ci(053): supply-chain security workflows — CodeQL, Scorecard, dep-review, Trivy, SHA-pinning (WP-B1–B5)

[Dumbris]

Part of spec 053 — OSS Repo Improvements (Track B, the highest-leverage track for a security product). One of ~3 PRs splitting the OSS-report backlog.

What's in here

WP	Adds	Notes
B1 CodeQL	.github/workflows/codeql.yml	Matrix over go + javascript-typescript (covers the Vue frontend/ + website/). build-mode: none for both — avoids flaky autobuild given this repo's -tags server build. Push/PR to main + weekly schedule.
B2 Scorecard	.github/workflows/scorecard.yml + README badge	ossf/scorecard-action with publish_results: true, id-token: write; triggers on branch_protection_rule + schedule + push. SARIF → Security tab. Badge added to the README badge row.
B3 dependency-review	.github/workflows/dependency-review.yml	actions/dependency-review-action gating PRs, fail-on-severity: high, comment-on-failure. (PR-event only — the action requires it.)
B4 Trivy	steps in scanner-images.yml	Scans the pushed ghcr.io/.../scanner-* images (CRITICAL,HIGH; ignore-unfixed). Report-only (exit-code: 0) — scanner base images carry unfixable upstream CVEs; we want visibility, not a broken pipeline. SARIF → Security tab (distinct category per matrix leg). Gated to non-PR events since multi-platform builds can't load locally.
B5 SHA-pin all actions	12 workflow/action files	110 refs across 18 distinct actions pinned @vN → 40-char commit SHA with # vX.Y.Z comments. This is the highest-weight OpenSSF Scorecard item (Pinned-Dependencies). Dependabot (github-actions ecosystem, already configured) keeps them current. Local ./.github/actions/* refs left as path refs.

Verification

• Every pinned SHA was independently re-resolved via gh api (with annotated-tag dereferencing) and matched its # vX.Y.Z comment — zero mismatches across all 18 distinct actions.
• All workflow + composite-action YAML parses cleanly; grep confirms no @vN external refs remain.
• New actions introduced by B1–B4 (codeql-action v4.35.5, scorecard-action v2.4.1, dependency-review-action v4.9.0, trivy-action v0.36.0) are themselves SHA-pinned.

Follow-ups (separate PRs / out of scope)

• B6 (verify/harden branch protection on main to require these checks) is a settings change — not in this PR.
• The disabled build-docker job in release.yml (if: false, "until server MVP") was intentionally not wired for Trivy since it never runs.

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[cloudflare-workers-and-pages]

Deploying mcpproxy-docs with    Cloudflare Pages

Latest commit:	deb39ee
Status:	✅  Deploy successful!
Preview URL:	https://3e7b9c37.mcpproxy-docs.pages.dev
Branch Preview URL:	https://ci-053-supply-chain-security.mcpproxy-docs.pages.dev

View logs

[github-actions]

📦 Build Artifacts

Workflow Run: View Run
Branch: ci/053-supply-chain-security

Available Artifacts

• archive-darwin-amd64 (26 MB)
• archive-darwin-arm64 (23 MB)
• archive-linux-amd64 (15 MB)
• archive-linux-arm64 (13 MB)
• archive-windows-amd64 (26 MB)
• archive-windows-arm64 (23 MB)
• frontend-dist-pr (0 MB)
• installer-dmg-darwin-amd64 (20 MB)
• installer-dmg-darwin-arm64 (18 MB)

How to Download

Option 1: GitHub Web UI (easiest)

1. Go to the workflow run page linked above
2. Scroll to the bottom "Artifacts" section
3. Click on the artifact you want to download

Option 2: GitHub CLI

gh run download 26272759907 --repo smart-mcp-proxy/mcpproxy-go

Note: Artifacts expire in 14 days.