4.0 11d5960, setup-buildx v3.12.0 8d2750c, login v3.7.0 c94ce9f, metadata v5.10.0 c299e40, build-push v6.19.2 10e90e3. Each is the latest release of its major version, and the floating v4/v3/v5/v6 tags point at the same commits today.
• Images: each digest equals what its tag resolves to now, and each is an OCI image index (multi-arch, not a single-platform manifest):
  • golang:1.26.10-alpine covers amd64, arm64 and 6 more platforms. It equals golang:1.26-alpine.
  • oven/bun:1.4.4 and oven/bun:1.4.4-alpine cover amd64 and arm64. They are identical to what oven/bun:1, 1-alpine, latest and alpine resolve to today.
  • The images report Bun 1.4.4 and Go 1.26.10.
• dependabot.yml: validates against the SchemaStore dependabot-2.0 schema.

Verification (local, Bun 1.4.4 taken from the pinned image)

• I built both Docker variants from scratch (--pull --no-cache), standalone and apex (REGISTRY_WEB_BASE=/registry/). Every FROM resolved by digest, and the apex grep guard passed.
• CI's image smoke passes on both, and both images boot against Postgres. On the standalone image, /api/me returns authConfigured: true, devAuthEnabled: false and store: "postgres", the same assertion Production Smoke makes.
• I ran the full ci.yml verify sequence on main merged into this branch:
  • bun install --frozen-lockfile, bun audit (clean), generate:check, typecheck, build and openapi:check all pass.
  • test:unit: 480 pass, 483 after my commit.
  • Real-Postgres tier: 169 pass.
  • CLI e2e with the real gc from the built image: 1 pass.
  • Playwright: 33 pass.
• The new guard fails exactly 6 tests against main's workflows and Dockerfile, one per alert group, and passes here.
• actionlint reports the same 9 pre-existing findings (runner labels and SC2129) on main and here.
• CodeQL on the PR merge ref (actions and JS/TS) has 0 results.

Commits I pushed (fast-forward)

1. Merge origin/main: brings in chore(deps): raise the nanoid override to ^3.3.20 #615, which strict up-to-date protection requires. No conflicts.
2. test(ci): cover reusable workflows and docker:// digests in the pin guard (Low):
   • The guard only read step-level uses:, so an unpinned reusable workflow (jobs.<id>.uses: org/repo/.github/workflows/x.yml@main) passed it, even though Scorecard flags one (checks/raw/pinned_dependencies.go:770).
   • It also rejected two forms that are correctly pinned: docker://image@sha256:… and FROM scratch.
   • The detection now lives in unpinnedActions and unpinnedBaseImages, with fixture tests. A mutation harness confirms the old catches still fire.

Follow-ups (not blocking)

• Dependabot chore(deps): bump docker/build-push-action from 6 to 7 #29, chore(deps): bump docker/login-action from 3 to 4 #30, chore(deps): bump docker/setup-buildx-action from 3 to 4 #31, chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 #32 and chore(deps): bump docker/metadata-action from 5 to 6 #40 all merge cleanly today but conflict in image.yml after this PR. I'll ask Dependabot to rebase them, and it will regenerate them as SHA-pinned bumps. chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 #32 also leaves a stale # v6 comment on the 3d3c42e (v7.0.1) SHA in the other workflows.
• The hourly aggregate refresh is broken (pre-existing, unrelated). update-registry.yml has failed every hourly run since 2026-10-24 18:28 UTC (11 in a row as of 04:28 UTC today). Right after the force-push, gh pr checks "$pr" --watch --fail-fast runs before any check exists on the new head. It exits 1 with "no checks reported", so the green refresh PR chore: update aggregate registry #617 is never merged. It needs a short wait or retry before the watch.
• Bun drift. Dependabot docker can now bump the Dockerfile's Bun ahead of bun-version: "1.4.4" in ci.yml and update-registry.yml. That is visible in the diff, which is better than the old silent oven/bun:1 float, but CI wouldn't fail. A small guard that keeps the two equal would enforce ci: test on Bun 1.4.4, the Bun that ships (eMudhra CA compromise) #614's "test the Bun that ships" invariant.
• Info:
  • # syntax=docker/dockerfile:1 is still a floating frontend reference. It isn't a Scorecard finding.
  • PR runs of image.yml hold packages: write but only need read. This predates the PR.

🤖 Generated with Claude Code