CodeQL flagged docker/setup-buildx-action, docker/login-action,
docker/build-push-action and cypress-io/github-action as unpinned: a
moving v3 or v6 tag lets whoever controls it change what runs with the
workflow's GHCR write token.
Each action is now pinned to the commit its tag points to today, with
the exact release as a trailing comment (v3.12.0, v3.7.0, v6.19.2,
v6.10.9), resolved through the GitHub API, so the code that runs does
not change. GitHub's own actions/* were not flagged and keep their tags.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The lint-docker job in lint.yml requires security-events: write
for SARIF upload; must be explicitly granted to the caller job.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Replace requirements.txt with pyproject.toml for modern Python packaging
- Add unit, integration, lint and security test suites under tests/
- Add utils/export_runtime_requirements.py and utils/check_hadolint_sarif.py
- Split monolithic CI into reusable lint.yml, security.yml and tests.yml
- Refactor ci.yml to orchestrate reusable workflows; publish on semver tag only
- Modernize Dockerfile: pin python:3.12-slim, install via pyproject.toml
- Expand Makefile with lint, security, test and CI targets
- Add test-e2e via act with portfolio container stop/start around run
- Fix navbar_logo_visibility.spec.js: win.fullscreen() → win.enterFullscreen()
- Set use_reloader=False in app.run() to prevent double-start in CI
- Add app/core.* and build artifacts to .gitignore
- Fix apt-get → sudo apt-get in tests.yml e2e job
- Fix pip install --ignore-installed to handle stale act cache
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
