deps: setup-node 7, login-action 4, and dependabot/script hygiene

.github/dependabot.yml

@@ -48,6 +48,15 @@ updates:
     groups:
       npm-minor-patch:
         update-types: [minor, patch]
+    # Angular pins TypeScript to a narrow peer range -- @angular/build 22 wants
+    # ">=6.0 <6.1", so anything past a 6.0.x patch fails `npm ci` with ERESOLVE.
+    # TypeScript here is driven by Angular: bump it deliberately with an Angular
+    # major, not on its own. Patches still flow.
+    ignore:
+      - dependency-name: typescript
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
     labels: [dependencies, frontend]
     commit-message:
       prefix: deps

.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
   backend:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
@@ -58,8 +58,8 @@ jobs:
     env:
       PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: npm
@@ -93,11 +93,11 @@ jobs:
   e2e:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: npm
@@ -155,7 +155,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       # Validate the production Dockerfile builds for amd64, and load it into the local
       # daemon so Trivy can scan the exact image. No push on CI.
@@ -179,7 +179,7 @@ jobs:
           ignore-unfixed: true
       - name: Upload Trivy results to code scanning
         if: always()
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           sarif_file: trivy-results.sarif
           category: trivy-image

.github/workflows/pr-label.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Read conventional commit types config
         id: type-config

.github/workflows/pr-title-check.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Fail if PR title does not follow conventional commit format
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9

.github/workflows/refresh-lockfiles.yml

@@ -36,7 +36,7 @@ jobs:
   refresh:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Check out the PR's head branch by name (not the merge ref) so the refreshed
           # lock files can be pushed straight back to it.

.github/workflows/release.yml

@@ -41,9 +41,9 @@ jobs:
         && github.event.workflow_run.head_sha == github.sha)
       || startsWith(github.ref, 'refs/tags/v')
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

scripts/refresh-lockfiles.ps1

@@ -46,15 +46,43 @@ $repoRoot = Resolve-Path (Join-Path $PSScriptRoot '..')
 $solution = 'CoffeeTracker.sln'
 $restoreArgs = if ($Check) { '--locked-mode' } else { '--force-evaluate' }
 
-# Keep this digest in step with the SDK stage in ./Dockerfile so a local refresh
-# resolves against the same SDK (and therefore the same bundled NuGet) as the image.
-$sdkImage = 'mcr.microsoft.com/dotnet/sdk:10.0@sha256:ed034a8bf0b24ded0cbbac07e17825d8e9ebfe21e308191d0f7421eaf5ad4664'
+# Read the SDK image straight out of ./Dockerfile rather than repeating the digest here.
+# Dependabot bumps that digest regularly, so a copy in this file would silently go stale
+# and start resolving against a different SDK (and a different bundled NuGet) than the
+# image builds with -- which is exactly the class of drift this script exists to prevent.
+function Get-SdkImage {
+    $dockerfile = Join-Path $repoRoot 'Dockerfile'
+    $match = Select-String -Path $dockerfile -Pattern '^FROM\s+(mcr\.microsoft\.com/dotnet/sdk:\S+)' |
+        Select-Object -First 1
+    if (-not $match) {
+        throw "Could not find the .NET SDK 'FROM' line in $dockerfile."
+    }
+    return $match.Matches[0].Groups[1].Value
+}
+
+# Windows PowerShell 5.1 wraps every line a native command writes to stderr in an
+# ErrorRecord, so with $ErrorActionPreference = 'Stop' ordinary progress output turns
+# fatal -- docker's "Unable to find image ... locally" pull message did exactly that on
+# the first run, before the SDK image is cached. Run natives with the preference relaxed
+# and judge them by their exit code instead.
+function Invoke-Native {
+    param([Parameter(Mandatory)][string[]]$Command)
+
+    $previous = $ErrorActionPreference
+    $ErrorActionPreference = 'Continue'
+    try {
+        & $Command[0] @($Command[1..($Command.Length - 1)])
+    }
+    finally {
+        $ErrorActionPreference = $previous
+    }
+}
 
 function Test-Sdk {
     $dotnet = Get-Command dotnet -ErrorAction SilentlyContinue
     if (-not $dotnet) { return $false }
     # The dotnet *host* is present on many machines without any SDK; only an SDK can restore.
-    $sdks = & $dotnet.Source --list-sdks 2>$null
+    $sdks = Invoke-Native @($dotnet.Source, '--list-sdks') 2>$null
     return [bool]$sdks
 }
 
@@ -78,15 +106,19 @@ try {
 
     if (Test-Sdk) {
         Write-Host "Restoring $solution with a local SDK ($restoreArgs)..."
-        & dotnet restore $solution $restoreArgs
+        Invoke-Native @('dotnet', 'restore', $solution, $restoreArgs)
     }
     else {
         Write-Host 'No .NET SDK on PATH; falling back to the SDK container.'
         if (-not (Get-Command docker -ErrorAction SilentlyContinue)) {
             throw 'Neither a .NET SDK nor docker is available. Install the .NET 10 SDK or start Docker.'
         }
+        $sdkImage = Get-SdkImage
         Write-Host "Restoring $solution in $sdkImage ($restoreArgs)..."
-        & docker run --rm -v "${repoRoot}:/src" -w /src $sdkImage dotnet restore $solution $restoreArgs
+        Invoke-Native @(
+            'docker', 'run', '--rm', '-v', "${repoRoot}:/src", '-w', '/src',
+            $sdkImage, 'dotnet', 'restore', $solution, $restoreArgs
+        )
     }
     if ($LASTEXITCODE -ne 0) { throw "dotnet restore failed with exit code $LASTEXITCODE." }