P1: Supply-chain security — Dependabot, npm audit gate, Trivy, SBOM (#175)

[dkijania]

What & why

Part of the production-readiness epic (#163). Refs #175.

There were no supply-chain controls: no Dependabot, no audit gate, no SBOM.

Changes

• .github/dependabot.yml — weekly updates for npm (production/development grouped), GitHub Actions, and Docker (keeps the pinned base-image digest from P1: Container hardening — node as PID 1 / tini, HEALTHCHECK, pin digest #171 fresh).
• .github/workflows/security.yaml:
  • npm audit — hard gate on critical advisories in production deps (what actually ships in the image/npm package), plus a full informational audit for visibility.
  • CycloneDX SBOM generation, uploaded as a build artifact.

Notes

• Gate is "prod-critical", not "all-high": a blocking audit over all deps would fail immediately — the repo has 115 advisories, almost all from dev tooling (artillery, codegen). Production deps have 0 critical / 4 high, and the highs are OpenTelemetry + fast-uri transitives that Dependabot and the Yoga 5 upgrade (P1: Dependency upgrades — graphql-yoga 4→5, Node 20→22 LTS #176) will clear. The gate blocks prod criticals today, surfaces everything else, and can be tightened to high once P1: Dependency upgrades — graphql-yoga 4→5, Node 20→22 LTS #176 lands.
• Trivy/Grype image scanning deferred: I dropped the Trivy job rather than ship it red (the scanner action failed to run in CI and I couldn't verify it blind). Dependabot's npm + docker ecosystems already surface vulnerable deps and base images; a verified image-scan job can be added as a follow-up. Hence Refs P1: Supply chain — Dependabot, npm audit gate, image scan, SBOM #175, not Closes.

Testing

• npm audit --omit=dev --audit-level=critical → exit 0 (the blocking gate passes)
• prettier --debug-check . — clean; YAML validated
• No application code changed.

🤖 Generated with Claude Code