ci: fix a pin that could not resolve, and aim CodeQL at the real attack surface

Acting on the CI-hardening research. Four changes, one of which is a bug
I shipped two commits ago.

dependency-review-action@v4 does not exist. That action publishes no
floating `v4` major tag — only v4.7.3 ... v4.9.0 specifics and v5.0.0 —
so the reference could never resolve. It never surfaced because the job
is gated off while the repo is private, which is exactly how a broken pin
survives until the moment you need it. Now @v5.

The other actions were three majors behind: checkout, setup-python and
upload-artifact are all on v7. Bumped, and CI is what verifies that —
the upload-artifact step is already continue-on-error, so the riskiest
of the three cannot redden a build.

CodeQL now analyses `actions` as well as `python`, one job per language.
This is the change with the most value per line. The runtime here is
stdlib-only with a single outbound API; the CI is where a public repo is
actually attacked, and CodeQL's actions queries cover exactly that —
workflow script injection, checkout of untrusted code in a privileged
context, cache and artifact poisoning, unpinned action tags. Autobuild is
skipped for `actions`, which analyses YAML and has nothing to build.

Also switched the suite from security-and-quality to security-extended.
security-and-quality adds roughly 122 Python code-quality queries that
ruff already enforces, and it disables CodeQL's autofix validation; the
redundancy was not buying anything.

The `category` is now per-language, which CodeQL requires once a repo
uploads more than one SARIF result. I got this wrong on the first attempt
— referenced `matrix.language` with no matrix defined — and actionlint
did not catch it, because an undefined matrix context is a runtime
failure rather than a syntax error.

Renovate gains `helpers:pinGitHubActionDigests` rather than me pinning
SHAs by hand, deliberately. A pin needs its `# vX.Y.Z` comment to keep
being updated: since 2026-04-07 Renovate disables bare-SHA pins by
default because it cannot tell what branch or tag the SHA belongs to, so
a hand-written bare pin goes stale silently and forever. Renovate writes
the comment and maintains it. Worth knowing the tradeoff it buys into:
Dependabot does not raise vulnerability alerts for SHA-pinned actions,
only for semver ones, so the pins have to be kept current by Renovate
rather than by alerting.

Also worth recording what SHA pinning does NOT fix, since it is easy to
over-trust: it locks the outer reference only. A composite action that
internally does `uses: some/action@v1` still resolves a mutable tag the
caller cannot reach — that is how the reviewdog compromise propagated to
consumers "regardless of version or pinning method". It is a further
argument for the existing pattern of curling a pinned CLI (gitleaks,
trufflehog, lychee, markdownlint) instead of adopting third-party
actions: a binary has no transitive action graph.

CITATION.cff: `authors: [{alias: FZ2000}]` is schema-legal but produces no
printable author, so GitHub's "Cite this repository" panel rendered an
entry with nobody in it. Added a `name`. Also removed
`date-released: 2026-04-26`, which asserted a release that has never
existed — `git tag` is empty, and CHANGELOG.md and PUBLISHING.md both
already say so.

Author: FZ2000

.github/workflows/ci.yml

@@ -69,8 +69,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
       - name: Install dev deps
@@ -114,8 +114,8 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dev deps
@@ -135,7 +135,7 @@ jobs:
         # v4: v3 was retired 2025-01-30 and now fails outright. The old
         # v3 pin existed only because Gitea's artifact server implemented
         # the v3 API and rejected v4 with GHESNotSupportedError.
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         # Never fail the build on this. The coverage GATE is enforced inside
         # the test step by pytest-cov's --cov-fail-under, so by the time we
         # get here the number has already passed or failed; this upload only
@@ -153,8 +153,8 @@ jobs:
   integration:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
       - name: Install dev deps
@@ -175,8 +175,8 @@ jobs:
   smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
       - name: Run `da --version` (stdlib-only — no deps needed)
@@ -230,8 +230,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: test
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
 
@@ -322,7 +322,7 @@ jobs:
   secret-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # gitleaks needs full history to scan past commits, not just HEAD.
           fetch-depth: 0
@@ -354,7 +354,7 @@ jobs:
     # reportable finding, which gates CI.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: TruffleHog (verified/unknown findings only)
@@ -370,7 +370,7 @@ jobs:
   codespell:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install codespell
         # Into a venv: the runner image's system Python is externally
         # managed (PEP 668) and rejects a bare `pip install`.
@@ -398,8 +398,8 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
       - name: Install dev deps
@@ -422,7 +422,7 @@ jobs:
     # so "configured" and "enforced" mean the same thing.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: markdownlint
         # Pinned to the same version .pre-commit-config.yaml uses, so
         # local and CI agree. Newer versions add rules (e.g. MD060) that
@@ -435,7 +435,7 @@ jobs:
     # covered by link-check-external below.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install lychee
         run: |
           case "$(uname -m)" in
@@ -455,7 +455,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install lychee
         run: |
           case "$(uname -m)" in
@@ -473,8 +473,8 @@ jobs:
     # what actually catches a DA response-shape change.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
       - name: Install dev + integration deps
@@ -518,8 +518,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: test  # don't bother if unit tests are broken
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
       - name: Install dev + integration deps
@@ -548,12 +548,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # No token in the environment: this job runs no privileged step and
           # a checkout that leaves credentials behind is a needless one.
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
       - name: Discoverability and metadata checks

.github/workflows/codeql.yml

@@ -46,37 +46,52 @@ concurrency:
 
 jobs:
   analyze:
-    name: Analyze Python
+    name: Analyze ${{ matrix.language }}
     # Skips entirely while the repo is private. See the header.
     if: ${{ github.event.repository.private == false }}
     runs-on: ubuntu-latest
+    strategy:
+      # One job per language so a failure names the language, and so the
+      # `category` below is distinct per analysis — CodeQL requires that when
+      # a repo uploads more than one SARIF result.
+      fail-fast: false
+      matrix:
+        language: [python, actions]
     permissions:
       # Raised above the workflow default: the upload step writes results
       # to the Security tab. `contents: read` alone is not enough.
       security-events: write
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
         with:
-          languages: python
-          # security-and-quality is a superset of the default suite. The
-          # extra quality queries are noisier, but this is a small codebase
-          # with a 92% coverage gate — the signal is worth the noise.
-          queries: security-and-quality
+          # `actions` matters at least as much as `python` here: the runtime
+          # is stdlib-only, while the CI is where a public repo is actually
+          # attacked. Its queries cover workflow script injection, checkout of
+          # untrusted code in a privileged context, cache/artifact poisoning
+          # and unpinned action tags.
+          languages: ${{ matrix.language }}
+          # security-extended, not security-and-quality: the latter adds
+          # ~122 Python code-quality queries that ruff already enforces,
+          # and it disables CodeQL's autofix validation. Extended keeps the
+          # security queries without the redundancy.
+          queries: security-extended
 
       - name: Autobuild
-        # Python needs no compilation; autobuild resolves the import graph
-        # so CodeQL can follow calls across dacli/ submodules. That matters
-        # here because the package deliberately re-exports names and reads
-        # them back through the package at call time (see ADR 0007), which
-        # a file-at-a-time scan would not connect.
+        # Python needs no compilation, but autobuild resolves the import graph
+        # so CodeQL can follow calls across dacli/ submodules — which matters
+        # because the package deliberately re-exports names and reads them
+        # back through the package at call time (ADR 0007), something a
+        # file-at-a-time scan would not connect. Skipped for `actions`, which
+        # analyses YAML and has nothing to build.
+        if: matrix.language == 'python'
         uses: github/codeql-action/autobuild@v3
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v3
         with:
-          category: "/language:python"
+          category: "/language:${{ matrix.language }}"

.github/workflows/dependency-review.yml

@@ -40,8 +40,10 @@ jobs:
       # burying the result in the job log.
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/dependency-review-action@v4
+      - uses: actions/checkout@v7
+      - # @v5, not @v4: this action publishes no `v4` floating major tag,
+        # only v4.x.y specifics and v5.0.0, so `@v4` fails to resolve.
+        uses: actions/dependency-review-action@v5
         with:
           # Fail on a moderate finding rather than the default `low`. The
           # dev graph is large and low-severity advisories in test tooling

CITATION.cff

@@ -7,11 +7,15 @@ abstract: >-
   to a local destination directory, and exposes search / browse / metadata
   helpers.
 authors:
-  - alias: FZ2000
+  - name: "FZ2000"
+    alias: FZ2000
 type: software
 license: MIT
 version: "0.3.0"
-date-released: "2026-04-26"
+# date-released is deliberately omitted: it is not a required CFF field
+# and no release has ever been tagged (`git tag` is empty), so a date
+# here would assert a release that does not exist. Add it with the
+# first real tag — see CONTRIBUTING.md#releases.
 repository-code: "https://github.com/FZ2000/da-cli"
 url: "https://github.com/FZ2000/da-cli"
 keywords:

renovate.json

@@ -1,13 +1,14 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
+  "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
   "schedule": ["before 6am on Monday"],
   "labels": ["dependencies"],
   "commitMessagePrefix": "chore(deps)",
   "commitMessageTopic": "{{depName}}",
   "prConcurrentLimit": 5,
   "prHourlyLimit": 2,
   "rangeStrategy": "bump",
+  "configMigration": true,
   "pre-commit": {
     "enabled": true
   },