chore(ci): unblock the CVE gate, finish Sonnet 5, parallelize, harden the supply chain (#1223)

Unblocks docker-image-scan (red 5 runs straight on GHSA-f88m-g3jw-g9cj: next's nested sharp@0.34.5, deduped via an override).

Finishes the #1218 Sonnet 5 rollout: compliance-pr and compliance-swarm were falling through to compliancemaxx's sonnet-4-6 default; swedish-compliance-review.mjs budgeted max_tokens as if thinking were off (it is adaptive-by-default on Sonnet 5) and never checked stop_reason; pr-agent's token budgets were sized for 4.6's tokenizer and its hidden default OpenAI fallback list is now emptied explicitly.

Core build 7m43s -> 2m51s measured (parallel checks/build/test, unit suite sharded 4 ways). Docker publish moves off QEMU to native ARM runners with a digest-merge job, so tags apply only on success and latest never moves on failure.

40 actions pinned to immutable SHAs; adds zizmor (0 high after fixing persist-credentials on 7 checkouts and permissions on test-pg-real) and CodeQL (0 findings on first run).

Full details in the PR body.

.github/workflows/ci-cache.yml

@@ -0,0 +1,54 @@
+name: CI cache warm
+
+# The save half of the npm cache that .github/actions/setup-core restores.
+#
+# It has to live in its own main-branch workflow. GitHub scopes a cache entry to
+# the ref that wrote it, with one exception: entries written on the default
+# branch are readable from every branch and PR. core-build.yml runs on
+# pull_request only, so anything it saved would be readable by exactly one PR
+# and dead the moment that PR merged. That is not hypothetical here: a naive
+# `cache: npm` on the pg-real workflow once put fourteen 284 MB copies (4 GB,
+# 40% of the repo quota) on disk in a day, none of them ever restorable.
+#
+# So: main saves, PRs restore-only. Keyed on the lockfile hash, so this runs
+# only when dependencies actually move and each entry is read many times before
+# it is replaced.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - package-lock.json
+      - package.json
+  workflow_dispatch: {}
+
+concurrency:
+  group: ci-cache
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  warm:
+    name: Warm npm cache
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 20
+
+      # Populates ~/.npm. `npm ci` deletes node_modules first, so this measures
+      # a cold install the same way a PR job will.
+      - run: npm ci
+
+      # A no-op when the key already exists, which is the intent: one entry per
+      # lockfile state, not one per push.
+      - name: Save npm cache
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ~/.npm
+          key: npm-${{ runner.os }}-node20-${{ hashFiles('package-lock.json') }}

.github/workflows/codeql.yml

@@ -0,0 +1,71 @@
+name: CodeQL
+
+# Semantic code scanning. The repo already had `security-events: write` and
+# uploaded Trivy SARIF, but Trivy only reports known CVEs in dependencies and
+# base images: nothing analysed the application's own code. For a multi-tenant
+# accounting SaaS holding personnummer, bank data and money, that was the gap.
+#
+# Two languages:
+#   javascript-typescript - the app itself (injection, path traversal, unsafe
+#     deserialization, missing authorization checks, hardcoded credentials).
+#   actions - GitHub's own workflow analysis. It overlaps zizmor.yml without
+#     replacing it: CodeQL follows dataflow into composite actions, zizmor knows
+#     Actions-specific misconfigurations CodeQL has no notion of. Two cheap
+#     scanners with different blind spots beat one.
+#
+# The default query suite is used deliberately. `security-extended` finds more
+# but roughly doubles the runtime, and this already runs on every PR; revisit
+# once the default suite's findings are triaged.
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  schedule:
+    # Weekly. CodeQL ships new queries continuously, so an unchanged repo can
+    # still acquire findings.
+    - cron: '19 3 * * 1'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      # Required to upload the analysis results.
+      security-events: write
+      # Required by the `actions` language pack to read workflow metadata.
+      actions: read
+    strategy:
+      # A failure in one language should not hide the other's results.
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript, actions]
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
+        with:
+          languages: ${{ matrix.language }}
+
+      # No build step. javascript-typescript and actions are both interpreted
+      # languages to CodeQL, extracted straight from source, so `npm ci` and
+      # `next build` would add minutes and change nothing about the database.
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
+        with:
+          category: /language:${{ matrix.language }}

.github/workflows/compliance-pr.yml

@@ -23,11 +23,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
-      - uses: erp-mafia/compliancemaxx@v2
+      - uses: erp-mafia/compliancemaxx@248cebcf90867fa813a8c0a2bc66cca70a56db3a # v2
         with:
           base: ${{ github.event.pull_request.base.sha }}
           fail-on-findings: false           # advisory while bedding in
@@ -35,3 +35,10 @@ jobs:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_REGION: eu-north-1
+          # Pin the review model explicitly. compliancemaxx falls back to
+          # `eu.anthropic.claude-sonnet-4-6` when this is unset
+          # (packages/cli/src/llm/bedrock.ts), so leaving it out silently kept
+          # this workflow a generation behind the rest of the repo after the
+          # Sonnet 5 migration (#1218). Keep in sync with
+          # swedish-compliance-review.yml and lib/agent/composer/client.ts.
+          COMPLIANCE_BEDROCK_MODEL: eu.anthropic.claude-sonnet-5

.github/workflows/compliance-swarm.yml

@@ -40,11 +40,11 @@ jobs:
     timeout-minutes: 60
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
-      - uses: erp-mafia/compliancemaxx@v2
+      - uses: erp-mafia/compliancemaxx@248cebcf90867fa813a8c0a2bc66cca70a56db3a # v2
         with:
           mode: audit                    # v2 name; was `swarm` in v1
           llm-provider: bedrock
@@ -53,5 +53,9 @@ jobs:
           AWS_REGION: eu-north-1
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          # Override default model if desired:
-          # COMPLIANCE_BEDROCK_MODEL: 'eu.anthropic.claude-sonnet-5'
+          # Pin the audit model explicitly rather than leaving this commented
+          # out. compliancemaxx defaults to `eu.anthropic.claude-sonnet-4-6`
+          # when it is unset (packages/cli/src/llm/bedrock.ts), which quietly
+          # kept the nightly audit a generation behind after #1218. Keep in
+          # sync with compliance-pr.yml and lib/agent/composer/client.ts.
+          COMPLIANCE_BEDROCK_MODEL: eu.anthropic.claude-sonnet-5

.github/workflows/core-build.yml

@@ -1,44 +1,63 @@
 name: Core Build (no extensions)
 
+# Split out of a single serial job that took 7m43s wall-clock: npm ci 24s, lint
+# ratchet 1m29s, build 2m00s, unit tests 3m31s, ratchets ~10s. None of those
+# stages needed the previous one's output, so they were serial only by
+# accident. Running them as independent jobs (and sharding the 897-file unit
+# suite four ways) puts the critical path on `build` at roughly 2m30s.
+#
+# The prologue each job needs is in .github/actions/setup-core.
+
 on: [pull_request]
 
+# Six concurrent jobs per push makes stale runs far more expensive than they
+# were when this was one job, and a superseded push has nothing worth finishing.
+concurrency:
+  group: core-build-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
-  core-only:
+  checks:
+    name: Checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
-          node-version: 20
-      - run: npm ci
+          # Nothing here pushes, so leaving the token in .git/config only widens
+          # what a compromised dependency in the build could reach.
+          persist-credentials: false
+      - uses: ./.github/actions/setup-core
+
       - name: Verify skill bodies are in sync with the seed migration
         # Fails if a .claude/skills/**/SKILL.md changed without regenerating the
         # seed migration (npm run skills:generate). Keeps prod skill content from
         # silently drifting out of sync. No DB needed: reads files + manifest.
         run: npm run skills:check
+
       - name: Verify taxonomy registry is in sync with the element lists
         # Fails if dev_docs/bokslut/taxonomi/** changed without regenerating
         # lib/bokslut/ixbrl/taxonomy/generated/ (npm run taxonomy:generate).
         # The iXBRL generator emits facts strictly from the generated registry,
         # so drift here means filings tagged against a stale concept set.
         run: npm run taxonomy:check
-      - name: Reset extensions config
-        run: echo '{"extensions":[]}' > extensions.config.json
-      - run: npm run setup:extensions
+
       - name: Lint ratchet (no new ESLint errors)
         # `npm run lint` was never wired into CI, so ~60 legacy errors
         # accumulated. This ratchet (sibling of check:guards) fails only when
         # a PR ADDS an error beyond scripts/checks/eslint-baseline.json; the
         # baseline ratchets down as legacy errors get fixed.
         run: npm run check:lint
-      - run: npm run build
-      - run: npm test
+
       - name: Antipattern ratchet (no new MFA-bypassing routes / naive öre-rounding)
         # Fails only if a PR ADDS a route that hand-rolls supabase.auth.getUser()
         # instead of the MFA-enforcing guard, or a new Math.round(x*100)/100.
         # Baseline lives in scripts/checks/antipatterns-baseline.json and ratchets
         # down as the A1 (route auth) and D1 (rounding) migrations land.
         run: npm run check:guards
+
       - name: Check no core imports from extensions
         run: |
           VIOLATIONS=$(grep -r "from '@/extensions/" lib/ app/api/ components/ --include="*.ts" --include="*.tsx" \
@@ -51,3 +70,71 @@ jobs:
             echo "$VIOLATIONS"
             exit 1
           fi
+
+  build:
+    name: Build (zero extensions)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          # Nothing here pushes, so leaving the token in .git/config only widens
+          # what a compromised dependency in the build could reach.
+          persist-credentials: false
+      - uses: ./.github/actions/setup-core
+      - run: npm run build
+
+  test:
+    # 897 unit test files (11,341 tests) take 3m31s in one process. Measured
+    # locally, four shards split them 225/224/224/224 with the slowest at 64s,
+    # which puts this comfortably under the build job so it stops being the
+    # critical path. Vitest hard-errors when the shard count exceeds the
+    # resolved file count, which is nowhere near a concern at this size.
+    name: Unit tests (${{ matrix.shard }}/4)
+    runs-on: ubuntu-latest
+    strategy:
+      # One shard failing should not hide failures in the other three: a red PR
+      # is more useful when it lists every broken test, not just the first.
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          # Nothing here pushes, so leaving the token in .git/config only widens
+          # what a compromised dependency in the build could reach.
+          persist-credentials: false
+      - uses: ./.github/actions/setup-core
+      # Via env rather than interpolated straight into the shell body: the value
+      # is a static matrix integer and harmless, but keeping every `run:` free of
+      # ${{ }} is the rule that makes the template-injection audit meaningful.
+      - run: npm test -- --shard="$SHARD/4"
+        env:
+          SHARD: ${{ matrix.shard }}
+
+  core-build:
+    # One stable check name covering all six jobs above, so the PR checks list
+    # (and any future required-status-check rule) has a single thing to read
+    # rather than a shard-numbered matrix. `needs` alone would not be enough:
+    # a needed job that is skipped or cancelled does not fail its dependents,
+    # so the results are asserted explicitly.
+    name: Core Build
+    if: always()
+    needs: [checks, build, test]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Assert every core job succeeded
+        env:
+          CHECKS: ${{ needs.checks.result }}
+          BUILD: ${{ needs.build.result }}
+          TEST: ${{ needs.test.result }}
+        run: |
+          set -euo pipefail
+          echo "checks=$CHECKS build=$BUILD test=$TEST"
+          failed=0
+          for r in "$CHECKS" "$BUILD" "$TEST"; do
+            [ "$r" = "success" ] || failed=1
+          done
+          if [ "$failed" -ne 0 ]; then
+            echo "::error::One or more core-build jobs did not succeed"
+            exit 1
+          fi

.github/workflows/docker-image-scan.yml

@@ -61,14 +61,14 @@ jobs:
 
     steps:
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Scan published image with Trivy
-        uses: aquasecurity/trivy-action@v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
           # Block on fixable CRITICAL/HIGH: the same policy the build pipeline
@@ -92,7 +92,7 @@ jobs:
         # scan step above failed the run. Same category as docker-publish.yml so
         # the two analyses share one alert set instead of duplicating.
         if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
         with:
           sarif_file: trivy-results.sarif
           category: trivy
@@ -109,12 +109,12 @@ jobs:
       security-events: write
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: Scan npm lockfile with Trivy
-        uses: aquasecurity/trivy-action@v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           # Filesystem scan: picks up package-lock.json and reports known CVEs
           # in the resolved dependency tree, including transitive pins. Same
@@ -136,7 +136,7 @@ jobs:
         # step failed the run. Distinct category from the image scan so
         # dependency alerts and image alerts stay separately traceable.
         if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
         with:
           sarif_file: trivy-sca.sarif
           category: trivy-sca

.github/workflows/docker-publish.yml

@@ -1,63 +1,88 @@
 name: Build and Push Docker Image
 
+# Builds each platform on its own native runner, then stitches the two into one
+# manifest list.
+#
+# This was a single amd64 job emulating arm64 through QEMU and took ~31 minutes:
+# QEMU translates every Arm instruction into x86, so the arm64 half ran several
+# times slower than the amd64 half it shared a runner with. GitHub's free
+# `ubuntu-24.04-arm` runners (public repos) remove the emulation entirely, and
+# the two halves now run concurrently on their own hardware.
+#
+# The cost is a second job. A native single-platform build cannot produce a
+# multi-platform manifest by itself, so each build pushes an untagged,
+# digest-addressed image and `merge` composes the tag list from those digests
+# with `imagetools create`. Tagging, signing, and scanning all belong to `merge`,
+# because the digest consumers actually resolve is the manifest list's, not
+# either platform's.
+#
+# workflow_dispatch is deliberate: it makes this runnable from a branch before
+# merge. On a non-default branch the is_default_branch guard below disables the
+# `latest` tag, so a dispatch run publishes only the immutable commit-sha tag and
+# cannot move what production pulls.
+
 on:
   push:
     branches: [main]
     tags: ['v*.*.*']
+  workflow_dispatch: {}
 
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: erp-mafia/gnubok
 
 jobs:
-  build-and-push:
-    runs-on: ubuntu-latest
+  build:
+    name: Build ${{ matrix.platform }}
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      # Publishing one architecture and silently dropping the other is worse
+      # than publishing neither: the merge below needs both digests.
+      fail-fast: true
+      matrix:
+        include:
+          - platform: linux/amd64
+            arch: amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            arch: arm64
+            runner: ubuntu-24.04-arm
     permissions:
       contents: read
       packages: write
-      # OIDC token used by cosign keyless signing.
-      id-token: write
-      # SARIF upload to the repo's "Security" tab from the Trivy scan.
-      security-events: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          # The build pushes to GHCR via docker/login-action, never over git, so
+          # the git credential is dead weight inside a Docker build context.
+          persist-credentials: false
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # Labels only. Tags are applied once, to the manifest list, in `merge`.
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          # On main: push `latest` + commit-sha tags.
-          # On v*.*.* tags: push semver tags (1.2.3, 1.2, 1) for production pinning.
-          tags: |
-            type=raw,value=latest,enable={{is_default_branch}}
-            type=sha,prefix=
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
-      - name: Build and push
+      # No setup-qemu-action. That was the whole point: each runner now builds
+      # its own architecture natively.
+      - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
+          platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             EXTENSIONS_PRESET=self-hosted
@@ -65,6 +90,10 @@ jobs:
           # OCI attestations, queryable via `docker buildx imagetools inspect`.
           provenance: mode=max
           sbom: true
+          # push-by-digest publishes without a tag; `merge` collects the digests
+          # and builds the tag list from them. name-canonical records the
+          # repository name in the config so the merged manifest resolves.
+          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
           # Layer cache lives in GHCR, not the GitHub Actions cache. Two
           # platforms x mode=max is ~7 GB, which alone ate 70% of the repo's
           # 10 GB Actions cache quota and, because buildx refreshes every blob's
@@ -74,23 +103,138 @@ jobs:
           # would drop the deps/builder stages and make every push redo
           # `npm ci` + `next build`.
           #
-          # A single stable cache tag is safe here: this workflow only runs on
-          # main and v*.*.* tags, and tags are cut from main, so there is no
-          # untrusted ref that could poison the layers.
+          # The cache tag is now per-architecture. Each runner builds a single
+          # platform, so a shared tag would leave the two jobs racing to
+          # overwrite a cache manifest describing layers the other cannot use.
+          #
+          # A stable cache tag is safe here: this workflow runs only on main,
+          # on v*.*.* tags (cut from main), and on manual dispatch, so there is
+          # no untrusted ref that could poison the layers.
           #
           # image-manifest=true,oci-mediatypes=true is required by GHCR, which
           # rejects buildkit's default cache manifest media type.
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max,image-manifest=true,oci-mediatypes=true
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache-${{ matrix.arch }}
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache-${{ matrix.arch }},mode=max,image-manifest=true,oci-mediatypes=true
 
-      - name: Install cosign
-        uses: sigstore/cosign-installer@v4.1.2
-
-      - name: Sign the image (keyless OIDC)
+      # Digests reach `merge` as artifact filenames: the file content is
+      # irrelevant, only the name carries information.
+      - name: Export digest
         env:
           DIGEST: ${{ steps.build.outputs.digest }}
         run: |
-          cosign sign --yes "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"
+          set -euo pipefail
+          mkdir -p /tmp/digests
+          touch "/tmp/digests/${DIGEST#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: digests-${{ matrix.arch }}
+          path: /tmp/digests/*
+          # A silently empty artifact would surface later as an imagetools
+          # invocation with no source digests, which is a much worse error.
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    name: Merge, sign and scan
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: read
+      packages: write
+      # OIDC token used by cosign keyless signing.
+      id-token: write
+      # SARIF upload to the repo's "Security" tab from the Trivy scan.
+      security-events: write
+
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          path: /tmp/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - name: Log in to GHCR
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          # On main: push `latest` + commit-sha tags.
+          # On v*.*.* tags: push semver tags (1.2.3, 1.2, 1) for production pinning.
+          # A workflow_dispatch run from a branch gets the sha tag only, because
+          # is_default_branch gates `latest`.
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha,prefix=
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+
+      - name: Create and push manifest list
+        working-directory: /tmp/digests
+        run: |
+          set -euo pipefail
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf "${REGISTRY}/${IMAGE_NAME}@sha256:%s " *)
+
+      # Cosign and Trivy must address the manifest list, not either platform's
+      # image: the list digest is what `docker pull` resolves for consumers, so
+      # it is the thing worth signing and the thing worth scanning.
+      - name: Resolve manifest list digest
+        id: manifest
+        env:
+          VERSION: ${{ steps.meta.outputs.version }}
+        run: |
+          set -euo pipefail
+          DIGEST=$(docker buildx imagetools inspect \
+            "${REGISTRY}/${IMAGE_NAME}:${VERSION}" \
+            --format '{{json .Manifest}}' | jq -r '.digest')
+          echo "Resolved ${REGISTRY}/${IMAGE_NAME}:${VERSION} -> ${DIGEST}"
+          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
+
+      - name: Verify both platforms are present
+        # A merge that quietly produced a single-arch manifest would ship a
+        # broken image to every arm64 self-hoster, and nothing downstream checks
+        # architecture. Assert it here while the digest is still in hand.
+        env:
+          DIGEST: ${{ steps.manifest.outputs.digest }}
+        run: |
+          set -euo pipefail
+          PLATFORMS=$(docker buildx imagetools inspect \
+            "${REGISTRY}/${IMAGE_NAME}@${DIGEST}" --raw \
+            | jq -r '[.manifests[]
+                      | select(.platform != null)
+                      | select(.platform.os != "unknown")
+                      | "\(.platform.os)/\(.platform.architecture)"]
+                     | sort | unique | join(",")')
+          echo "Manifest platforms: ${PLATFORMS}"
+          [ "$PLATFORMS" = "linux/amd64,linux/arm64" ] || {
+            echo "::error::Expected linux/amd64,linux/arm64 but got ${PLATFORMS}"
+            exit 1
+          }
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - name: Sign the image (keyless OIDC)
+        env:
+          DIGEST: ${{ steps.manifest.outputs.digest }}
+        run: |
+          set -euo pipefail
+          cosign sign --yes "${REGISTRY}/${IMAGE_NAME}@${DIGEST}"
 
       - name: Scan image with Trivy (report-only)
         id: trivy
@@ -108,9 +252,9 @@ jobs:
         # Accepted residual risk: an image is live for that short scan window
         # before the gate fires; see docs/SELF-HOSTING.md / the risk register.
         continue-on-error: true
-        uses: aquasecurity/trivy-action@v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
-          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.manifest.outputs.digest }}
           severity: CRITICAL,HIGH
           exit-code: '0'
           ignore-unfixed: true
@@ -125,7 +269,7 @@ jobs:
         # hiccup can't redden an otherwise-good publish.
         if: always()
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
         with:
           sarif_file: trivy-results.sarif
           category: trivy

.github/workflows/pr-agent.yml

@@ -64,15 +64,25 @@ jobs:
           # ── Model: Claude Sonnet 5 via the EU Bedrock inference profile. The
           #    strong and weak slots both point at it: this account has no larger
           #    model enabled, so a second id would only be the same model under
-          #    another name. No FALLBACK_MODELS for the same reason: a fallback
-          #    list naming the primary is not a fallback. custom_model_max_tokens
-          #    is required because this id is not in PR-Agent's built-in map.
+          #    another name. custom_model_max_tokens is required because this id
+          #    is not in PR-Agent's built-in map.
           CONFIG.MODEL: "bedrock/eu.anthropic.claude-sonnet-5"
           CONFIG.MODEL_WEAK: "bedrock/eu.anthropic.claude-sonnet-5"
-          CONFIG.CUSTOM_MODEL_MAX_TOKENS: "200000"
+          # Emptied explicitly. This block previously said it set no fallback
+          # list, but "unset" is not "none": PR-Agent's own default is
+          # ["gpt-5.6-terra"], visible in the resolved config it logs on every
+          # run. Only AWS credentials reach this container, so that fallback
+          # could never have authenticated, but a silent third-party model in
+          # the path of every PR diff should be absent by intent, not by a
+          # missing key.
+          CONFIG.FALLBACK_MODELS: "[]"
+          CONFIG.CUSTOM_MODEL_MAX_TOKENS: "1000000"
           # Input window PR-Agent prunes the diff to fit. Default (~32k) truncated
           # large PRs; raise it so the whole diff is reviewed (Sonnet 5 = 1M ctx).
-          CONFIG.MAX_MODEL_TOKENS: "64000"
+          # 64000 was tuned against Sonnet 4.6's tokenizer. Sonnet 5 tokenizes the
+          # same text into roughly 30% more tokens, so that budget silently held
+          # ~30% less real diff after #1218; 96000 restores parity with headroom.
+          CONFIG.MAX_MODEL_TOKENS: "96000"
           LITELLM.DROP_PARAMS: "true"
 
           # ── pr_actions = which GitHub PR *event actions* trigger the bot

.github/workflows/swedish-compliance-diff.yml

@@ -19,7 +19,7 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
@@ -41,7 +41,7 @@ jobs:
           git diff --name-only "$MERGE_BASE" HEAD > files.txt
           printf '%s\n' "$PR_NUMBER" > pr-number.txt
       - name: Upload diff artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: compliance-input
           path: |

.github/workflows/swedish-compliance-review.yml

@@ -33,14 +33,14 @@ jobs:
       # Base repo only: the TRUSTED copy of the script and .claude/skills/.
       # persist-credentials: false, no later step needs git push creds, so don't
       # leave the token in .git/config for the steps that handle untrusted input.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 20
       - name: Download diff artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: compliance-input
           run-id: ${{ github.event.workflow_run.id }}

.github/workflows/test-pg-real.yml

@@ -2,6 +2,12 @@ name: pg-real tests
 
 on: [pull_request]
 
+# Neither job writes anything back: they read the repo, stand up a throwaway
+# Postgres, and run tests. Without this block both inherit the repository's
+# default token permissions, which are broader than that.
+permissions:
+  contents: read
+
 concurrency:
   group: pg-real-${{ github.ref }}
   cancel-in-progress: true
@@ -14,11 +20,12 @@ jobs:
     # (<reason>)` comments inside the migration.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # Full history so the merge-base with the PR base branch exists.
           fetch-depth: 0
-      - uses: actions/setup-node@v6
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 20
       - name: Require pg-real coverage for trigger/RPC/RLS migrations
@@ -50,7 +57,9 @@ jobs:
       PGPASSWORD: postgres
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       # Deliberately no `cache: npm` here. This workflow runs on pull_request
       # only, so the cache is never written on main, and GitHub scopes caches
@@ -59,7 +68,7 @@ jobs:
       # the repo quota) accumulated in a single day. If this is ever worth
       # caching again, it has to be actions/cache/save on main plus
       # actions/cache/restore here, which is the only shape that gets hits.
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 20
 

.github/workflows/zizmor.yml

@@ -0,0 +1,81 @@
+name: Workflow audit (zizmor)
+
+# Static analysis for the workflows themselves. Every other scanner in this repo
+# looks at application code or container contents; nothing looked at CI, which is
+# where the credentials live.
+#
+# The motivating incident is concrete: in March 2026 attackers exploited a
+# pull_request_target misconfiguration in aquasecurity/trivy-action (an action
+# this repo uses in three places) to exfiltrate org and repo secrets, then used
+# them to backdoor LiteLLM on PyPI. zizmor's dangerous-triggers and
+# unpinned-uses audits cover exactly that class.
+#
+# Installed from PyPI at a pinned version rather than via zizmorcore/zizmor-action:
+# a workflow whose job is to check the supply chain should not widen it.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    # Weekly, off the hour to dodge cron congestion on GitHub. New audits ship
+    # regularly, so a repo that stopped changing can still start failing here.
+    - cron: '41 5 * * 1'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  audit:
+    name: Audit workflows
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      # SARIF upload to the repo's "Security" tab.
+      security-events: write
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      # pipx is preinstalled on GitHub's ubuntu runners. Exact pin, because an
+      # unpinned install here would be the same mistake this workflow exists to
+      # catch.
+      - name: Install zizmor
+        run: pipx install zizmor==1.28.0
+
+      - name: Audit workflows (SARIF)
+        env:
+          # Lets zizmor run its online audits (resolving `uses:` refs against
+          # the forge) instead of falling back to offline-only checks.
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        # zizmor suppresses its findings-based exit codes under --format=sarif,
+        # so this step reports and never gates. The gate is the separate step
+        # below, which is why the audit is run twice.
+        run: zizmor --format=sarif . > zizmor.sarif
+
+      - name: Upload zizmor results to GitHub Security tab
+        # if: always() so findings still reach the Security tab when the gate
+        # below fails the run. Distinct category from the Trivy uploads so
+        # workflow findings stay separately traceable.
+        if: always()
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
+        with:
+          sarif_file: zizmor.sarif
+          category: zizmor
+
+      - name: Gate on high-severity, high-confidence findings
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        # Deliberately narrower than the SARIF report above. Everything zizmor
+        # finds is visible in the Security tab; only findings it is confident are
+        # high severity block a merge. Tighten by lowering --min-severity once
+        # the backlog is clear.
+        run: zizmor --min-severity=high --min-confidence=high --format=plain .