ci: move Docker actions to Node 24 and Trivy to 0.76.1

Open

iamgpwants to merge intofrom

299 commits3063 files changed+417536-154637

Goal and scope

Clear the Node 20 deprecation warnings and update the stale Trivy scanner. Non-goals: no change to scan policy or the signature-verification logic. Another change is fixing the rescan signature loop; this PR only touches the action-pin and Trivy-digest lines in container-rescan.yml (lines 47, 52, 176).

Change map and risk

Mechanical pin updates, all to commit SHAs or image digests:

docker/login-action v3.7.0 → v4.7.0 (81c6f93d…)
docker/setup-buildx-action v3.12.0 → v4.4.1 (f87e5991…). The v4 major removed deprecated inputs; none of our uses pass them (buildkitd-config-inline is still supported).
aquasec/trivy 0.72.0 → 0.76.1 (sha256:790fd66d…) in CI scans and phlo plugin check (src/phlo/cli/commands/plugin/check.py).

Risk: a newer Trivy database or matcher can report new findings, which surface as policy failures instead of being hidden.

Verification

pytest tests/tooling/test_container_security_workflows.py tests/tooling/test_generated_image_publication.py tests/tooling/test_postgres_concurrency_workflow.py tests/cli/test_cli_plugin.py tests/scripts/test_container_security.py → 132 passed.
A Trivy 0.76.1 JSON report of a locally built MinIO image passes container_security.py apply-policy (report format compatible).
Not checked: the workflows themselves run only on GitHub; CI on this PR covers ci.yml.
Not applicable: dependency pin update, no behaviour fix.

Recovery and maintainer decisions

Revert restores the previous pins. No publication or settings change.

Activity

302

test(api): accept completed idempotency replay race (#699)

f6ce7a4Oct 30

fix(phlo-dagster): correlate WAP cleanup through logical run tags (#694)

e0b09ecOct 30

fix(observatory): make settings durable and fail closed (#695)

09d4ac7Oct 30

fix(support): reconcile v1 support claims with committed evidence (#696)

88fcd72Oct 30

fix(compliance): authenticate evidence-pack integrity with HMAC-SHA256 (#697)

cbe3367Oct 30

fix(api): resolve table relations once per preview (#698)

5de2127Oct 30

feat: link exact durable run reports from Runs (#700)

2a9649dOct 30

fix(api): bound Loki regex filtering (#701)

594d94eOct 30

ci(types): enforce strict Python type checks (#702)

e510bdcOct 30

feat(cli): add offline support status (#703)

85f16c6Oct 30

feat: carry bounded data intervals through Dagster and DLT (#1199)

9fba027Oct 30

fix(examples): resolve source-to-report release dependencies locally (#1201)

6748679Oct 30

fix: prevent stale WAP audit approval with candidate-bound checks (#1202)

304877bOct 30

fix(ci): wait for the dependency producer before triage refusal (#1204)

bc530bcOct 30

fix(agent): publish complete advisory remediation PRs (#1207)

b8fef36Oct 30

fix(deps): upgrade msgpack to 1.2.4 for GHSA-j586-36cw-2gc2 (#1206)

8c19925Oct 30

fix(deps): upgrade seroval to 1.7.3 for GHSA-9wx9-5pv9 and GHSA-f86p-h4j2 (#1208)

7feced4Oct 30

ci: move Docker actions to Node 24 and Trivy to 0.76.1

662af24Oct 30

coldtea-pr-lens[bot]9h ago

NOTE

The title starts with ci:, so PR Lens left this pull request undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}

phlo-agent[bot]8h ago

Reviewed the pin bump at 662af24.

Verified against upstream

docker/login-action@81c6f93d… is tag v4.7.0 and docker/setup-buildx-action@f87e5991… is tag v4.4.1; both action.yml files declare runs.using: node24, and every input used here still exists (registry/username/password, buildkitd-config-inline). The v4.0.0 notes list dependency updates only.
aquasec/trivy@sha256:790fd66d… is the published multi-arch index digest for 0.76.1, so the amd64 and arm64 lanes pull the same image. The report contract stays put in 0.76.1: SchemaVersion = 2 (writer.go) and ArtifactType/Metadata.ImageID are still emitted (report.go), so the ci.yml jq assertion and apply-policy keep working. The image still runs as root, so the phlo plugin check cache mount at /root/.cache/trivy remains writable.
The sweep is complete: all six docker/login-action and six docker/setup-buildx-action references and all eight Trivy references (seven workflow invocations plus the TRIVY_IMAGE constant) are updated, and the one pin assertion in tests/tooling/test_postgres_concurrency_workflow.py moved with them. I found no stale pin in the other workflows, the Makefile, the CLI, or the tests and docs I checked.
Waiver fingerprints hash only (VulnerabilityID, PkgName) pairs (_vulnerability_evidence_sha256), so existing user waivers are not invalidated by the version change; newly matched CVEs still fail closed, as the description says.

No actionable findings.

Still unverified: at review time only pr / changed lanes, containers / safety / container contracts and security / introduced dependency risk had finished (all successful); the Python and container-build jobs were still queued. The lanes that exercise the new pins for real — build-service-images.yml, container-rescan.yml, upstream-image-visibility.yml and the release staging/promotion workflows — only run on GitHub, so this PR's CI has not yet exercised a 0.76.1 scan or a v4 login.