thc1006 5a36aa23b7 fix: supply chain hardening — pin actions, images, and fix secret logging ...

Supply chain:
- Pin GitHub Actions to stable releases instead of @master/@main:
  trivy-action@0.28.0, snyk@0.4.0, sonarcloud@v3, dependency-check@v6
- Update EOL actions: upload-artifact v3→v4, codeql/upload-sarif v2→v3,
  codecov v3→v4
- Pin container images to specific tags instead of :latest:
  kubectl:1.31, vault:1.17, prometheus:v3.2, jaeger:1.62, tempo:2.7,
  sonarqube:10.8-community, trivy:0.58.0, trufflehog:3.88, uv:0.6,
  temporalio auto-setup:1.26, temporalio ui:2.33

Security:
- Replace echo of secrets in CI examples with env var injection pattern
  (secrets-management SKILL.md)

Misc:
- Fix CRLF → LF line endings in deployment-engineer.md

2026-04-19 11:13:46 +00:00

..

compliance-check.md

fix: supply chain hardening — pin actions, images, and fix secret logging

2026-04-19 11:13:46 +00:00