chore: T2 2026 platform, CI and dependency updates

.github/dependabot.yml

@@ -9,3 +9,7 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "daily"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/deployment-institution.yml

@@ -4,18 +4,21 @@ on:
     tags:
       - 'v*'
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   docker-web-server:
+    if: github.repository_owner == 'doubtfire-lms'
     environment: deployment-secrets
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
       - name: Check custom institution deployment secrets
         id: custom_config
         env:
@@ -30,14 +33,14 @@ jobs:
             echo "Skipping custom institution Docker publish because one or more institution secrets are not set."
           fi
       - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         if: github.event_name != 'pull_request' && steps.custom_config.outputs.enabled == 'true'
         with:
           username: ${{ secrets.INSTITUTION_DOCKERHUB_USERNAME }}
           password: ${{ secrets.INSTITUTION_DOCKERHUB_TOKEN }}
       - name: Setup meta for custom institution web server
         id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         if: steps.custom_config.outputs.enabled == 'true'
         with:
           images: ${{ secrets.INSTITUTION_DOCKERHUB_USERNAME }}/${{ secrets.INSTITUTION }}
@@ -49,14 +52,16 @@ jobs:
             type=semver,pattern=prod-{{major}}
       - name: Build and push custom web server
         id: docker_build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         if: steps.custom_config.outputs.enabled == 'true'
         with:
           file: deploy.Dockerfile
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_meta.outputs.tags }}
           labels: ${{ steps.docker_meta.outputs.labels }}
+          sbom: true
+          provenance: mode=max
           build-args: |
             SENTRY_DSN=${{ secrets.SENTRY_DSN }}
             SENTRY_ORG=${{ secrets.SENTRY_ORG }}

.github/workflows/deployment.yml

@@ -41,7 +41,7 @@ jobs:
   #         context: .
   #         push: ${{ github.event_name != 'pull_request' }}
   #         tags: ${{ steps.docker_meta.outputs.tags }}
-  #         labels: ${{ steps.meta.outputs.labels }}
+  #         labels: ${{ steps.docker_meta.outputs.labels }}
   #     - name: Image digest
   #       run: echo ${{ steps.docker_build.outputs.digest }}
   docker-web-server:
@@ -50,20 +50,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
       - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         if: github.event_name != 'pull_request'
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Setup meta for web server
         id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         with:
           images: lmsdoubtfire/doubtfire-web
           tags: |
@@ -74,12 +74,14 @@ jobs:
             type=semver,pattern=prod-{{major}}
       - name: Build and push web server
         id: docker_build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           file: deploy.Dockerfile
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+          sbom: true
+          provenance: mode=max
       - name: Image digest
         run: echo ${{ steps.docker_build.outputs.digest }}

.github/workflows/lint.yml

@@ -13,9 +13,9 @@ jobs:
         node-version: [22]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: ${{ matrix.node-version }}
       - run: npm ci

.github/workflows/nodejs-ci.yml

@@ -15,11 +15,16 @@ jobs:
       matrix:
         node-version: [22]
     steps:
-      - uses: actions/checkout@v6
-      - uses: browser-actions/setup-chrome@v2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          submodules: recursive
+      - uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: ${{ matrix.node-version }}
       - run: npm ci
-      - run: npm run build --if-present
+      - run: npm run verify:deployment-config
+      - run: npm run verify:pwa
+      - run: npm run build -- --configuration production
+      - run: npm run verify:pwa:build

.github/workflows/test.yml

@@ -9,11 +9,23 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Use Node.js 22
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
           cache: npm
       - run: npm ci
-      - run: npm run test:ci
+      - name: Accessibility regression tests
+        run: npm run test:a11y
+      - name: Check theme first paint, compiled surfaces and contrast
+        run: npx vitest run scripts/theme/theme-surfaces.spec.ts
+      - run: npm run test:coverage
+      - name: Upload coverage report
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: web-coverage
+          path: coverage/
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/validate-nginx.yml

@@ -0,0 +1,34 @@
+name: Validate production Nginx
+
+on:
+  pull_request:
+    paths:
+      - nginx.conf
+      - deploy.Dockerfile
+      - src/manifest.webmanifest
+      - scripts/test-nginx.py
+      - .github/workflows/validate-nginx.yml
+  push:
+    branches: ["11.0.x"]
+    paths:
+      - nginx.conf
+      - deploy.Dockerfile
+      - src/manifest.webmanifest
+      - scripts/test-nginx.py
+      - .github/workflows/validate-nginx.yml
+
+permissions:
+  contents: read
+
+concurrency:
+  group: nginx-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  nginx:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Exercise static responses from the production configuration
+        run: python3 -B scripts/test-nginx.py

.nvmrc

@@ -1 +1 @@
-v16.14.2
+v22.22.3