build(deps): bump the github-actions group with 8 updates

.github/SECURITY.md

@@ -0,0 +1,10 @@
+# Security policy
+
+Please do not report security vulnerabilities in a public issue.
+
+Use [GitHub private vulnerability reporting](https://github.com/croit/keepAfloatD/security/advisories/new)
+to send the maintainers a confidential report. Include the affected version, impact, reproduction
+steps and any suggested mitigation.
+
+The maintainers will acknowledge the report, assess affected releases and coordinate a fix before
+public disclosure. General support requests can be sent to [email protected].

.github/dependabot.yml

@@ -0,0 +1,39 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      rust-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: docker
+    directory: /tests/e2e/fixtures
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: docker
+    directory: /tests/e2e/runner
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: docker
+    directory: /tests/haproxy-e2e
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -13,8 +13,7 @@ env:
   CARGO_TERM_COLOR: always
   CARGO_INCREMENTAL: "0"
   RUST_VERSION: 1.91.1
-  # scripts/ci/* default their workdir to GitLab's /app; point them at the
-  # Actions checkout instead.
+  # Point the shared CI scripts at the Actions checkout.
   CI_PROJECT_DIR: ${{ github.workspace }}
 
 permissions:
@@ -25,12 +24,14 @@ jobs:
     name: lint / fmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: ${{ env.RUST_VERSION }}
           components: rustfmt
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - run: cargo fmt --check
 
   build-binary:
@@ -40,12 +41,16 @@ jobs:
       fail-fast: false
       matrix:
         arch: [amd64, arm64]
+    env:
+      TARGET_ARCH: ${{ matrix.arch }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: Install native build dependencies
         run: |
           sudo apt-get update -qq
@@ -68,25 +73,25 @@ jobs:
           mkdir -p dist
           # Static musl build: artifact has no glibc/GLIBC_* dependency, so it
           # installs/runs on any libc version (e.g. el9 glibc 2.34).
-          if [ "${{ matrix.arch }}" = "arm64" ]; then
+          if [ "${TARGET_ARCH}" = "arm64" ]; then
             TARGET=aarch64-unknown-linux-musl
             export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc
           else
             TARGET=x86_64-unknown-linux-musl
           fi
           rustup target add "${TARGET}"
           cargo build --release --locked --target "${TARGET}"
-          cp "target/${TARGET}/release/keepafloatd" "dist/keepafloatd-linux-${{ matrix.arch }}"
+          cp "target/${TARGET}/release/keepafloatd" "dist/keepafloatd-linux-${TARGET_ARCH}"
           chmod +x dist/keepafloatd-linux-*
       - name: Verify binary is statically linked
         run: |
-          if file "dist/keepafloatd-linux-${{ matrix.arch }}" | grep -q "dynamically linked"; then
+          if file "dist/keepafloatd-linux-${TARGET_ARCH}" | grep -q "dynamically linked"; then
             echo "ERROR: binary is dynamically linked; expected a static musl build" >&2
-            file "dist/keepafloatd-linux-${{ matrix.arch }}" >&2
+            file "dist/keepafloatd-linux-${TARGET_ARCH}" >&2
             exit 1
           fi
-          file "dist/keepafloatd-linux-${{ matrix.arch }}"
-      - uses: actions/upload-artifact@v5
+          file "dist/keepafloatd-linux-${TARGET_ARCH}"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: keepafloatd-binary-${{ matrix.arch }}
           path: dist/keepafloatd-linux-${{ matrix.arch }}
@@ -98,12 +103,16 @@ jobs:
       fail-fast: false
       matrix:
         arch: [amd64, arm64]
+    env:
+      TARGET_ARCH: ${{ matrix.arch }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: Install Debian packaging dependencies
         run: |
           sudo apt-get update -qq
@@ -131,7 +140,7 @@ jobs:
           mkdir -p dist
           # Package the static musl binary so the .deb's $auto depends carries
           # no libc6/GLIBC requirement.
-          if [ "${{ matrix.arch }}" = "arm64" ]; then
+          if [ "${TARGET_ARCH}" = "arm64" ]; then
             TARGET=aarch64-unknown-linux-musl
             export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc
           else
@@ -140,8 +149,8 @@ jobs:
           rustup target add "${TARGET}"
           cargo build --release --locked --target "${TARGET}"
           cargo deb --no-build --no-strip --target "${TARGET}"
-          find target -type f -name "*_${{ matrix.arch }}.deb" -exec cp {} dist/ \;
-      - uses: actions/upload-artifact@v5
+          find target -type f -name "*_${TARGET_ARCH}.deb" -exec cp {} dist/ \;
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: keepafloatd-deb-${{ matrix.arch }}
           path: dist/*_${{ matrix.arch }}.deb
@@ -150,16 +159,18 @@ jobs:
     name: build / source tarball
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: Build vendored source tarball
         run: VERSION=0.0.0 ./scripts/ci/build/source-tarball.sh
       - name: Verify it builds fully offline
         run: ./scripts/ci/test/source-build.sh
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: keepafloatd-source
           path: dist/keepafloatd-*.tar.gz
@@ -168,59 +179,77 @@ jobs:
     name: build / images
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: docker/setup-buildx-action@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - name: Build runtime image
         run: docker build --target runtime -t keepafloatd:runtime-ci .
+      - name: Scan runtime image
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.36.0
+        with:
+          exit-code: "1"
+          ignore-unfixed: true
+          image-ref: keepafloatd:runtime-ci
+          severity: CRITICAL,HIGH
+          vuln-type: os
       - name: Build dev image
         run: docker build --target dev -t keepafloatd:dev-ci .
 
   test-unit:
     name: test / unit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - run: ./scripts/ci/test/unit.sh
 
   test-clippy:
     name: test / clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: ${{ env.RUST_VERSION }}
           components: clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - run: ./scripts/ci/test/clippy.sh
 
   test-licenses:
     name: test / licenses
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - run: ./scripts/ci/test/licenses-before.sh
       - run: ./scripts/ci/test/licenses.sh
 
   test-doc:
     name: test / doc
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - run: ./scripts/ci/test/doc.sh
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: keepafloatd-doc
           path: target/doc/
@@ -229,11 +258,13 @@ jobs:
     name: test / coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: Install coverage dependencies
         run: |
           sudo apt-get update -qq
@@ -242,7 +273,7 @@ jobs:
             pkg-config
           cargo install cargo-tarpaulin --locked
       - run: ./scripts/ci/test/coverage.sh
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: keepafloatd-coverage
           path: |
@@ -253,12 +284,14 @@ jobs:
     name: test / e2e
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Build E2E image
         run: docker build -t keepafloatd:ci .
       - name: Run Docker Compose E2E
         run: KEEPAFLOATD_IMAGE=keepafloatd:ci ./scripts/ci/test/e2e.sh
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: keepafloatd-e2e-artifacts
@@ -268,19 +301,19 @@ jobs:
     name: test / haproxy article
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: Build runtime base image
         run: docker build --target runtime -t keepafloatd:runtime-local .
-      - name: Pre-pull pinned service images
-        # the compose file runs hermetic (pull_policy: never), so fetch its
-        # third-party images explicitly
-        run: docker pull -q python:3.12-alpine
+      - name: Preload fixture image
+        run: docker pull python:3.12-alpine@sha256:d09d15e60962ca365d1cd544a48773bac9d33f2fb1b00f2aa0deec78ade7dc31
       - run: bash tests/haproxy-e2e/run.sh
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: keepafloatd-haproxy-e2e-artifacts
@@ -292,10 +325,21 @@ jobs:
     needs:
       - build-deb
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/download-artifact@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: keepafloatd-deb-amd64
           path: dist/
       - name: Install and validate Debian package
         run: sudo env CI_PROJECT_DIR="${PWD}" bash ./scripts/ci/test/deb-install.sh
+
+  test-public-export:
+    name: test / public export
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - run: ./scripts/public/verify.sh HEAD