chore(deps): bundle Dependabot updates + harden dependency review workflows

[lelia]

Summary

Mirrors the Dependabot hardening patterns established in the Python SDK (SocketDev/socket-sdk-python#84) and Python CLI (SocketDev/socket-python-cli#207 + SocketDev/socket-python-cli#217), adapted to Socket Basics workflows. This adaptation includes support for both uv.lock and Dockerfiles, plus supply chain monitoring for the core OSS tools that Basics leverages. There are four components:

1. Bundle dependency updates — supersedes the 8 open Dependabot PRs in one verified change.
2. Dependabot config hardening — adds the missing uv ecosystem and groups every ecosystem into one minor/patch bundle + a separate major PR.
3. Dependency review — anonymous Socket Firewall smoke on every dependency PR, with an authenticated (enterprise) upgrade path for trusted SocketDev members, plus report artifacts.
4. Core-tool supply-chain watch — discovers the latest upstream versions of OpenGrep / TruffleHog / Trivy / Socket SCA and scores them through the Socket API, even though three of the four are binary/container/GitHub-release tools Dependabot cannot track.

1. Dependencies (supersedes 8 Dependabot PRs)

PR	Package	Bump	Notes
#72	idna	3.10 → 3.18	CVE-2026-45409 fix (resolves newer than Dependabot's 3.15)
#71	pygments	2.19.2 → 2.20.0
#70	urllib3	2.6.3 → 2.7.0
#67	pytest	8.4.2 → 9.0.3
#76	docker/metadata-action	5.10.0 → 6.1.0	major
#75	docker/login-action	3.7.0 → 4.2.0	major
#74	docker/build-push-action	6.19.2 → 7.2.0	major
#73	docker/setup-buildx-action	4.0.0 → 4.1.0	grouped

The four Python bumps are transitive/dev deps — runtime constraints in pyproject.toml are unchanged; targeted uv lock --upgrade-package only (no unrelated lock churn). The four docker/* action SHAs all live in _docker-pipeline.yml. The three major action bumps are pin-by-SHA and validated by the smoke/publish builds. GitHub closing keywords don't close PRs, so the 8 Dependabot PRs must be closed manually after merge.

2. Dependabot config (.github/dependabot.yml)

• Adds the uv ecosystem — the gap that let the idna/pygments/urllib3/pytest PRs pile up ungrouped.
• Every ecosystem (uv, docker ×2, github-actions) now groups into a weekly minor/patch bundle + a separate major PR, so routine bumps land as one review and breaking majors stay isolated.
• GitHub Actions now also scans /.github/actions/* (the new composite action).
• 7-day cooldown retained across all ecosystems.

3. Dependency review (.github/workflows/dependency-review.yml)

Renamed from dependabot-review.yml and now runs on every PR (not just Dependabot's). inspect classifies the PR; exactly one Socket Firewall job runs when Python deps change:

• Enterprise (firewall-enterprise + socket-token) — trusted in-repo (non-fork) non-Dependabot PRs. Token is scoped to the socket-firewall environment, so only this job can read it.
• Free (firewall-free, anonymous, no token) — Dependabot, forks, external contributors, or whenever the token is absent.

Degrades to free whenever the token is missing, so it's safe to ship today and auto-upgrades to enterprise once the socket-firewall environment secret exists — no follow-up PR. Both jobs upload their sfw output as an artifact (sfw-report-free / sfw-report-enterprise). Docker dep changes: the main image is already build-smoke-tested by smoke-test.yml, so only the app_tests image (uncovered elsewhere) is built here.

4. Core-tool supply-chain watch (core-tool-watch.yml + scripts/check_core_tools.py)

The critical addition for socket-basics. Three of its four core tools — OpenGrep (SAST), TruffleHog (secrets), Trivy (containers) — ship as binaries / container images / GitHub releases that Dependabot can't track; the fourth, Socket SCA (socketdev), is a PyPI package. The watcher:

• Discovers the latest upstream version of each (GitHub Releases API + PyPI) and compares against the repo pins (Dockerfile ARGs + uv.lock).
• Scores the relevant package coordinates through the Socket API — dogfooding the socketdev SDK's purl.post() that socket-basics already depends on:
  • pkg:pypi/socketdev@…, pkg:golang/github.com/trufflesecurity/trufflehog/v3@…, pkg:golang/github.com/aquasecurity/trivy@…, pkg:github/opengrep/opengrep@… (best-effort; a missing result is reported, not failed).
• Two intents:
  • schedule / dispatch → watch: analyze pinned and latest, report drift, upsert a core-tool-drift tracking issue.
  • PR / push touching the pins → build: analyze the versions a build would bake in; fail on a malware/critical alert.
• Uploads a core-tools-report artifact (markdown + JSON) and degrades to discovery-only when no token is present (e.g. fork PRs).

Live run today (no token yet) discovered: OpenGrep v1.16.5→v1.22.0, TruffleHog 3.93.8→v3.95.5, Trivy 0.69.3→v0.71.0, socketdev 3.0.29→3.1.1 — all flagged as drift. (Adopting those bumps is intentionally not part of this PR.)

5. Workflow plumbing

• .github/actions/setup-sfw composite action (Python 3.12 + uv + Socket Firewall, free/enterprise).
• python-tests.yml gains a uv lock --locked drift guard.
• No Dependabot-skip logic is needed: unlike the SDK/CLI, socket-basics has no PR workflow (preview/version-increment gate) that should skip on Dependabot PRs — python-tests, smoke-test, and commit-lint all behave correctly on dep bumps as-is.

Test plan

Local (all green):

• uv lock --locked (clean) · uv sync --locked --extra dev · import smoke
• pytest tests/ — 139 passed
• actionlint .github/workflows/*.yml — clean
• zizmor --offline .github/workflows .github/actions — no findings
• YAML parse on all .github files
• scripts/check_core_tools.py in both watch and build mode (token-absent degradation)

Pending (needs the socket-firewall environment secret):

• Maintainer dep PR → python-sfw-smoke-enterprise runs with the env-scoped token
• Dependabot/fork dep PR → python-sfw-smoke-free runs without it
• core-tool-watch scheduled run scores all four PURLs through the Socket API

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pytest@​8.4.2 ⏵ 9.0.3	-3	+2

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pytest@​8.4.2 ⏵ 9.0.3	-3	+2

View full report