Resolve Console UI, download, and release validation backlog

.github/dependabot.yml

@@ -87,3 +87,20 @@ updates:
     schedule:
       interval: "monthly"
       day: "thursday"
+
+  # Semgrep and its hash-locked Python dependencies require reviewed PRs.
+  - package-ecosystem: "pip"
+    directory: "/.github/requirements"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 5
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 5
+  - package-ecosystem: "docker"
+    directory: "/.github/packaging"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 5

.github/packaging/Dockerfile.apk

@@ -0,0 +1,3 @@
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
+RUN apk add --no-cache bash curl openssl
+CMD ["tail", "-f", "/dev/null"]

.github/packaging/Dockerfile.deb

@@ -0,0 +1,3 @@
+FROM debian:12@sha256:6ebd97fa83deb272194a2cf015b3d26a4d538e9ad3a7a79d544c8af5b0a01443
+RUN apt-get update && apt-get install -y --no-install-recommends systemd systemd-sysv dbus curl openssl ca-certificates adduser && rm -rf /var/lib/apt/lists/*
+CMD ["/lib/systemd/systemd"]

.github/packaging/Dockerfile.rpm

@@ -0,0 +1,3 @@
+FROM rockylinux/rockylinux:9@sha256:8101994123cf3d0a8fee517bee7f39e555c7d92bd2d9eb3303cc988a0eeed00f
+RUN dnf install -y systemd dbus openssl shadow-utils curl-minimal && dnf clean all
+CMD ["/usr/sbin/init"]

.github/requirements/firefox.env

@@ -0,0 +1,4 @@
+# Mozilla release archive, Linux x86_64 en-US. Review version and digest together.
+# https://archive.mozilla.org/pub/firefox/releases/155.0.1/SHA512SUMS
+FIREFOX_VERSION=155.0.1
+FIREFOX_SHA512=da23025495aa3a2b154cff7c6464fa8bc31ca0c683b378c34b9dced9f33b6e657537c0b5fc44e98bce742bda8e3c58a0a571d1ccd849bf41031881cd36dfba1b

.github/requirements/semgrep.in

@@ -0,0 +1 @@
+semgrep==1.176.1