v1.6.3 - The image Trivy scans is the image you pull

A hardening release for the CI and the published image. The application itself is unchanged.

Upgrading

Nothing to do. There is no migration, and environment variables, port and the Alpine image base are unchanged. If you deployed from the Docker Hub quick start, consider the new loopback port binding described below.

Security

• The published image is the scanned image. Trivy kept its database inside the build context, so the push step rebuilt next build after the scan and published layers the scan never saw. The database now lives outside the context, and the workflow fails if the pushed layers differ from the scanned ones. The 1.6.2 image was rescanned by hand after its release: 0 findings.
• SBOM. Release images now carry an SBOM attestation next to the build provenance: docker buildx imagetools inspect whitemuush/gardik:1.6.3 --format '{{ json .SBOM }}'.
• Daily image scan. The latest image is rescanned every day; findings land in the repository's Security tab.
• Pinned actions. Every GitHub Action is pinned to a commit SHA, and the repository refuses unpinned ones.
• Quick start. The Docker Hub example now publishes 127.0.0.1:3000:3000 instead of 3000:3000, which listened on every interface in plain HTTP and bypassed host firewalls such as ufw. It also drops every Linux capability and sets no-new-privileges.

CI

• The required ci gate now fails whenever one of its jobs fails, instead of being skipped.
• The Next.js build cache is kept between runs (build step from about 37 s to 8 s).