Stamp official Docker builds with a low-cardinality provenance marker and report build_provenance/image_modified in anonymous telemetry. Local and fork builds default to custom, while official GitHub/GitLab release paths mark images as official.
- drop permissions block from reusable build workflow so callers set token
scope (fixes PR-checks startup failure: ci.yml grants only contents:read
while the reusable demanded packages:write)
- remove codeql.yml: repo already uses CodeQL default setup, which conflicts
with an advanced configuration
- pin trivy-action to 0.36.0 (0.28.0 tag does not exist; <0.35.0 is the
compromised supply-chain release flagged by dependency-review)
- make pip-audit and npm audit informational (continue-on-error); they flag
upstream/transitive advisories, dependency-review stays the PR gate
- dev-images: build/push backend, worker, frontend to ghcr.io and Docker
Hub on every push to dev (tags: dev, dev-<sha>)
- release-images: same images on v* tag push (tags: latest, <version>)
- PR checks (into main/dev): ruff lint+format, eslint+prettier, no-push
Docker build of all targets
- CodeQL (python, js/ts), dependency-review, pip-audit, npm audit, Trivy fs
- pin .github/workflows/*.yml to LF
3252a8
BADtochka