chore(release): promote main to release

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: "/"
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies

.github/workflows/bump-versions.yml

@@ -16,16 +16,17 @@ jobs:
   bump:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
       - name: Refresh registry.json pins
-        run: go run . bump --write --soak-days "${{ github.event.inputs.soak-days || '14' }}"
+        # The bump command is gated behind the "bump" build tag (maintainer-only).
+        run: go run -tags bump . bump --write --soak-days "${{ github.event.inputs.soak-days || '14' }}"
       - name: Verify build still passes
         run: go build -o /dev/null . && go test ./...
       - name: Open pull request
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch: chore/bump-versions

.github/workflows/promote.yml

@@ -13,7 +13,7 @@ jobs:
     name: Open or update promotion PR
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/release.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Deployment
         run: |
@@ -29,7 +29,7 @@ jobs:
       new_release_published: ${{ steps.semrel.outputs.new_release_published }}
       new_release_git_tag: ${{ steps.semrel.outputs.new_release_git_tag }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -38,7 +38,7 @@ jobs:
           node-version: 22
 
       - id: semrel
-        uses: cycjimmy/semantic-release-action@v4
+        uses: cycjimmy/semantic-release-action@v6
         with:
           extra_plugins: |
             @semantic-release/commit-analyzer
@@ -64,7 +64,7 @@ jobs:
           - goos: linux
             goarch: arm64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.semantic-release.outputs.new_release_git_tag }}
 
@@ -80,7 +80,7 @@ jobs:
           go build -ldflags "-s -w -X main.Version=${{ needs.semantic-release.outputs.new_release_git_tag }}" -o bungkus-cli-${{ matrix.goos }}-${{ matrix.goarch }} .
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: bungkus-cli-${{ matrix.goos }}-${{ matrix.goarch }}
           path: bungkus-cli-${{ matrix.goos }}-${{ matrix.goarch }}
@@ -93,7 +93,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           path: artifacts
 

.github/workflows/run-tests.yml

@@ -20,7 +20,7 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -35,6 +35,16 @@ jobs:
               repo: context.repo.repo,
               labels: ["ci-testing"]
             })
+      - uses: actions/setup-go@v5
+        with:
+          # Use the latest 1.25 patch so the toolchain's standard library carries
+          # stdlib security fixes. govulncheck flags stdlib advisories against the
+          # exact toolchain version, and go.mod's `go 1.25.0` would pin an
+          # unpatched stdlib (crypto/tls, net/textproto, crypto/x509 advisories).
+          go-version: "1.25.x"
       - name: Build and run tests
         run: |
-          echo "Build and run tests here"
+          go build -o /dev/null .
+          go test ./...
+      - name: Vulnerability scan
+        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

.github/workflows/start-pull-request.yml

@@ -37,7 +37,7 @@ jobs:
           exit 1
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Get issue labels
         id: get_labels

SECURITY.md

@@ -0,0 +1,69 @@
+# Security
+
+bungkus-cli is a local, single-user CLI that scaffolds projects. It runs with
+the invoking user's own OS privileges, exposes no network service, and stores
+no credentials or user data. This document records the security-relevant
+aspects of the **tool itself** (not the projects it generates).
+
+## Reporting a vulnerability
+
+Open a private security advisory on the GitHub repository, or email the
+maintainer. Please do not file public issues for undisclosed vulnerabilities.
+
+## Dependency management & remediation policy
+
+- **Inventory.** `go.mod` + `go.sum` are the authoritative list of all direct
+  and transitive third-party components. `go.sum` carries integrity hashes
+  verified against the Go checksum database; every module path is a
+  fully-qualified public repository (no dependency-confusion surface).
+- **Scanning.** `govulncheck ./...` runs in CI on every push
+  (`.github/workflows/run-tests.yml`) and fails the build on any advisory that
+  affects called code.
+- **Updates.** Dependabot opens PRs for the `gomod` and `github-actions`
+  ecosystems weekly (`.github/dependabot.yml`).
+- **Remediation windows** (by advisory severity affecting called code):
+  - Critical: ≤ 7 days
+  - High: ≤ 30 days
+  - Moderate / Low: ≤ 90 days
+
+  Advisories in required-but-uncalled modules are bumped opportunistically
+  (e.g. on the next Dependabot PR) rather than under an SLA.
+
+## External communication
+
+The tool is offline at scaffold time. Its only outbound network call is:
+
+- **Host:** `https://registry.npmjs.org/<package>` (hardcoded, HTTPS only)
+- **Trigger:** the maintainer-only `bump` command
+  (`cmd/bump.go`, gated behind the `bump` build tag — not in released binaries)
+- **Auth:** none (anonymous, read-only version metadata)
+- **Client policy** (`cmd/bump.go`): 20s request timeout, no retries, sequential
+  requests, redirects are **not** followed (`CheckRedirect` returns
+  `ErrUseLastResponse`); a failed fetch skips that one package rather than
+  aborting. TLS is left at Go's secure defaults (no `InsecureSkipVerify`).
+
+The package-manager and git subprocesses launched by `PostScaffold` perform
+their own network access using the user's own tool configuration; that is
+outside this tool's control.
+
+## Dangerous functionality
+
+Security-sensitive operations and their safeguards:
+
+- **Subprocess execution** — `pkg/scaffold.go` (`PostScaffold`: `git …`, the
+  package-manager install command) and `pkg/packagejson.go` (`pm --version`).
+  All calls use `exec.Command` with an argument slice (no shell), so there is
+  no shell-metacharacter injection surface. The package-manager value is
+  validated against the registry enum before execution, and install commands
+  originate only from the embedded, trusted `config/registry.json`.
+- **Filesystem writes** — scaffolding writes under the destination directory.
+  The project name / destination is validated (`pkg/validate.go`,
+  `ValidateProjectName` + `ValidateDest`) to a single local path segment, so
+  absolute paths and `..` traversal are rejected before any write.
+- **Outbound HTTP** — see "External communication" above.
+
+## Risky components
+
+Reviewed 2026-07-23 against `go.mod`: no unmaintained, end-of-life, or
+known-vulnerable third-party component identified (`govulncheck` clean).
+Reassess on each Dependabot PR and at least quarterly.