Security hardening: Renovate, SHA-pinned actions, least-privilege permissions

[mikepenz]

Summary

This PR applies a comprehensive set of CI/CD and supply chain security hardening measures across the repository.

Dependency Management

• Replace Dependabot with self-hosted Renovate (renovate.json + .github/workflows/renovate.yml): enables digest pinning for container images, OSV vulnerability alerts, and 0-day vulnerability patching via immediate PRs rather than weekly batch updates.

GitHub Actions Hardening

• All GitHub Actions pinned to commit SHAs instead of mutable tags, preventing tag-hijacking supply chain attacks.
• Explicit least-privilege permissions: blocks added to every workflow job, following the principle of minimal access.

Workflow Improvements

• commit-dist job added for automated Renovate dist rebuilds, ensuring compiled artifacts stay in sync after dependency updates without manual intervention.
• Fork-protection guard on the test job to prevent untrusted forks from accessing repository secrets.
• SLSA build provenance attestation on releases, placed before release publish to attest build artifacts with verifiable provenance.

Source Code & Package Security

• core.setSecret(token) secret masking added in src/main.ts to prevent token values from leaking into GitHub Actions logs.
• brace-expansion ^5.0.5 CVE override added in package.json to address known vulnerability via overrides field.
• devDependency versions bumped to latest releases.

Developer Experience

• Devcontainer image digest-pinned for reproducible dev environments.
• Broken community TypeScript feature removed from devcontainer config.
• Tokens passed as with: token: inputs rather than environment variables, aligning with GitHub Actions security best practices.

Test plan

• Verify all workflows pass on this branch
• Confirm Renovate workflow triggers correctly on schedule
• Check that release workflow produces SLSA attestation
• Validate that fork PRs are correctly blocked from accessing secrets

[Copilot]

Pull request overview

This PR hardens the repo’s CI/CD and supply-chain posture by migrating dependency automation to Renovate, pinning Actions to immutable SHAs, and tightening workflow permissions/guards while adding a bot-only dist rebuild path.

Changes:

• Add self-hosted Renovate configuration and scheduled workflow; remove Dependabot config.
• Pin GitHub Actions to SHAs and introduce least-privilege permissions across key workflows.
• Add a Renovate-only commit-dist job and token masking in the action runtime.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/main.ts	Masks provided token to prevent accidental log disclosure in CI.
renovate.json	Adds Renovate configuration with digest pinning and vulnerability alert settings.
package.json	Updates devDependencies and adds security-related overrides.
.github/workflows/renovate.yml	Introduces scheduled Renovate workflow.
.github/workflows/codeql-analysis.yml	Pins CodeQL and checkout actions to SHAs.
.github/workflows/build.yml	Adds least-privilege permissions, audit steps, dist auto-rebuild for Renovate, fork guard, release attestation.
.github/dependabot.yml	Removes Dependabot configuration in favor of Renovate.
.devcontainer/devcontainer.json	Pins devcontainer image by digest and removes a broken feature.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

	Tests	Passed ☑️	Skipped	Failed ❌️
Example Pytest Report	4 ran	2 passed	0 skipped	2 failed

Test	Result
Example Pytest Report
test_sample.test_which_succeeds	✅ passed
test_sample.test_which_fails	❌ failure
test_sample.test_with_error	❌ failure
test_sample.test_with_flaky_success	✅ passed

• View Example Pytest Report

[github-actions]

	Tests	Passed ☑️	Skipped ⚠️	Failed ❌️
Example Ungrouped Test Report | test_12.xml	3 ran	2 passed	1 skipped	0 failed
Example Ungrouped Test Report | test_11.xml	3 ran	2 passed	0 skipped	1 failed
Example Ungrouped Test Report | test_10.xml	3 ran	3 passed	0 skipped	0 failed

• View Example Ungrouped Test Report | test_12.xml
• View Example Ungrouped Test Report | test_11.xml
• View Example Ungrouped Test Report | test_10.xml

[github-actions]

	Tests	Passed ✅	Skipped	Failed
Example Nested JUnit Test Report	3 ran	3 passed	0 skipped	0 failed

Test	Result
Example Nested JUnit Test Report
ABC-0199: XMPP Ping
PingIntegrationTest.pingAsync (Normal)	✅ passed
PingIntegrationTest.pingServer (Normal)	✅ passed
ABC-0045: Multi-User Chat
MultiUserIntegrationTest.mucRoleTestForReceivingModerator (Normal)	✅ passed

[Copilot]

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.