fix(ci)!: refresh security and build workflows

.github/workflows/backplane-release.yml

@@ -5,17 +5,21 @@ on:
       - main
       - alpha
       - beta
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Setup .NET
-      uses: actions/setup-dotnet@v3
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
       with:
-        dotnet-version: 6.0.x
+        dotnet-version: 10.0.x
     - name: Restore dependencies
       run: dotnet restore
       working-directory: ./src/Finos.Fdc3.Backplane
@@ -27,7 +31,7 @@ jobs:
       working-directory: ./src/Finos.Fdc3.Backplane
 
     - name: Setup Node.js
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
           node-version: latest
           cache: 'npm'
@@ -44,4 +48,4 @@ jobs:
           GIT_COMMITTER_NAME: manish-nwm
           GIT_COMMITTER_EMAIL: manish.bhutani@natwestmarkets.com
       run: npx semantic-release 
-      working-directory: ./src/Finos.Fdc3.Backplane
+      working-directory: ./src/Finos.Fdc3.Backplane

.github/workflows/codeql.yml

@@ -42,11 +42,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -60,7 +60,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -73,6 +73,6 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/cve-scanning.yml

@@ -0,0 +1,70 @@
+name: CVE Scanning
+
+on:
+  push:
+    branches: [main, alpha, beta]
+    paths:
+      - '**/*.csproj'
+      - '**/*.sln'
+      - '**/*.slnx'
+      - '**/Directory.Packages.props'
+      - '**/Directory.Build.props'
+      - '**/Directory.Build.targets'
+      - '**/packages.lock.json'
+      - '**/global.json'
+      - '**/NuGet.config'
+      - '**/nuget.config'
+      - '.github/workflows/cve-scanning.yml'
+  pull_request:
+    branches: [main, alpha, beta]
+    paths:
+      - '**/*.csproj'
+      - '**/*.sln'
+      - '**/*.slnx'
+      - '**/Directory.Packages.props'
+      - '**/Directory.Build.props'
+      - '**/Directory.Build.targets'
+      - '**/packages.lock.json'
+      - '**/global.json'
+      - '**/NuGet.config'
+      - '**/nuget.config'
+      - '.github/workflows/cve-scanning.yml'
+  schedule:
+    - cron: '17 5 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  dotnet:
+    name: .NET dependencies
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Restore dependencies
+        run: dotnet restore Finos.Fdc3.Backplane.sln
+
+      - name: Scan direct and transitive dependencies
+        shell: bash
+        run: |
+          set -o pipefail
+          dotnet list Finos.Fdc3.Backplane.sln package \
+            --vulnerable \
+            --include-transitive \
+            --format json | tee vulnerability-report.json
+
+          jq -e '
+            [ .projects[]?.frameworks[]?
+              | ((.topLevelPackages // []) + (.transitivePackages // []))[]?
+              | select((.vulnerabilities // []) | length > 0)
+            ] | length == 0
+          ' vulnerability-report.json

.github/workflows/dot-net-build.yml

@@ -14,16 +14,19 @@ on:
       - alpha
       - beta
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Setup .NET
-      uses: actions/setup-dotnet@v3
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
       with:
-        dotnet-version: 6.0.x
+        dotnet-version: 10.0.x
     - name: Restore dependencies
       run: dotnet restore
     - name: Build

.github/workflows/doxygen.yml

@@ -10,6 +10,10 @@ on:
       - main
       - alpha
       - beta
+
+permissions:
+  contents: write
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -20,18 +24,20 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
     # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Doxygen Action
-      uses: mattnotmitt/doxygen-action@v1.1.0
+      uses: mattnotmitt/doxygen-action@b84fe17600245bb5db3d6c247cc274ea98c15a3b # 1.12.0
       with:
         # Path to Doxyfile
         doxyfile-path: "./Doxyfile" # default is ./Doxyfile
         # Working directory
         working-directory: "." # default is .
 
     - name: Deploy
-      uses: peaceiris/actions-gh-pages@v3
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         # Default Doxyfile build documentation to html directory. 

.github/workflows/node-cve-scanning.yml

@@ -8,7 +8,6 @@ on:
     paths:
       - 'src/Finos.Fdc3.Backplane.Client.JS/package.json'
       - 'src/Finos.Fdc3.Backplane.Client.JS/package-lock.json'
-      - 'src/Finos.Fdc3.Backplane.Client.JS/allow-list.json'
       - '.github/workflows/node-cve-scanning.yml'
   pull_request:
     branches:
@@ -18,24 +17,29 @@ on:
     paths:
       - 'src/Finos.Fdc3.Backplane.Client.JS/package.json'
       - 'src/Finos.Fdc3.Backplane.Client.JS/package-lock.json'
-      - 'src/Finos.Fdc3.Backplane.Client.JS/allow-list.json'
       - '.github/workflows/node-cve-scanning.yml'
+  schedule:
+    - cron: '37 5 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
   scan:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [16.x]
+        node-version: [22.x]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
           cache-dependency-path: '**/package-lock.json'
       - run: npm ci --omit dev
         working-directory: src/Finos.Fdc3.Backplane.Client.JS
-      - run: npx --yes auditjs ossi --whitelist allow-list.json
+      - run: npm audit --omit dev --audit-level high
         working-directory: src/Finos.Fdc3.Backplane.Client.JS

.github/workflows/node-license-scanning.yml

@@ -20,16 +20,19 @@ on:
       - 'src/Finos.Fdc3.Backplane.Client.JS/package-lock.json'
       - '.github/workflows/node-license-scanning.yml'
 
+permissions:
+  contents: read
+
 jobs:
   scan:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [16.x]
+        node-version: [22.x]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'

.github/workflows/npm-build.yml

@@ -11,19 +11,22 @@ on:
       - alpha
       - beta
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     strategy:
       matrix:
-        node-version: [16.x, 18.x]
+        node-version: [22.x, 24.x]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ matrix.node-version }}
         cache: 'npm'

.github/workflows/npm-release.yml

@@ -5,18 +5,22 @@ on:
       - main
       - alpha
       - beta
+
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
            persist-credentials: false
 
       - name: Setup Node.js 
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
            node-version: latest
            cache: 'npm'

.github/workflows/nuget-release.yml

@@ -5,23 +5,27 @@ on:
       - main
       - alpha
       - beta
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Setup .NET
-      uses: actions/setup-dotnet@v3
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
       with:
-        dotnet-version: 6.0.x
+        dotnet-version: 10.0.x
     - name: Restore dependencies
       run: dotnet restore
       working-directory: ./src/Finos.Fdc3.Backplane.Client
 
     - name: Setup Node.js
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
           node-version: latest
           cache: 'npm'