chore: pin GitHub Actions to commit SHAs (incl. Node 24 bumps)

[alanbem]

Summary

Two related CI hardening changes:

1. Bump flagged actions to Node 24 runtime majors — GitHub is deprecating the Node 20 runtime (runner default flips to Node 24 on 2026-06-16, Node 20 removed 2026-09-16). Bumped paths-filter v3→v4, gitleaks-action v2→v3, and the docker/* family (build-push v6→v7, setup-buildx/setup-qemu/login v3→v4, metadata v5→v6). All verified as runtime-only bumps (no behavioral changes; the deprecated inputs/envs dropped by v7/v4 are not used here).

2. Pin every action to a full commit SHA — protects against mutable-tag supply-chain attacks (a maintainer/account compromise re-pointing a tag at malicious code, cf. the tj-actions/changed-files incident, March 2025, where only SHA-pinned consumers were safe). Each pin carries a # vX.Y.Z comment so the existing github-actions Dependabot config keeps the SHAs updated — immutability without losing auto-updates.

All ~15 distinct actions (25 uses: lines) are now pinned, including GitHub-owned ones (checkout, codeql-action, setup-node) for a uniform, Scorecard-friendly policy.

Notes

• Versions reflect current majors; cosign-installer intentionally stays on v3 (not upgraded to v4 — out of scope for this PR).
• The residual transitive actions/cache Node 20 warning comes from inside the docker/* actions (not our YAML); it'll clear when Docker bumps their internal pin upstream.

Test plan

• CI green on this PR — confirms all pinned SHAs resolve and run correctly (Lint, Build and Scan, SAST, Secret Scanning, Trivy, Semgrep)

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated CI/CD pipeline tooling to latest stable versions with pinned revisions to enhance deployment reliability and security scanning capabilities.

[coderabbitai]

📝 Walkthrough

Walkthrough

The CI/CD workflow pins 15 GitHub Actions to specific commit SHAs, replacing floating major version references with immutable digests. The Semgrep job adds an explicit run step. All workflow job structure, triggers, environment variables, and build commands remain unchanged.

Changes

CI/CD Action Version Pinning

Layer / File(s)	Summary
Early validation jobs action pinning .github/workflows/ci-cd.yml	Docker change detection, Lint, and secret-scanning jobs pin actions/checkout, dorny/paths-filter, Hadolint, ShellCheck, and gitleaks/gitleaks-action to specific commit SHAs.
SAST and vulnerability scanning jobs action pinning .github/workflows/ci-cd.yml	Semgrep job adds explicit run step and pins actions/checkout and upload-sarif. Build-and-scan job pins docker/setup-buildx-action, docker/build-push-action, trivy-action, and upload-sarif to specific revisions.
Docker publish and release jobs action pinning .github/workflows/ci-cd.yml	Docker publish job pins actions/checkout, docker/setup-qemu-action, docker/setup-buildx-action, docker/login-action, docker/metadata-action, and docker/build-push-action v7.2.0. Cosign installer and Docker Hub description actions are pinned. NPM publish job pins actions/checkout and actions/setup-node v6.4.0.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

A rabbit hops through workflows bright,
Each action pinned with SHA's light,
No floating versions left to drift,
Just concrete commits—a security gift! 🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title references pinning GitHub Actions to commit SHAs and Node 24 bumps, which directly aligns with the PR's primary objective of updating CI/CD actions to Node 24 runtime versions and pinning them to commit SHAs for supply-chain security.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/bump-node24-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/ci-cd.yml (1)

80-153: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix CodeQL action tag label; Docker major-upgrade risk is unlikely

• docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 (v4.1.0) and docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf (v7.2.0) are pinned to SHAs that match their tags; the key v4/v7 breaking changes called out include deprecated DOCKER_BUILD_* envs/inputs, and ci-cd.yml doesn’t set any DOCKER_BUILD_* values.
• github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa doesn’t match the v4.36.0 tag object SHA; update the inline # v4.36.0 label or repin to the tag commit.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci-cd.yml around lines 80 - 153, The workflow uses a SHA
for github/codeql-action/upload-sarif that is mislabeled as "# v4.36.0"; update
the reference so the inline comment matches the actual commit or repin the
action to the official v4.36.0 tag (or replace the SHA with "v4.36.0") to
resolve the mismatch; leave the docker/setup-buildx-action and
docker/build-push-action pins as-is since their SHAs correspond to their v4/v7
labels and you are not using any deprecated DOCKER_BUILD_* inputs.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/ci-cd.yml:
- Around line 80-153: The workflow uses a SHA for
github/codeql-action/upload-sarif that is mislabeled as "# v4.36.0"; update the
reference so the inline comment matches the actual commit or repin the action to
the official v4.36.0 tag (or replace the SHA with "v4.36.0") to resolve the
mismatch; leave the docker/setup-buildx-action and docker/build-push-action pins
as-is since their SHAs correspond to their v4/v7 labels and you are not using
any deprecated DOCKER_BUILD_* inputs.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ef7bb30e-2b49-4797-915d-d2196624622b

📥 Commits

Reviewing files that changed from the base of the PR and between 40e89e1 and c5fc940.

📒 Files selected for processing (1)

• .github/workflows/ci-cd.yml