security: fix 7 dep advisories + pin CI actions (drop exclusion)

.github/dependabot.yml

@@ -9,6 +9,12 @@ updates:
       day: monday
       time: "06:00"
     open-pull-requests-limit: 5
+    # Wait before adopting a just-published release — the window when a
+    # compromised/backdoored version is live before it's caught and yanked.
+    # Patches move faster (usually the security fixes we want promptly).
+    cooldown:
+      default-days: 7
+      semver-patch-days: 2
     groups:
       # Weekly version updates (Monday 06:00 UTC, per schedule above).
       prod-deps:
@@ -53,6 +59,10 @@ updates:
       day: monday
       time: "06:00"
     open-pull-requests-limit: 3
+    # Same rationale as the npm cooldown above — don't adopt a just-published
+    # (possibly compromised) action release immediately.
+    cooldown:
+      default-days: 7
     labels:
       - dependencies
       - github-actions

.github/workflows/ci.yml

@@ -22,13 +22,13 @@ jobs:
       pull-requests: read
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # Full history so gitleaks can scan the diff vs. main, not just HEAD
           fetch-depth: 0
 
       - name: gitleaks
-        uses: gitleaks/gitleaks-action@v3
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -38,8 +38,8 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 20
           cache: npm
@@ -81,9 +81,9 @@ jobs:
       NEXT_PUBLIC_APP_URL: http://localhost:3000
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 20
           cache: npm
@@ -117,10 +117,10 @@ jobs:
     timeout-minutes: 20
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Deploy via SSH
-        uses: appleboy/ssh-action@v1
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1
         with:
           host: ${{ secrets.DEPLOY_HOST }}
           username: ${{ secrets.DEPLOY_USER }}

.github/workflows/codeql.yml

@@ -26,19 +26,19 @@ jobs:
       security-events: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
         with:
           languages: javascript-typescript
           # Default queries only — security-extended adds noise.
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
         with:
           category: "/language:javascript-typescript"

.github/workflows/db-backup.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Dump and rotate via SSH
-        uses: appleboy/ssh-action@v1
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1
         with:
           host: ${{ secrets.DEPLOY_HOST }}
           username: ${{ secrets.DEPLOY_USER }}

.github/workflows/semgrep.yml

@@ -32,25 +32,17 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Run Semgrep
         run: |
-          # Excluded rules are CI-config best-practices, not application security,
-          # and they fail the whole-repo main scan on accepted tradeoffs (PR diff
-          # scans don't hit them). Same posture as the npm-audit allowlist.
-          #   - mutable-action-tag: we use `@vN` action tags, not SHA pins
-          #     (Dependabot keeps them current); revisit if we adopt SHA pinning.
-          #   - dependabot-missing-cooldown: no cooldown configured by choice.
           semgrep ci \
             --config p/javascript \
             --config p/typescript \
             --config p/nextjs \
             --config p/react \
             --config p/owasp-top-ten \
             --config p/secrets \
-            --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag \
-            --exclude-rule package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown \
             --sarif \
             --output=semgrep.sarif
         env:
@@ -65,6 +57,6 @@ jobs:
 
       - name: Upload SARIF to GitHub Security
         if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
         with:
           sarif_file: semgrep.sarif