ci: Hardening; add actionlint, osv-scanner, harden other workflows

.github/renovate.json

@@ -5,6 +5,7 @@
     "config:js-lib",
     "github>maxmilton/renovate-config",
     "github>maxmilton/renovate-config:auto",
+    "github>maxmilton/renovate-config:manual",
     "schedule:monthly"
   ]
 }

.github/workflows/actionlint.yml

@@ -0,0 +1,77 @@
+name: actionlint
+
+on:
+  push:
+    branches:
+      - master
+      - next
+    paths:
+      - ".github/**"
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Install ShellCheck
+        env:
+          # renovate: depName=koalaman/shellcheck
+          SHELLCHECK_VERSION: v0.11.0
+          SHELLCHECK_SHA256: 8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198
+        run: |
+          tool_dir="$RUNNER_TEMP/shellcheck"
+          mkdir -p "$tool_dir"
+          curl --fail --silent --show-error --location --retry 3 \
+            "https://github.com/koalaman/shellcheck/releases/download/$SHELLCHECK_VERSION/shellcheck-$SHELLCHECK_VERSION.linux.x86_64.tar.xz" \
+            --output "$tool_dir/archive.tar.xz"
+          printf '%s  %s\n' "$SHELLCHECK_SHA256" "$tool_dir/archive.tar.xz" | sha256sum --check --strict
+          tar -xJf "$tool_dir/archive.tar.xz" -C "$tool_dir" --strip-components=1 \
+            "shellcheck-$SHELLCHECK_VERSION/shellcheck"
+          echo "$tool_dir" >> "$GITHUB_PATH"
+          "$tool_dir/shellcheck" --version
+      - name: Install actionlint
+        env:
+          # renovate: depName=rhysd/actionlint
+          ACTIONLINT_VERSION: v1.7.12
+          ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
+        run: |
+          tool_dir="$RUNNER_TEMP/actionlint"
+          version="${ACTIONLINT_VERSION#v}"
+          mkdir -p "$tool_dir"
+          curl --fail --silent --show-error --location --retry 3 \
+            "https://github.com/rhysd/actionlint/releases/download/$ACTIONLINT_VERSION/actionlint_${version}_linux_amd64.tar.gz" \
+            --output "$tool_dir/archive.tar.gz"
+          printf '%s  %s\n' "$ACTIONLINT_SHA256" "$tool_dir/archive.tar.gz" | sha256sum --check --strict
+          tar -xzf "$tool_dir/archive.tar.gz" -C "$tool_dir" actionlint
+          echo "$tool_dir" >> "$GITHUB_PATH"
+          "$tool_dir/actionlint" -version
+          curl --fail --silent --show-error --location --retry 3 \
+            https://raw.githubusercontent.com/rhysd/actionlint/main/.github/actionlint-matcher.json \
+            --output "$RUNNER_TEMP/actionlint-matcher.json"
+      - run: pipx install "ruff==${RUFF_VERSION}"
+        env:
+          # renovate: datasource=pypi depName=ruff
+          RUFF_VERSION: 0.17.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Check workflow files
+        run: |
+          echo "::add-matcher::$RUNNER_TEMP/actionlint-matcher.json"
+          actionlint -color -verbose -shellcheck shellcheck -pyflakes 'ruff check --isolated --select F,B,UP,SIM,PERF,RUF --output-format concise --stdin-filename "<stdin>" -'
+      # TODO: Uncomment once we have npm publishing automation script/s.
+      # - run: shellcheck --norc -a .github/scripts/*.sh

.github/workflows/audit.yml

@@ -10,7 +10,6 @@ on:
       - "bun.lock"
       - "package.json"
   pull_request:
-  merge_group:
   workflow_dispatch:
   schedule:
     - cron: "23 21 * * 3"
@@ -21,17 +20,21 @@ concurrency:
 
 permissions: {}
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   audit:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: .bun-version
       - run: bun audit
@@ -42,10 +45,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: .bun-version
       - name: Enable bun security scanner
@@ -60,10 +63,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: .bun-version
       - run: bun dedupe --check

.github/workflows/ci.yml

@@ -22,15 +22,15 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: .bun-version
       - run: bun install --frozen-lockfile
       - run: bun run build
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: build
           path: |
@@ -51,21 +51,21 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: build
           path: packages
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: .bun-version
       - run: bun install --frozen-lockfile
       - run: bun run test:ci --coverage-reporter=text --coverage-reporter=lcov
       - name: Report coverage
         if: ${{ matrix.platform == 'ubuntu-latest' && github.repository_owner == 'maxmilton' }}
-        uses: qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2
+        uses: qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2.4.0
         with:
           oidc: true
           files: coverage/lcov.info
@@ -96,17 +96,17 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: build
           path: packages
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: .bun-version
       - run: bun install --frozen-lockfile
@@ -116,7 +116,7 @@ jobs:
         if: ${{ matrix.node-version == 26 && matrix.platform == 'ubuntu-latest' }}
       - name: Report coverage
         if: ${{ matrix.platform == 'ubuntu-latest' && github.repository_owner == 'maxmilton' }}
-        uses: qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2
+        uses: qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2.4.0
         with:
           oidc: true
           files: coverage/lcov.info
@@ -129,10 +129,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
-      contents: read
       id-token: write
     steps:
-      - uses: qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2
+      - name: Report coverage complete
+        uses: qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2.4.0
         if: ${{ github.repository_owner == 'maxmilton' }}
         with:
           oidc: true
@@ -145,14 +145,14 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: build
           path: packages
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: .bun-version
       - run: bun install --frozen-lockfile

.github/workflows/codeql.yml

@@ -9,16 +9,23 @@ on:
   merge_group:
   workflow_dispatch:
   schedule:
-    - cron: "28 6 * * 4"
+    - cron: "25 14 * * 3"
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.head.label || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions: {}
 
 jobs:
   analyze:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+          - language: javascript-typescript
+            packs: githubsecuritylab/codeql-javascript-queries
     name: analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -27,25 +34,18 @@ jobs:
       contents: read
       packages: read
       security-events: write
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: actions
-          - language: javascript-typescript
-            # https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/blob/main/configs/synthetics.yml
-            packs: githubsecuritylab/codeql-javascript-queries
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: ${{ matrix.language }}
           build-mode: none
           queries: security-and-quality
+          # https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/blob/main/configs/synthetics.yml
           packs: ${{ matrix.packs }}
           # https://docs.github.com/en/code-security/reference/code-scanning/workflow-configuration-options#extending-codeql-coverage-with-threat-models
           config: |
             threat-models: local
-      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3

.github/workflows/osv-scanner.yml

@@ -0,0 +1,58 @@
+name: osv-scanner
+
+on:
+  push:
+    branches:
+      - master
+      - next
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: "25 14 * * 3"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions: {}
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # Runs the binary directly, bypassing the image's exit_code_redirect.sh
+      # (raw exit codes, no 128→0 rewrite).
+      # Gating: PRs → "Require code scanning results" ruleset (tool: osv-scanner);
+      # push → upload only (refreshes alerts + ruleset base); schedule/dispatch → fail on vulns.
+      - name: Scan
+        id: scan
+        env:
+          OSV_IMAGE: ghcr.io/google/osv-scanner-action:v2.7.0@sha256:d54770fe0b09493894e76a02aaed9f51a0513fa57c5186452a755d257b0068a6
+        run: |
+          out="$RUNNER_TEMP/osv"
+          mkdir -p "$out"
+          rc=0
+          docker run --rm -e GOTOOLCHAIN=auto \
+            -v "$GITHUB_WORKSPACE:/github/workspace:ro" -w "/github/workspace" \
+            -v "$out:/out" \
+            --entrypoint /root/osv-scanner "$OSV_IMAGE" \
+            --include-git-root \
+            --x-flag-deprecated-packages \
+            --format=sarif --output=/out/results.sarif -r . || rc=$?
+          echo "rc=$rc" >> "$GITHUB_OUTPUT"
+          [ "$rc" -le 1 ] || { echo "::error::osv-scanner exited $rc (127=error, 128=no packages, 129=OSV API failure, 130=invalid config; 125-127 may also be docker)"; exit "$rc"; }
+      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          sarif_file: ${{ runner.temp }}/osv/results.sarif
+          category: osv-scanner
+      - name: Fail on vulnerabilities
+        if: steps.scan.outputs.rc == '1' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+        run: exit 1