build(deps): add Dependabot, digest-pin base images, and scan dependency licenses

[ArangoGutierrez]

Description

Adds Dependabot, pins the container base images to digests, and adds a dependency license
scan.

Part of the OSS Health Scorecard work tracked in #513.

What

• .github/dependabot.yml covering gomod, github-actions and docker. Minor and patch
  bumps are grouped into one PR per ecosystem per week so the merge train stays short; major
  bumps are deliberately left ungrouped so each gets a real review.
• Dockerfile base images pinned to digests, with the readable tag kept alongside:
  golang:1.26.6@sha256:0d1d3a… and alpine:3.24@sha256:28bd5fe…. The previous alpine:3
  was a floating tag.
• .github/workflows/license-scan.yml checking dependency licenses against Apache-2.0.

The digests were resolved and then proven

Both digests come from docker buildx imagetools inspect, not from memory. They were then
verified by an actual BuildKit build of a probe Dockerfile assembled from the two FROM lines
extracted from the file, with the builder stage made load-bearing so it could not be pruned:
build rc=0, ALPINE=3.24.1, GO=go version go1.26.6 linux/amd64.

Note alpine:3 currently resolves to 3.24.1, so pinning is not a version change.

The license gate was seen to go red

Across 122 modules the tree is 72 Apache-2.0, 27 BSD-3-Clause, 21 MIT, 1 ISC, 1 BSD-2-Clause.
With the workflow's allowlist the check passes (rc=0). With MIT removed from the allowlist it
fails (rc=1, naming github.com/agrea/ptr among others). So the gate discriminates rather
than passing vacuously.

A note on the trigger

The workflow triggers on push to main and on pull-request/[0-9]+ rather than
pull_request, matching every existing workflow in this repo: there are zero pull_request
triggers across the twelve pre-existing workflows because the repo uses copy-pr-bot. Easy to
change if that is not the intent.

Measured effect

CI/CD 2.83/4 to 3.02/4, +0.57 points.

Reviewer note

Dependabot's PRs will pass DCO without any configuration change. The DCO app skips commits
whose author type is Bot before it inspects sign-off, and Dependabot signs off anyway. This
was verified against a sibling repo in the org running the same app with no dco.yml.

Part of #513.

Checklist

• I am familiar with the Contributing Guidelines.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.
• All commits are signed off per DCO (git commit -s).

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: a382e27b-7ab2-4548-a3e4-dbb069e58a28

📥 Commits

Reviewing files that changed from the base of the PR and between 62a4f22 and 64bcfd3.

📒 Files selected for processing (1)

• .github/workflows/license-scan.yml

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (6)

• GitHub Check: build
• GitHub Check: k8s / aws-sim
• GitHub Check: k8s / gcp-sim
• GitHub Check: k8s / test
• GitHub Check: oci-sim / slinky
• GitHub Check: k8s / crusoe

🔇 Additional comments (1)

.github/workflows/license-scan.yml (1)

38-39: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Added automated weekly checks for dependency updates across application components and build tooling.
  • Added automated license compliance validation covering supported open-source license types.
  • Pinned build and runtime container images to specific versions and integrity references for more consistent, reproducible releases.
  • Added scheduled checks for dependency changes and license compliance during code updates and releases.

Walkthrough

The pull request adds weekly Dependabot updates, a license-scan workflow, and digest-pinned Go and Alpine container images.

Changes

Dependency governance

Layer / File(s)	Summary
Automated dependency updates .github/dependabot.yml	Dependabot updates Go modules, GitHub Actions, and Docker dependencies weekly. Minor and patch updates are grouped.
License validation .github/workflows/license-scan.yml	The workflow checks dependency licenses on pushes and pull requests. It allows Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, and MIT licenses.
Pinned container images Dockerfile	The Go builder and Alpine runtime images now use pinned digests.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 64bcf

This change adds automated dependency updates, license compliance validation, and immutable container image pins. The current configuration is ready to merge with no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main changes: Dependabot configuration, Docker image digest pinning, and dependency license scanning.
Description check	✅ Passed	The description directly explains the Dependabot configuration, immutable Docker image digests, license-scan workflow, triggers, and verification results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR strengthens dependency and supply-chain maintenance:

• Adds weekly Dependabot updates for Go modules, GitHub Actions, and Docker images.
• Pins builder and runtime container images to immutable digests.
• Adds a CI license scan with an explicit permissive-license allowlist.
• Updates the license workflow to derive its Go version from go.mod, resolving the previous toolchain mismatch.

Confidence Score: 5/5

The PR appears safe to merge, with no outstanding correctness, security, or repository-rule issues identified.

The prior license-workflow toolchain mismatch is fully fixed by using go-version-file, and the current dependency automation, license scan, and digest pins introduce no actionable failures.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds grouped weekly dependency updates for Go modules, GitHub Actions, and Docker base images.
.github/workflows/license-scan.yml	Adds dependency-license enforcement and now tracks the Go version declared by go.mod.
Dockerfile	Pins both build and runtime base images to immutable SHA-256 digests.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  D[Dependabot weekly checks] --> G[Go module update PRs]
  D --> A[GitHub Actions update PRs]
  D --> I[Docker image digest update PRs]
  C[Push to main or PR mirror branch] --> L[License scan]
  L --> V{All dependency licenses allowed?}
  V -->|Yes| P[Check passes]
  V -->|No| F[Check fails]

Loading

_{Reviews (3): Last reviewed commit: "ci(license): resolve the Go toolchain fr..." | Re-trigger Greptile}