chore(ci): unblock the CVE gate, finish Sonnet 5, parallelize, harden the supply chain (#1223)

Unblocks docker-image-scan (red 5 runs straight on GHSA-f88m-g3jw-g9cj: next's nested sharp@0.34.5, deduped via an override).

Finishes the #1218 Sonnet 5 rollout: compliance-pr and compliance-swarm were falling through to compliancemaxx's sonnet-4-6 default; swedish-compliance-review.mjs budgeted max_tokens as if thinking were off (it is adaptive-by-default on Sonnet 5) and never checked stop_reason; pr-agent's token budgets were sized for 4.6's tokenizer and its hidden default OpenAI fallback list is now emptied explicitly.

Core build 7m43s -> 2m51s measured (parallel checks/build/test, unit suite sharded 4 ways). Docker publish moves off QEMU to native ARM runners with a digest-merge job, so tags apply only on success and latest never moves on failure.

40 actions pinned to immutable SHAs; adds zizmor (0 high after fixing persist-credentials on 7 checkouts and permissions on test-pg-real) and CodeQL (0 findings on first run).

Full details in the PR body.

This commit is contained in:

Jakob Wennberg

2026-07-27 12:01:03 +02:00

committed by

GitHub

parent bcbe9b0903

commit 5369349e9e

18 changed files with 650 additions and 592 deletions

									
										package.json
									
		+2
		-1
	
												View File
												
				@@ -94,6 +94,7 @@

				    "vitest": "^4.1.9"

				  },

				  "overrides": {

				    "ws": "^8.21.0"

				    "ws": "^8.21.0",

				    "sharp": "^0.35.3"

				  }

				}