ci(security): add CodeQL SAST + literal Dockerfile digests (close 7 Scorecard alerts)#431

Merged

SoundMindsAI merged 2 commits into

mainfrom

chore_scorecard_codeql_literal_digests

Jun 3, 2026

Commits on Jun 3, 2026

ci(security): add CodeQL SAST + write Dockerfile base-image digests literally

SoundMindsAI
and
claude
committed
ci(security): builder stage inherits from deps (Gemini #431)

SoundMindsAI
and
claude
committed