TASK-531: Audit remediation: harden scanner, viewer, and store surfaces (37 triple-validated findings)

.github/workflows/architecture.yml

@@ -58,7 +58,7 @@ jobs:
       matrix:
         pull: ${{ fromJSON(needs.pulls.outputs.open) }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ matrix.pull.base }}
           fetch-depth: 0
@@ -91,7 +91,7 @@ jobs:
           mkdir -p "preview/comparison/pr-$NUMBER"
           mv "$MAP" "preview/comparison/pr-$NUMBER/$GROMA_THEME"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: groma-comparison-${{ matrix.pull.number }}
           path: preview
@@ -103,15 +103,15 @@ jobs:
     if: ${{ !cancelled() }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - uses: oven-sh/setup-bun@v2.2.0
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: '1.4.3'
 
-      - uses: actions/configure-pages@v6.0.0
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
         id: pages
 
       - name: Install dependencies
@@ -140,13 +140,13 @@ jobs:
 
       - name: Add the pull request comparisons
         if: needs.compare.result == 'success' || needs.compare.result == 'failure'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           pattern: groma-comparison-*
           merge-multiple: true
           path: ./site
 
-      - uses: actions/upload-pages-artifact@v5.0.0
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: ./site
 
@@ -165,7 +165,7 @@ jobs:
     steps:
       - name: Publish architecture website
         id: deployment
-        uses: actions/deploy-pages@v5.0.1
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
 
       - name: Link to the architecture map
         id: map-url
@@ -181,7 +181,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           pattern: groma-comparison-*
           merge-multiple: true

.github/workflows/ci.yml

@@ -22,10 +22,10 @@ jobs:
         os: [ubuntu-24.04, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Cache Swift test package
         id: swift-package
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: scanner-packages/swift
           key: >-
@@ -37,7 +37,7 @@ jobs:
               'LICENSE') }}
       - name: Cache SwiftSyntax build
         if: runner.os == 'Windows' && steps.swift-package.outputs.cache-hit != 'true'
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .groma/swift-syntax-build
           key: >-
@@ -46,7 +46,7 @@ jobs:
               'plugins/scanners/swift/Package.swift') }}
       - name: Cache C# test package
         id: csharp-package
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: scanner-packages/csharp
           key: >-
@@ -58,7 +58,7 @@ jobs:
               'bun.lock', 'LICENSE') }}
       - name: Cache Rust test package
         id: rust-package
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: plugins/scanners/rust/dist
           key: >-
@@ -70,22 +70,22 @@ jobs:
               'bun.lock', 'LICENSE') }}
       - uses: ./.github/actions/setup-swift
         if: steps.swift-package.outputs.cache-hit != 'true'
-      - uses: actions/setup-java@v6
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '25'
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: plugins/scanners/go/worker/go.mod
           cache-dependency-path: plugins/scanners/go/worker/go.sum
-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
       - name: Install Rust build toolchain
         if: steps.rust-package.outputs.cache-hit != 'true'
         run: rustup toolchain install "$RUST_VERSION" --profile minimal
         shell: bash
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: ${{ env.BUN_VERSION }}
       - name: Install dependencies

.github/workflows/release.yml

@@ -24,13 +24,13 @@ jobs:
     name: validate-release
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup-swift
-      - uses: actions/setup-java@v6
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '25'
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: ${{ env.BUN_VERSION }}
       - name: Set version from tag
@@ -70,29 +70,29 @@ jobs:
             platform: win32-arm64
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Cache SwiftSyntax build
         if: runner.os == 'Windows'
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .groma/swift-syntax-build
           key: >-
             swift-syntax-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles(
               '.github/actions/setup-swift/action.yml',
               'plugins/scanners/swift/Package.swift') }}
       - uses: ./.github/actions/setup-swift
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: ${{ env.BUN_VERSION }}
-      - uses: actions/setup-java@v6
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: ${{ matrix.platform == 'win32-arm64' && 'microsoft' || 'temurin' }}
           java-version: '25'
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: plugins/scanners/go/worker/go.mod
           cache-dependency-path: plugins/scanners/go/worker/go.sum
-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
       - name: Install Rust build toolchain
@@ -117,7 +117,7 @@ jobs:
       - name: Check fresh checkouts without project tools
         run: GROMA_TEST_PACKAGES=scanner-packages bun test --timeout 60000 test-bun/scanner-fresh-checkout.test.ts
         shell: bash
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: scanner-packages-${{ matrix.platform }}
           path: scanner-packages
@@ -129,15 +129,15 @@ jobs:
     needs: [validate, build-scanners]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: ${{ env.BUN_VERSION }}
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: https://registry.npmjs.org
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: scanner-packages-*
           path: scanner-artifacts
@@ -149,7 +149,7 @@ jobs:
         run: bun scripts/scanner-release.ts publish scanner-packages
         env:
           NPM_CONFIG_PROVENANCE: true
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: published-scanner-packages
           path: scanner-packages
@@ -195,8 +195,8 @@ jobs:
             npm_cpu: arm64
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: ${{ env.BUN_VERSION }}
       - name: Set version from tag
@@ -216,7 +216,7 @@ jobs:
       - name: Install all Bun target dependencies
         run: bun install --frozen-lockfile --os="*" --cpu="*"
         shell: bash
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: published-scanner-packages
           path: published-scanner-packages
@@ -233,7 +233,7 @@ jobs:
         if: matrix.npm_os != 'win32'
         run: chmod +x "dist/${{ matrix.binary }}"
         shell: bash
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: groma-${{ matrix.target }}
           path: dist/${{ matrix.binary }}
@@ -244,7 +244,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: groma-*
           path: release-artifacts
@@ -303,12 +303,12 @@ jobs:
             npm_cpu: arm64
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/download-artifact@v8
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: groma-${{ matrix.target }}
           path: artifact
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: https://registry.npmjs.org
@@ -352,8 +352,8 @@ jobs:
     needs: publish-platform
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: https://registry.npmjs.org
@@ -407,7 +407,7 @@ jobs:
     needs: [release-assets, publish-wrapper]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           fetch-depth: 0
@@ -426,7 +426,7 @@ jobs:
           NODE
         shell: bash
       - name: Commit released version to main
-        uses: stefanzweifel/git-auto-commit-action@v7
+        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
         with:
           commit_message: 'chore: sync groma.md version to ${{ github.ref_name }}'
           branch: main

CONTRIBUTING.md

@@ -39,8 +39,7 @@ when making changes.
 
 `bun install` applies the checked-in Parcel Watcher patch. It makes native binding imports explicit so Bun can embed
 them in a single-file bytecode executable; development and compiled builds use the same package loader. When updating
-Parcel, review the patch against its platform packages and run `bun test test-bun/parcel-bytecode.test.ts`. This test
-receives native file events in both source mode and a compiled executable with no accompanying source or dependencies.
+Parcel, review the patch against its platform packages.
 
 ## Repository structure
 
@@ -147,9 +146,6 @@ Run the checks relevant to the change:
 bun run check
 ```
 
-`bun src/typescript-scanner.ts` prints the C4 candidates the scanner reads from this repository's import graph
-without writing Markdown; `--glob` replaces the files it reads and `--ignore` adds to the files it skips.
-
 For a terminal feature, finish by running its approved scenario through the real TUI in a PTY when the task requires a
 terminal walkthrough.