feat: implement issue #18 — Scorecard: Pinned-Dependencies (6/10)

[don-petry]

Closes #18

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• Chores
  • Updated CI/CD workflows to reference specific commit SHAs instead of version tags for more predictable and reliable workflow executions
  • Removed duplicate entries from ignore configuration
  • Pinned Docker base images to specific digests for deterministic and secure containerized builds

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 6 minutes and 32 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8c3152de-0d53-4ec4-9b55-7ecd6ca86ae8

📥 Commits

Reviewing files that changed from the base of the PR and between 4e2526a and 46c4bda.

⛔ Files ignored due to path filters (1)

• _bmad-output/planning-artifacts/broodly-prototype.html is excluded by !_bmad-output/**

📒 Files selected for processing (9)

• .github/dependabot.yml
• .github/workflows/dependabot-automerge.yml
• .github/workflows/dependabot-rebase.yml
• .github/workflows/dependency-audit.yml
• .github/workflows/pr-auto-review.yml
• .github/workflows/pr-review-mention.yml
• CLAUDE.md
• apps/api/Dockerfile
• apps/api/Dockerfile.worker

📝 Walkthrough

Walkthrough

This PR hardens dependency resolution by pinning all external references to immutable identifiers: GitHub Actions reusable workflows are pinned to specific commit SHAs instead of version tags, container base images are pinned by digest hash, and a .gitignore duplicate is removed. This directly addresses the OpenSSF Scorecard pinned-dependencies finding.

Changes

Dependency Pinning

Layer / File(s)	Summary
GitHub Actions reusable workflow pinning .github/workflows/dependency-audit.yml, .github/workflows/pr-auto-review.yml, .github/workflows/pr-review-mention.yml, .github/workflows/pr-review.yml, .gitignore	Four workflow jobs update their uses: references from mutable tags (@v2, @main) to pinned commit SHA @376a4fcb1117444595e3e702fa450873d0e54310. The .gitignore file removes duplicate .dev-lead/ rules.
Container base image digest pinning apps/api/Dockerfile, apps/api/Dockerfile.worker	Builder and runtime stages in both Dockerfiles are updated to reference base images by sha256 digest instead of tag-only references: golang:1.24-alpine@sha256:... and gcr.io/distroless/static-debian12@sha256:....

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• petry-projects/broodly#54: Introduced the dependency-audit workflow that is now being pinned to a commit SHA in this PR.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately describes the main objective: implementing a fix for the Pinned-Dependencies Scorecard issue, with specific reference to issue #18 and the current progress (6/10).
Linked Issues check	✅ Passed	The PR successfully addresses issue #18 requirements by pinning all Docker base images and GitHub Actions reusable workflows to specific commit SHAs/digests, directly remedying the 'dependency not pinned by hash' finding.
Out of Scope Changes check	✅ Passed	The .gitignore duplicate entry removal is a minor cleanup unrelated to pinned dependencies, but the change is inconsequential and doesn't interfere with the primary objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-18-20260606-1405

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request pins the Docker base images in apps/api/Dockerfile to specific SHA256 digests for improved security and build reproducibility. Additionally, it appends a duplicate .dev-lead/ entry to .gitignore. The review feedback correctly identifies that this new entry is redundant due to existing duplicates in the file.

[Copilot]

Pull request overview

Pins previously unpinned dependencies (container base images and reusable workflow references) to immutable digests/commit SHAs to improve supply-chain security posture and address OpenSSF Scorecard “Pinned-Dependencies”.

Changes:

• Pin apps/api/Dockerfile base images by digest (@sha256:...).
• Pin reusable workflow callers to specific commit SHAs instead of mutable refs/tags.
• Add another .dev-lead/ ignore entry (introduces further duplication).

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
apps/api/Dockerfile	Pins builder/runtime base images by digest.
.gitignore	Adds an additional .dev-lead/ entry (duplicates existing entries).
.github/workflows/pr-review.yml	Pins reusable workflow ref from @main to a commit SHA.
.github/workflows/pr-review-mention.yml	Pins reusable workflow ref from @v2 to a commit SHA.
.github/workflows/pr-auto-review.yml	Pins reusable workflow ref from @v2 to a commit SHA.
.github/workflows/dependency-audit.yml	Pins reusable workflow ref from @v2 to a commit SHA.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #291
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-06-08T00:40:48Z

[don-petry]

Note

I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-06-08T00:40:48Z

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: Quality Gate evaluation
Root cause: Lint/style

SonarCloud flagged both apps/api/Dockerfile and apps/api/Dockerfile.worker (line 1) with the code smell: "Use either the version tag or the digest for the image instead of both." The PR pinned base images using the combined form golang:1.24-alpine@sha256:..., which violates SonarCloud's Dockerfile maintainability rule. This dropped the Maintainability Rating on New Code to B (Quality Gate requires A).

Suggested fix: Remove the named tag from the FROM directives and keep only the SHA digest — change golang:1.24-alpine@sha256:<hash> to golang@sha256:<hash> (and similarly for the distroless image) in both Dockerfiles.

View analysis details on SonarQube Cloud

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4e2526a481

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[don-petry]

@dev-lead please process and advance this PR — fix any failing CI, resolve outstanding review threads, and enable auto-merge once it's green and approvable.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2eec3b55cc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ccfbb64f2c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Code Analysis (external quality gate)
Root cause: Lint/style

SonarCloud is a static analysis quality gate that scans code for bugs, vulnerabilities, and code smells. Because the details URL (https://sonarcloud.io) contains no GitHub Actions run ID, the exact findings cannot be fetched directly — but the PR diff shows only CI config changes (SHA-pinning of reusable workflow refs and Docker base image digests) with no Go source changes. SonarCloud likely has pre-existing quality gate findings on the branch, or the new Dockerfile digest lines triggered a new rule (e.g. flagging the long SHA strings as suspicious literals).

Suggested fix: Open the SonarCloud dashboard for the petry-projects/broodly project, navigate to the "Pull Requests" tab, select PR #291, and resolve or mark-as-won't-fix any flagged issues so the quality gate passes.

View run logs

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Code Analysis (external quality gate)
Root cause: Env issue

This PR contains only infrastructure changes (pinning Dockerfile base images to digest SHAs, pinning GitHub Actions workflow references to commit SHAs, and adding a Dependabot Docker config) — no application source code was modified. SonarCloud failing on a config-only PR typically indicates either the SONAR_TOKEN secret is unavailable in this workflow context (common when security-restricted secrets are not passed to certain branch/fork runs), or the repository has a pre-existing quality gate violation that was already failing before this PR.

Suggested fix: Check the SonarCloud project dashboard to confirm whether the quality gate was already failing on the base branch before this PR was opened; if so, the failure is unrelated to these changes and the gate should be addressed separately. If the gate was passing on the base branch, verify that SONAR_TOKEN is correctly configured and accessible in the GitHub Actions secrets for this workflow.

[don-petry]

Dev-Lead Fix CI — applied

PR: #291 | SHA: 20f81a9a12c9a755243b09147f85a7c1a77c0e03
Fix committed and pushed. Waiting for CI.

[don-petry]

Dev-Lead — rebase (applied)

Rebase completed and pushed.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

- ✅ All dependency audits **passing**
**Tier 1 Blockers:**
- ❌ `dev-lead / ci-relay` — failed (infrastructure/agent job, not code issue)
- ❌ `dev-lead / dispatch` — failed (infrastructure/agent job, not code issue)
These are dev-lead agent internal jobs unrelated to code changes and appear to be infrastructure-level issues beyond the scope of code review fixes.
**Other reviews noted** a duplicate `.dev-lead/` entry in `.gitignore`, but:
1. That entry does not appear in the current PR's `git diff` 
2. It may be stale feedback from an earlier PR version
3. The reviews are non-blocking `COMMENTED` state
**Conclusion:** No actionable code issues to fix. The Codex comment is a system message, not a code review finding. The PR's code quality status is clean across all automated gates.