ci(security): harden container supply chain

[ty-everett]

Summary

Implements the container half of tracker #324 Wave 6 without publishing any image or npm artifact.

• register all seven release images and exact Linux/amd64 base inputs;
• pin Node bases and checked-in Compose/Kubernetes examples by readable version plus digest;
• remove release-time lockfile regeneration and mutable apk upgrade behavior;
• build and scan all service images in PR CI with blocking Trivy HIGH/CRITICAL gates;
• make GHCR releases build once, scan/SBOM that artifact, publish the exact reviewed image, attach SLSA/SPDX attestations, Cosign-sign it, and verify all evidence;
• apply trusted-source, scan, SBOM, digest, and GitHub-attestation gates to WAB Marketplace without assuming the Marketplace-controlled ECR accepts Cosign sidecar manifests;
• add Docker Dependabot ownership for Dockerfiles and every checked-in deployment-image directory;
• publish OpenSSF Scorecard SARIF on main, weekly, and repository-rule changes;
• add zero-install regression controls and operator verification/rollback documentation;
• keep SECURITY.md honest: npm SBOM/signing and automated license policy remain future tracker gates.

Security and release invariants

• no wildcard or deployment-edge/CORS/CSP behavior changes;
• no local macOS image publication;
• no registry mutation occurs until the exact local Linux image passes the vulnerability gate;
• version tags remain immutable and an existing release is skipped;
• manual releases must run from main; release tags must be reachable from main;
• release workflows use GitHub OIDC, least-privilege job permissions, SHA-pinned actions, and explicit post-publication verification.

Local validation

• pnpm health:check — 18/18 tests pass; 0 control errors
• pnpm build — pass
• pnpm lint — pass (existing warnings only)
• pnpm audit:security — no known vulnerabilities
• pnpm --filter docs-site validate — 94 frontmatter and link checks pass
• pnpm --filter docs-site build — pass
• changed YAML parse — pass
• git diff --check — pass
• isolated previously resource-contended SDK suite — 60/60 pass

The generic root pnpm test is not the repository CI contract: after the real suites it reaches the already-tracked example-paymail placeholder test script and exits 1. CI excludes that example and is authoritative here. Local OpenAPI codegen could not run because this Mac lacks uv; the pinned CI toolchain will perform it.

GitHub validation required before merge

• all seven Linux/amd64 image builds;
• all seven blocking Trivy scans;
• repository health, scoped build/lint/test, conformance, docs, CodeQL, SonarCloud, dependency review, and secret scanning;
• zero unresolved review threads and zero open security findings introduced by this PR.

Rollback

Revert this commit to restore the previous workflow and example references. No runtime image or package is published by merging this PR. Future deployed rollbacks must select a previously verified digest; published version tags are never moved.

Closes the container-specific portion of #324 Wave 6; npm artifact SBOM/signing and license enforcement remain tracked separately.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Addressed all 16 Sonar annotations from the first analysis in be1b28b8d:

• 14 mixed tag+digest FROM findings: runtime Dockerfiles are now digest-only, with the expected 24.18.0-alpine3.24 version governed and checked separately. A non-build governance/Dockerfile.container-bases gives Dependabot readable tag targets, while repository health requires the version, digest, and all runtime Dockerfiles to reconcile together. Actual digest-only Dockerfiles ignore bare node updates so Dependabot cannot accidentally resolve latest.
• Alpine package-order finding: build tool packages are alphabetized consistently.
• Scorecard permission finding: workflow-level read-all is replaced by explicit contents: read; the job retains only its required contents, id-token, and security-events permissions.

pnpm health:check remains 18/18 with 0 control errors, YAML parses, and git diff --check passes. The first GitHub run otherwise passed all 34 checks, including all seven Linux image builds and blocking Trivy scans, CodeQL, coverage, conformance, dependency review, docs, and merge gate. Re-running the full suite now against the remediation commit.

[ty-everett]

The second Sonar analysis reduced the new-code set from 16 findings to 1: the non-build Dependabot metadata Dockerfile's final dummy stage defaulted to root. 5123e652b sets USER node in both metadata stages. No suppression or analyzer-side change was used; repository health remains 18/18.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Maintainer merge decision (ty-everett): reviewed the complete change set and release/security design. All 36 checks pass. Sonar was remediated from 16 new findings to 1 to 0 without suppressions; CodeQL, Trivy (HIGH/CRITICAL including unfixed), dependency review, Socket, coverage, conformance, docs, image builds, and repository-health controls are green. There are no open review threads, inline comments, review requests, CodeQL alerts for this PR, secret-scanning alerts, or Dependabot security alerts. This PR publishes no image or npm artifact. GitHub rejected my explicit approval because authors cannot approve their own PR (Review Can not approve your own pull request), so I am applying the repository-authorized maintainer/admin merge path documented for this program.