ci(security): harden container supply chain

.github/SECURITY.md

@@ -72,8 +72,13 @@ This repository follows the MBGA reliability and security programme:
 - Supply chain controls currently enforce frozen lockfiles, deny dependency
   lifecycle scripts by default in CI, explicitly rebuild audited native/build
   tools, run dependency review and high/critical audits, and enable Dependabot
-  security updates. License enforcement, SBOMs, and signed container artifacts
-  remain tracked completion gates in the repository health program; they are
-  not represented here as already complete.
+  security updates. Container builds additionally use digest-pinned bases,
+  committed locks, high/critical image gates, SPDX SBOMs, SLSA provenance,
+  immutable release tags, and keyless signatures or attestations with
+  verification before release completion. Automated license-policy
+  enforcement and npm-package SBOM/signing remain tracked completion gates in
+  the repository health program; they are not represented here as complete.
 
 See `specs/reliability/` for per-package security status.
+See `docs/reference/container-supply-chain.md` for image release and
+verification procedures.

.github/dependabot.yml

@@ -68,6 +68,39 @@ updates:
         exclude-patterns:
           - '@bsv/*'
 
+  # Keep deployment manifests current. Runtime Dockerfiles are digest-only, so
+  # ignore their bare `node` dependency here: a digest-only Dependabot update
+  # would incorrectly resolve the registry's `latest` tag.
+  - package-ecosystem: docker
+    directories:
+      - /infra
+      - /infra/chaintracks-server
+      - /infra/message-box-server
+      - /infra/overlay-server
+      - /infra/overlay-server/deploy
+      - /infra/uhrp-server-basic
+      - /infra/uhrp-server-cloud-bucket
+      - /infra/wab
+      - /infra/wab/deploy
+      - /infra/wallet-infra
+      - /infra/wallet-infra/guides/kube_samples
+    patterns:
+      - '*'
+    multi-ecosystem-group: monthly-stack-maintenance
+    rebase-strategy: auto
+    ignore:
+      - dependency-name: node
+
+  # Dependabot discovers readable Node version updates here. This file is never
+  # built; repository health requires its version, the governed digest, and all
+  # release Dockerfiles to move together before the grouped PR can merge.
+  - package-ecosystem: docker
+    directory: /governance
+    patterns:
+      - '*'
+    multi-ecosystem-group: monthly-stack-maintenance
+    rebase-strategy: auto
+
   - package-ecosystem: gomod
     directory: /tools/codegen
     patterns:

.github/workflows/ci.yml

@@ -686,6 +686,20 @@ jobs:
           done
           exit 1
 
+      - name: Reject high and critical image vulnerabilities
+        if: matrix.run && matrix.component != 'uhrp-server-cloud-bucket/notifier'
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: image
+          image-ref: ts-stack-${{ strategy.job-index }}:ci
+          scanners: vuln
+          vuln-type: os,library
+          severity: CRITICAL,HIGH
+          ignore-unfixed: false
+          exit-code: '1'
+          format: table
+          timeout: 15m
+
   docs-validate:
     name: Docs Site Validation
     runs-on: ubuntu-latest