fix(release): develop to main

.github/dependabot.yml

@@ -74,6 +74,10 @@ updates:
           - "trufflesecurity/trufflehog"
           - "anchore/sbom-action"
           - "sigstore/cosign-installer"
+          # Only reachable if SocketDev/action is ever referenced from a workflow;
+          # its current use is in src/security/socket-firewall, which the
+          # github-actions ecosystem does not scan (see note at the top).
+          - "SocketDev/action"
         update-types:
           - "minor"
           - "patch"

.github/workflows/go-ci.yml

@@ -79,10 +79,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7
         with:
           go-version: ${{ matrix.go }}
           cache: true
@@ -101,7 +101,7 @@ jobs:
 
       - name: Upload coverage artifact
         if: inputs.enable_coverage_comment && matrix.os == 'ubuntu-latest' && matrix.go == inputs.go_version_lint
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: coverage-report
           path: coverage.txt
@@ -118,15 +118,15 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Download coverage artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
         with:
           name: coverage-report
 
       - name: Go Coverage Comment
-        uses: fgrosse/go-coverage-report@v1.3.0
+        uses: fgrosse/go-coverage-report@e432de98ee94a276e8f666d25bfd76347665f75b  # v1.3.1
         with:
           coverage-artifact-name: coverage-report
           coverage-file-name: coverage.txt
@@ -137,16 +137,16 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7
         with:
           go-version: ${{ inputs.go_version_lint }}
           cache: true
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a  # v9
         with:
           version: ${{ inputs.golangci_lint_version }}
           args: ${{ inputs.golangci_lint_args }}
@@ -159,17 +159,20 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7
         with:
           go-version: ${{ inputs.go_version_lint }}
           cache: true
 
       - name: Build cross-platform binaries
+        env:
+          BUILD_TARGETS: ${{ inputs.build_targets }}
+          BUILD_PATH: ${{ inputs.build_path }}
         run: |
-          targets='${{ inputs.build_targets }}'
+          targets="$BUILD_TARGETS"
           if [ "$targets" = "[]" ] || [ -z "$targets" ]; then
             echo "No build targets specified, using defaults"
             targets='[
@@ -181,21 +184,21 @@ jobs:
             ]'
           fi
 
-          echo "$targets" | jq -c '.[]' | while read target; do
-            os=$(echo $target | jq -r '.os')
-            arch=$(echo $target | jq -r '.arch')
+          echo "$targets" | jq -c '.[]' | while read -r target; do
+            os=$(echo "$target" | jq -r '.os')
+            arch=$(echo "$target" | jq -r '.arch')
             binary_name="${{ github.event.repository.name }}-${os}-${arch}"
 
             if [ "$os" = "windows" ]; then
               binary_name="${binary_name}.exe"
             fi
 
             echo "Building for $os/$arch..."
-            GOOS=$os GOARCH=$arch go build -o build/$binary_name ${{ inputs.build_path }}
+            GOOS="$os" GOARCH="$arch" go build -o "build/$binary_name" "$BUILD_PATH"
           done
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: binaries
           path: build/
@@ -208,10 +211,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7
         with:
           go-version: ${{ inputs.go_version_lint }}
           cache: true
@@ -227,10 +230,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7
         with:
           go-version: ${{ inputs.go_version_lint }}
           cache: true
@@ -253,7 +256,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Check required files
         run: |
@@ -265,7 +268,7 @@ jobs:
           test -f LICENSE
 
       - name: Validate Markdown links
-        uses: tcort/github-action-markdown-link-check@v1
+        uses: tcort/github-action-markdown-link-check@e047c5b37f24ab722bbef1a27b6fab7f96bc4068  # v1
         with:
           use-quiet-mode: 'yes'
           config-file: '.github/markdown-link-check-config.json'