Score-driven hardening: least-privilege tokens + checksummed Trivy

[wnstfy]

Summary

Two targeted fixes for the OpenSSF Scorecard findings that were driving us to 6.9:

Token-Permissions (0 → 10 expected)

weekly-audit.yml had contents: write + pull-requests: write at workflow level. Scorecard wants top-level minimal so a future job added without an explicit permissions block can't accidentally inherit write. Moved both write permissions to the job level (only the scan job actually needs them — peter-evans/create-pull-request pushes the branch and opens the PR).

Pinned-Dependencies (6 → 10 expected)

All three workflows installed Trivy via curl .../install.sh | sudo sh. Scorecard flagged this as "downloadThenRun not pinned by hash" because only the URL path was version-tagged — the script content itself wasn't verified. Replaced with the same pattern we use for actionlint: pinned tarball URL + SHA256 checksum verification + tar + install.

env:
  TRIVY_VERSION: '0.70.0'
  TRIVY_SHA256: '8b4376d5d6befe5c24d503f10ff136d9e0c49f9127a4279fd110b727929a5aa9'
run: |
  curl -sfLo trivy.tgz "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
  echo "${TRIVY_SHA256}  trivy.tgz" | sha256sum -c -
  tar -xzf trivy.tgz trivy
  sudo install -m 755 trivy /usr/local/bin/trivy

Three workflows updated (pr-cve-gate, pr-misconfig-scan, weekly-audit).

Not addressed (yet)

• Branch-Protection (currently -1 / "not measured" due to token scope) — needs a fine-grained PAT. Separate follow-up; instructions below.
• CII-Best-Practices — self-assessment at https://www.bestpractices.dev/. ~1-2 hours of forms for Bronze.
• Code-Review, Contributors, Fuzzing — structural to a solo OSS templates repo. Not realistic targets.

Expected score after merge

8.5–9.0, depending on weights. Scorecard re-runs on push to main, but the badge cache can take a few hours to refresh.

Test plan

• actionlint clean (already verified locally before push)
• scan check passes trivially (no compose changes)
• After merge, Scorecard runs on push trigger and the next API call reports Token-Permissions 10 + Pinned-Dependencies 10

Branch-Protection fix (follow-up — needs your action)

The error "some github tokens can't read classic branch protection rules" means the default token can't see branch protection. Fix:

1. Create a fine-grained PAT at https://github.com/settings/personal-access-tokens/new
   • Resource owner: you / wnstify
   • Repository access: only wnstify/docker
   • Permissions: Administration: Read-only, Contents: Read-only, Pull requests: Read-only, Metadata: Read-only (auto)
   • Expiration: 1 year (set a calendar reminder to rotate)
2. Add the token as a repo secret named SCORECARD_TOKEN at Settings → Secrets and variables → Actions
3. Tell me you've added it; I'll open the workflow PR to reference the token (one-line change)

That alone should land another +1.0 on the average.

[github-actions]

Trivy misconfiguration findings (HIGH + CRITICAL)

Findings below. Fix the issue or add an ignore entry to .trivyignore with a justification.

Report Summary

┌────────┬──────┬───────────────────┐
│ Target │ Type │ Misconfigurations │
├────────┼──────┼───────────────────┤
│   -    │  -   │         -         │
└────────┴──────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)