ci: add security-scan + semgrep + dependabot

.github/dependabot.yml

@@ -0,0 +1,40 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - github-actions
+    commit-message:
+      prefix: deps
+      include: scope
+    groups:
+      actions-minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - go
+    commit-message:
+      prefix: deps
+      include: scope
+    groups:
+      gomod-minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch

.github/workflows/branch-preview.yaml

@@ -17,7 +17,7 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Get next version
         uses: reecetech/version-increment@2023.10.2
         id: base-version
@@ -40,16 +40,16 @@ jobs:
       cicd-bot-telegram-token: ${{ steps.telegram-secrets.outputs.cicd-bot-telegram-token }}
       cicd-bot-telegram-chat-id: ${{ steps.telegram-secrets.outputs.cicd-bot-telegram-chat-id }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - uses: fregante/setup-git-user@v2
       - name: Set up Go with Blacksmith caching
         uses: useblacksmith/setup-go@v6
         with:
           go-version: '1.25'
-      - name: install sc tool (latest release)
-        shell: bash
-        run: |-
-          curl -s "https://dist.simple-container.com/sc.sh" | bash
+      - name: install sc tool
+        uses: simple-container-com/actions/install-sc@main
+      - name: install welder tool
+        uses: simple-container-com/actions/install-welder@main
       - name: prepare secrets for build
         run: |
           cat << EOF > ./.sc/cfg.default.yaml
@@ -70,7 +70,7 @@ jobs:
           SKIP_EMBEDDINGS: "true"
         run: |-
           git remote set-url origin https://${{ secrets.GITHUB_TOKEN }}@github.com/simple-container-com/api.git
-          bash <(curl -Ls "https://welder.simple-container.com/welder.sh") run rebuild
+          welder run rebuild
       - name: clean
         run: |
           mkdir -p dist
@@ -124,7 +124,7 @@ jobs:
           - os: darwin
             arch: amd64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Set up Go with Blacksmith caching
         uses: useblacksmith/setup-go@v6
         with:
@@ -166,7 +166,7 @@ jobs:
             cmd: cloud-helpers
             output: dist/cloud-helpers
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Set up Go with Blacksmith caching
         uses: useblacksmith/setup-go@v6
         with:
@@ -192,7 +192,7 @@ jobs:
     runs-on: blacksmith-8vcpu-ubuntu-2204
     needs: [prepare, build-setup]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Set up Go with Blacksmith caching
         uses: useblacksmith/setup-go@v6
         with:
@@ -217,18 +217,16 @@ jobs:
             dockerfile: cloud-helpers.aws.Dockerfile
             tag_prefix: "simplecontainer/cloud-helpers:aws-"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: download ${{ matrix.target }} binary
         uses: actions/download-artifact@v4
         with:
           name: ${{ matrix.target }}-binary
           path: dist
       - name: fix binary permissions
         run: chmod +x dist/${{ matrix.binary }}
-      - name: install sc tool (latest release)
-        shell: bash
-        run: |-
-          curl -s "https://dist.simple-container.com/sc.sh" | bash
+      - name: install sc tool
+        uses: simple-container-com/actions/install-sc@main
       - name: prepare secrets for build
         run: |
           cat << EOF > ./.sc/cfg.default.yaml
@@ -267,7 +265,7 @@ jobs:
     # Runs in parallel with publish-git-tag.
     needs: [prepare, build-setup, build-platforms, test]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: download all sc platform artifacts
         uses: actions/download-artifact@v4
         with:
@@ -280,10 +278,8 @@ jobs:
           path: bin
       - name: fix bin tools permissions
         run: chmod +x bin/*
-      - name: install sc tool (latest release)
-        shell: bash
-        run: |-
-          curl -s "https://dist.simple-container.com/sc.sh" | bash
+      - name: install sc tool
+        uses: simple-container-com/actions/install-sc@main
       - name: prepare secrets for build
         run: |
           cat << EOF > ./.sc/cfg.default.yaml
@@ -319,7 +315,7 @@ jobs:
     # Does not need build-platforms or publish-sc-preview. Runs in parallel with publish-sc-preview.
     needs: [prepare, docker-build]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
       - uses: fregante/setup-git-user@v2
@@ -364,18 +360,17 @@ jobs:
       - publish-git-tag
       - docker-build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         if: ${{ always() }}
 
       - name: Extract git reference
         id: extract_git_ref
         if: ${{ always() }}
         shell: bash
+        env:
+          COMMIT_MESSAGE: ${{ github.event.head_commit.message || github.event.workflow_run.head_commit.message }}
         run: |-
-          cat <<'EOF' > /tmp/commit_message.txt
-            ${{ github.event.head_commit.message || github.event.workflow_run.head_commit.message }}
-          EOF
-          message="$(cat /tmp/commit_message.txt | tr -d '\n')"
+          message="$(printf '%s' "$COMMIT_MESSAGE" | tr -d '\n')"
           if [ ${#message} -gt 200 ]; then
             truncated_message="${message:0:80}...${message: -80}"
             message="$truncated_message"
@@ -420,29 +415,39 @@ jobs:
 
           Docker image: \`simplecontainer/github-actions:${VERSION}\`
 
-          ### Install this SC version via CLI
+          ### Install this SC version in your CI
 
-          \`\`\`bash
-          SIMPLE_CONTAINER_VERSION=${VERSION} curl -s "https://dist.simple-container.com/sc.sh" | bash
+          \`\`\`yaml
+          - uses: simple-container-com/actions/install-sc@main
+            with:
+              version: ${VERSION}
           \`\`\`
 
-          > Preview build from branch \`${BRANCH}\`. Running \`sc.sh\` without \`SIMPLE_CONTAINER_VERSION\` will **not** pick up this version.
+          > Preview build from branch \`${BRANCH}\`. The \`install-sc\` action pins the binary to the exact preview version above and verifies it on download.
           ENDSUMMARY
 
-      - uses: yanzay/notify-telegram@v0.1.0
+      - name: Notify Telegram (success)
         if: ${{ success() && !contains(needs.*.result, 'failure') }}
         continue-on-error: true
+        uses: simple-container-com/actions/notify-telegram@main
         with:
-          chat: ${{ needs.build-setup.outputs.cicd-bot-telegram-chat-id }}
-          token: ${{ needs.build-setup.outputs.cicd-bot-telegram-token }}
-          status: ✅ preview published (${{ steps.extract_git_ref.outputs.branch }}) (v${{ needs.prepare.outputs.version }}) - ${{ steps.extract_git_ref.outputs.message }} by ${{ steps.extract_git_ref.outputs.author }}
-      - uses: yanzay/notify-telegram@v0.1.0
+          chat-id:   ${{ needs.build-setup.outputs.cicd-bot-telegram-chat-id }}
+          token:     ${{ needs.build-setup.outputs.cicd-bot-telegram-token }}
+          text:      '✅ Preview published: '
+          link-url:  ${{ format('{0}/{1}/actions/runs/{2}', github.server_url, github.repository, github.run_id) }}
+          link-text: 'v${{ needs.prepare.outputs.version }}'
+          suffix:    ' on ${{ github.head_ref || github.ref_name }} by ${{ steps.extract_git_ref.outputs.author }}'
+      - name: Notify Telegram (failure)
         if: ${{ failure() || contains(needs.*.result, 'failure') }}
         continue-on-error: true
+        uses: simple-container-com/actions/notify-telegram@main
         with:
-          chat: ${{ needs.build-setup.outputs.cicd-bot-telegram-chat-id }}
-          token: ${{ needs.build-setup.outputs.cicd-bot-telegram-token }}
-          status: ❗ preview failed (${{ steps.extract_git_ref.outputs.branch }}) - ${{ steps.extract_git_ref.outputs.message }} by ${{ steps.extract_git_ref.outputs.author }}
+          chat-id:   ${{ needs.build-setup.outputs.cicd-bot-telegram-chat-id }}
+          token:     ${{ needs.build-setup.outputs.cicd-bot-telegram-token }}
+          text:      '❗ Preview failed: '
+          link-url:  ${{ format('{0}/{1}/actions/runs/{2}', github.server_url, github.repository, github.run_id) }}
+          link-text: 'v${{ needs.prepare.outputs.version }}'
+          suffix:    ' on ${{ github.head_ref || github.ref_name }} by ${{ steps.extract_git_ref.outputs.author }}'
 
       - name: Build failed due to previously failed steps
         id: fail_if_needed

.github/workflows/branch.yaml

@@ -17,16 +17,16 @@ jobs:
       cicd-bot-telegram-token: ${{ steps.telegram-secrets.outputs.cicd-bot-telegram-token }}
       cicd-bot-telegram-chat-id: ${{ steps.telegram-secrets.outputs.cicd-bot-telegram-chat-id }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - uses: fregante/setup-git-user@v2
       - name: Set up Go with Blacksmith caching
         uses: useblacksmith/setup-go@v6
         with:
           go-version: '1.25'
-      - name: install sc tool (latest release)
-        shell: bash
-        run: |-
-          curl -s "https://dist.simple-container.com/sc.sh" | bash
+      - name: install sc tool
+        uses: simple-container-com/actions/install-sc@main
+      - name: install welder tool
+        uses: simple-container-com/actions/install-welder@main
       - name: prepare secrets for build
         run: |
           cat << EOF > ./.sc/cfg.default.yaml
@@ -47,7 +47,7 @@ jobs:
           SKIP_EMBEDDINGS: "true"
         run: |-
           git remote set-url origin https://${{ secrets.GITHUB_TOKEN }}@github.com/simple-container-com/api.git
-          bash <(curl -Ls "https://welder.simple-container.com/welder.sh") run rebuild
+          welder run rebuild
       - name: clean
         run: |
           mkdir -p dist
@@ -101,7 +101,7 @@ jobs:
           - os: darwin
             arch: amd64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Set up Go with Blacksmith caching
         uses: useblacksmith/setup-go@v6
         with:
@@ -141,7 +141,7 @@ jobs:
             cmd: cloud-helpers
             output: dist/cloud-helpers
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Set up Go with Blacksmith caching
         uses: useblacksmith/setup-go@v6
         with:
@@ -166,7 +166,7 @@ jobs:
     runs-on: blacksmith-8vcpu-ubuntu-2204
     needs: build-setup
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Set up Go with Blacksmith caching
         uses: useblacksmith/setup-go@v6
         with:
@@ -187,7 +187,7 @@ jobs:
     runs-on: blacksmith-8vcpu-ubuntu-2204
     needs: build-setup
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Set up Go with Blacksmith caching
         uses: useblacksmith/setup-go@v6
         with:
@@ -209,38 +209,44 @@ jobs:
       - build-github-actions-staging
       - test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         if: ${{ always() }}
 
       - name: Extract git reference
         id: extract_git_ref
         if: ${{ always() }}
         shell: bash
+        env:
+          COMMIT_MESSAGE: ${{ github.event.head_commit.message || github.event.workflow_run.head_commit.message }}
         run: |-
-          cat <<'EOF' > /tmp/commit_message.txt
-            ${{ github.event.head_commit.message || github.event.workflow_run.head_commit.message }}
-          EOF
-          message="$(cat /tmp/commit_message.txt | tr -d '\n')"
+          message="$(printf '%s' "$COMMIT_MESSAGE" | tr -d '\n')"
           echo "branch=$GITHUB_REF_NAME" >> $GITHUB_OUTPUT
           echo "message=$message" >> $GITHUB_OUTPUT
           echo "author=$GITHUB_ACTOR" >> $GITHUB_OUTPUT
           echo "url=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> $GITHUB_OUTPUT
 
-      # Notify telegram
-      - uses: yanzay/notify-telegram@v0.1.0
-        if: ${{ success() && !contains(needs.*.result, 'failure')  }}
+      - name: Notify Telegram (success)
+        if: ${{ success() && !contains(needs.*.result, 'failure') }}
         continue-on-error: true
+        uses: simple-container-com/actions/notify-telegram@main
         with:
-          chat: ${{ needs.build-setup.outputs.cicd-bot-telegram-chat-id }}
-          token: ${{ needs.build-setup.outputs.cicd-bot-telegram-token }}
-          status: ✅ success (${{ steps.extract_git_ref.outputs.branch }}) - ${{ steps.extract_git_ref.outputs.message }} by ${{ steps.extract_git_ref.outputs.author }}
-      - uses: yanzay/notify-telegram@v0.1.0
+          chat-id:   ${{ needs.build-setup.outputs.cicd-bot-telegram-chat-id }}
+          token:     ${{ needs.build-setup.outputs.cicd-bot-telegram-token }}
+          text:      '✅ CI passed: '
+          link-url:  ${{ github.event.pull_request.html_url || format('{0}/{1}/actions/runs/{2}', github.server_url, github.repository, github.run_id) }}
+          link-text: "${{ github.event.pull_request.title && format('PR #{0}: {1}', github.event.pull_request.number, github.event.pull_request.title) || github.workflow }}"
+          suffix:    ' on ${{ github.head_ref || github.ref_name }} by ${{ steps.extract_git_ref.outputs.author }}'
+      - name: Notify Telegram (failure)
         if: ${{ failure() || contains(needs.*.result, 'failure') }}
         continue-on-error: true
+        uses: simple-container-com/actions/notify-telegram@main
         with:
-          chat: ${{ needs.build-setup.outputs.cicd-bot-telegram-chat-id }}
-          token: ${{ needs.build-setup.outputs.cicd-bot-telegram-token }}
-          status: ❗ failure (${{ steps.extract_git_ref.outputs.branch }}) - ${{ steps.extract_git_ref.outputs.message }} by ${{ steps.extract_git_ref.outputs.author }}
+          chat-id:   ${{ needs.build-setup.outputs.cicd-bot-telegram-chat-id }}
+          token:     ${{ needs.build-setup.outputs.cicd-bot-telegram-token }}
+          text:      '❗ CI failed: '
+          link-url:  ${{ github.event.pull_request.html_url || format('{0}/{1}/actions/runs/{2}', github.server_url, github.repository, github.run_id) }}
+          link-text: "${{ github.event.pull_request.title && format('PR #{0}: {1}', github.event.pull_request.number, github.event.pull_request.title) || github.workflow }}"
+          suffix:    ' on ${{ github.head_ref || github.ref_name }} by ${{ steps.extract_git_ref.outputs.author }}'
 
       - name: Build failed due to previously failed steps
         id: fail_if_needed