…th 1 update (#96)

Bumps the github-actions-major group with 1 update in the / directory: [actions/setup-python](https://github.com/actions/setup-python).
Bumps the github-actions-major group with 1 update in the /.github/actions/setup-sfw directory: [actions/setup-python](https://github.com/actions/setup-python).


Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)

Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-major
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…y with 2 updates (#95)

Bumps the github-actions-minor-patch group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [docker/login-action](https://github.com/docker/login-action).


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)

Updates `docker/login-action` from 4.4.0 to 4.5.1
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@af1e73f...abd2ef4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-minor-patch
- dependency-name: docker/login-action
  dependency-version: 4.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: restore Trivy scanning via Socket-built distribution

Trivy returns to the main, heavy, and app_tests images as a Socket-built
distribution: rebuilt from unmodified upstream source (v0.73.0) by Socket's
own release pipeline and pinned by digest (TRIVY_IMAGE build arg; override
available for builds without registry access).

- Dockerfiles: digest-pinned trivy stage restored; version label now truthful
- CI: GHCR login on every build mode (private base image) + packages: read
- Smoke tests: drop the removal guard; verify trivy presence, version-pin
  agreement, and a functional 'trivy config' scan (the connector's code path)
- Dependabot: trivy untracked by design — updates flow from the Socket
  release process, never independent bumps
- Docs: removed the temporarily-disabled messaging repo-wide; kept the
  0.69.4-0.69.6 warnings for native installs; fixed the APT example to the
  'generic' distribution (upstream change in trivy v0.72.0)

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore(deps): refresh OSS scanner toolchain pins

Batch with the Trivy restore since this warrants a major point release:
TruffleHog 3.93.8 -> 3.96.0, OpenGrep v1.16.5 -> v1.26.0, uv 0.10.11 -> 0.12.1,
gosec v2.24.7 -> v2.28.0 (app_tests), Go 1.24.1 -> 1.26.5 (app_tests),
Socket CLI 2.5.0 -> 2.5.8 (heavy). Runtime bases (python:3.12, node:22)
deliberately deferred to their own PR.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix(app_tests): repair unbuildable image and correct build context

The app_tests image predates the socket_basics layout migration: its
COPY src/... and entrypoint.sh references no longer exist anywhere in the
repo, so it could not build at all (its CI job only fires on app_tests
changes and had not run since). Drop the stale references (tools image for
now; modernizing the harness is follow-up work) and build with app_tests/
as the context so its own pyproject/uv.lock and fixtures resolve.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix(app_tests): recreate npm/npx symlinks instead of copying them

COPY --from dereferences the node image's npm/npx symlinks into flat files
under /usr/local/bin, breaking npm's relative require of ../lib/cli.js.
Copy node + node_modules and recreate the bin symlinks properly. Another
latent issue in this previously-unbuildable image, surfaced now that it
builds again.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix(app_tests): drop dead runner venv and repair corrupt uv.lock

The /scripts venv installed light-s3-client for the removed legacy runner
against an empty stub pyproject, and app_tests/uv.lock was corrupt TOML
(empty package name) that modern uv refuses to parse. Regenerate a valid
lockfile for the stub manifest, drop the pointless venv bake from the image,
and retire the last socket-security-tools fossil (WORKDIR).

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* test: add trivy connector end-to-end integration test

Scans a fixture Dockerfile through socket-basics --dockerfiles, exercising
config -> trivy config -> result parsing. Explicitly fails on the connector's
'Trivy not found' fallback so a missing binary can't pass vacuously.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* ci: scope Docker Hub credentials to the publish environment

Docker Hub secrets move from repo-level to environment secrets on 'publish'
(deployment policy: main + v* tags; secrets already created). merge-manifests
binds the environment directly; build-test-push calls the reusable workflow
(which cannot carry environment:), so it inherits secrets and the reusable
pipeline job binds the environment conditionally in push mode only — PR-branch
test builds bind no environment. Repo-level secrets stay until a real publish
validates the path, then get deleted.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* ci: document the secrets-inherit exception for the publish pipeline

zizmor's secrets-inherit audit flags the inherit on build-test-push; it is
required here — environment-scoped secrets only resolve on the environment-
bound job inside the called same-repo workflow, never through an explicit
workflow-call mapping. Inline ignore with rationale, matching the repo's
existing template-injection exceptions.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* feat(publish): reintroduce the latest floating tag aliases

latest/latest-heavy float to the newest release as onboarding convenience;
exact version tags stay immutable registry-side (Docker Hub immutable-tag
rule ^\d+\.\d+\.\d+(-heavy)?$, already applied). Dispatch re-publish is now
documented as recovery-only: re-pushing a published version tag is rejected
by the registry, by design. Pinning docs updated to match.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix(publish): apply variant suffix to the latest alias (onlatest)

metadata-action only suffixes the auto-generated latest tag when the suffix
carries onlatest=true; without it both matrix variants publish a bare,
racing 'latest' and 'latest-heavy' is never created. Caught by Bugbot.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Bumps the github-actions-minor-patch group with 1 update in the / directory: [docker/login-action](https://github.com/docker/login-action).


Updates `docker/login-action` from 4.5.1 to 4.6.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@abd2ef4...dbcb813)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

The core-tool-watch scoring call opted into the batch purl API's
fail-closed semantics via stringly-typed query-string kwargs
(poll="true", timeoutSec="120", alerts="true") -- an undocumented
SDK passthrough. socketdev 3.4.2 promoted these to first-class typed
params; migrate to the supported surface. Behavior unchanged (still
fail-closed).

Floor pinned at socketdev>=3.5.0, which additionally bounds the SDK's
runtime dependency ranges and hardens PyPI install verification.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* chore(release): 3.0.0

Version refs (version.py, __init__.py, pyproject.toml, action.yml image tag)
and CHANGELOG entry only, per the release process.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore(release): regenerate uv.lock for 3.0.0

uv.lock records the project's own version; uv sync --frozen fails on the
pyproject mismatch without the regen.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore(release): bump Socket CLI to 2.6.0 in the heavy image

Version ref bump folded into the release PR (was briefly #103).

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore(release): bump socketdev SDK to 3.5.0

Constraint + lock only; the core-tool-watch typed-params migration remains
in #99, which rebases on this.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore(release): bump Socket CLI to 2.6.3 in the heavy image

Adopts the post-outage CLI release bundling the final pending PRs, so 3.0.0
ships a current pin without needing a back-to-back Basics release.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>