chore(deps): bump actions/dependency-review-action from 4.8.2 to 5.0.0

.github/linters/.checkov.yaml

@@ -0,0 +1,15 @@
+---
+# Checkov configuration for this repository.
+# Options: https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html
+#
+# Supplying this file replaces super-linter's bundled one: it invokes
+# `checkov --config-file <this file>`.
+
+# Passed checks are not interesting; a failure is.
+quiet: true
+
+skip-path:
+  # See the note in trivy.yaml. The pinned ThousandEyes document's
+  # client-certificate example is a sample PEM, not a credential, and the document is
+  # committed verbatim so it cannot be edited to satisfy a scanner.
+  - openapi-specs

.github/linters/trivy.yaml

@@ -0,0 +1,33 @@
+---
+# Trivy configuration for this repository.
+#
+# Supplying this file replaces super-linter's bundled one wholesale -- it invokes
+# `trivy filesystem --config <this file>` -- so the scanner selection and exit code
+# are restated here rather than inherited.
+
+disable-telemetry: true
+
+# A finding must fail the job. The default is 0, which reports and passes.
+exit-code: 1
+
+scan:
+  scanners:
+    - vuln
+    - misconfig
+    - secret
+
+  skip-dirs:
+    # Pinned third-party API documents, committed verbatim for reproducibility.
+    #
+    # The ThousandEyes v7 document documents a client-certificate field, and its
+    # `example:` block contains a sample PEM private key. Both Trivy and Checkov read
+    # that as a leaked key. It is illustrative text in a vendor's documentation, and
+    # the only way to satisfy the scanner would be to edit a pinned artefact -- which
+    # would defeat the point of pinning it, and is why VALIDATE_OPENAPI is off too.
+    - openapi-specs
+
+    # Deliberately NOT skipped: probe-evidence. Those cassettes are our own recorded
+    # HTTP traffic against a live tenant, so a secret appearing there is exactly the
+    # thing worth being told about. The Authorization header is absent by construction
+    # -- it is not on the recorder's allow list -- but that is a property to keep
+    # verifying, not to assume.

.github/workflows/auto-merge-dependabot.yml

@@ -1,6 +1,5 @@
 name: Auto-Merge Dependabot
 
-
 on:
   pull_request:
     branches: [main]
@@ -11,13 +10,18 @@ permissions:
 
 jobs:
   dependabot-merge:
-    name: '🤖 Auto-Merge Dependabot'
+    name: "🤖 Auto-Merge Dependabot"
     runs-on: ubuntu-latest
 
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    # Gated on the pull request author's immutable numeric id, not on github.actor.
+    #
+    # This job holds contents: write and merges pull requests, so this condition is the
+    # whole of its security. github.actor is a login, and a login is a display name that
+    # can be changed; 49699333 is dependabot[bot]'s user id and cannot be. Verified
+    # against dependabot pull requests in this repository.
+    if: ${{ github.event.pull_request.user.id == 49699333 }}
 
     steps:
-
       - name: Harden Runner
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:

.github/workflows/codegen-verify.yml

@@ -12,15 +12,15 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
     paths:
-      - '.github/workflows/codegen-verify.yml'
-      - 'blueprints/**'
-      - 'cmd/**'
-      - 'internal/**'
-      - 'interop-specs/**'
-      - 'probe-evidence/**'
-      - 'pilot/**'
-      - 'go.mod'
-      - 'go.sum'
+      - ".github/workflows/codegen-verify.yml"
+      - "blueprints/**"
+      - "cmd/**"
+      - "internal/**"
+      - "interop-specs/**"
+      - "probe-evidence/**"
+      - "pilot/**"
+      - "go.mod"
+      - "go.sum"
 
 permissions:
   contents: read
@@ -31,7 +31,7 @@ concurrency:
 
 jobs:
   verify:
-    name: '🔁 Regenerate and diff'
+    name: "🔁 Regenerate and diff"
     runs-on: ubuntu-24.04-arm
     if: github.event.pull_request.draft == false
 
@@ -43,12 +43,15 @@ jobs:
 
       - name: Check Out
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # These jobs only read the tree; none of them runs git push.
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version-file: 'go.mod'
-          cache-dependency-path: 'go.sum'
+          go-version-file: "go.mod"
+          cache-dependency-path: "go.sum"
           cache: true
 
       - name: Download Dependencies
@@ -161,7 +164,7 @@ jobs:
           exit 1
 
   bindings:
-    name: '🔗 Verify SDK bindings'
+    name: "🔗 Verify SDK bindings"
     runs-on: ubuntu-24.04-arm
     if: github.event.pull_request.draft == false
 
@@ -173,12 +176,15 @@ jobs:
 
       - name: Check Out
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # These jobs only read the tree; none of them runs git push.
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version-file: 'go.mod'
-          cache-dependency-path: 'go.sum'
+          go-version-file: "go.mod"
+          cache-dependency-path: "go.sum"
           cache: true
 
       # A blueprint names SDK symbols as strings, so it can name one that does not
@@ -196,7 +202,7 @@ jobs:
           echo "::endgroup::"
 
   interop:
-    name: '🔀 Round-trip through tfplugingen-framework'
+    name: "🔀 Round-trip through tfplugingen-framework"
     runs-on: ubuntu-24.04-arm
     if: github.event.pull_request.draft == false
 
@@ -208,12 +214,15 @@ jobs:
 
       - name: Check Out
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # These jobs only read the tree; none of them runs git push.
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version-file: 'go.mod'
-          cache-dependency-path: 'go.sum'
+          go-version-file: "go.mod"
+          cache-dependency-path: "go.sum"
           cache: true
 
       # The exported specification is committed, so it drifts for the same reasons
@@ -236,8 +245,11 @@ jobs:
             echo "### ❌ The exported specification is out of date"
             echo ""
             echo '```bash'
-            echo 'go run ./cmd/tfpluginframeworkgen interop export \'
-            echo '  -blueprint blueprints/thousandeyes \'
+            # Double quotes with an escaped backslash, not a single-quoted string ending
+            # in one: the latter reads as an attempt to escape the closing quote. The text
+            # has no expansion in it, so the quoting style makes no other difference.
+            echo "go run ./cmd/tfpluginframeworkgen interop export \\"
+            echo "  -blueprint blueprints/thousandeyes \\"
             echo '  -out interop-specs/thousandeyes/provider-code-spec.json'
             echo '```'
           } >> "$GITHUB_STEP_SUMMARY"
@@ -291,7 +303,7 @@ jobs:
           echo "✅ HashiCorp's own generator accepted the export and produced formatted Go."
 
   probe-replay:
-    name: '🔬 Re-derive probe facts offline'
+    name: "🔬 Re-derive probe facts offline"
     runs-on: ubuntu-24.04-arm
     if: github.event.pull_request.draft == false
 
@@ -324,12 +336,15 @@ jobs:
 
       - name: Check Out
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # These jobs only read the tree; none of them runs git push.
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version-file: 'go.mod'
-          cache-dependency-path: 'go.sum'
+          go-version-file: "go.mod"
+          cache-dependency-path: "go.sum"
           cache: true
 
       - name: Download Dependencies

.github/workflows/dependancy-review.yml

@@ -1,24 +1,25 @@
-name: 'Dependency Review'
+name: "Dependency Review"
 on: [pull_request]
 
 permissions:
   contents: read
 
 jobs:
   dependency-review:
-    name: '🔎 Dependency Review'
+    name: "🔎 Dependency Review"
     runs-on: ubuntu-latest
     steps:
-
       - name: Harden Runner
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
-      - name: 'Checkout Repository'
+      - name: "Checkout Repository"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          # These jobs only read the tree; none of them runs git push.
+          persist-credentials: false
           fetch-depth: 0
-          
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
+
+      - name: "Dependency Review"
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/go-lint.yml

@@ -5,18 +5,18 @@ on:
   pull_request:
     types: [opened, synchronize]
     paths:
-      - '.github/workflows/go-lint.yml'
-      - '.golangci.yml'
-      - '**/*.go'
+      - ".github/workflows/go-lint.yml"
+      - ".golangci.yml"
+      - "**/*.go"
 
 permissions:
   contents: read
-  pull-requests: write  # Needed for "only-new-issues" and commenting on PR
-  issues: write  # Needed for commenting on PR
+  pull-requests: write # Needed for "only-new-issues" and commenting on PR
+  issues: write # Needed for commenting on PR
 
 jobs:
   golint:
-    name: '✨ Run golangci-lint'
+    name: "✨ Run golangci-lint"
     runs-on: ubuntu-24.04-arm
 
     steps:
@@ -25,16 +25,18 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Check Out  
+      - name: Check Out
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          fetch-depth: 0  # Get full history for full merge-base detection
-
+          # These jobs only read the tree; none of them runs git push.
+          persist-credentials: false
+          fetch-depth: 0 # Get full history for full merge-base detection
+
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version-file: 'go.mod'
-          cache-dependency-path: 'go.sum'
+          go-version-file: "go.mod"
+          cache-dependency-path: "go.sum"
           cache: true
           go-version: stable
 
@@ -45,41 +47,53 @@ jobs:
           args: --timeout=30m --verbose --config=./.golangci.yml --issues-exit-code=0
           only-new-issues: true
           github-token: ${{ secrets.GITHUB_TOKEN }}
-          skip-cache: false              # restore and save cache
-          skip-save-cache: false         # allow saving any new cache
+          skip-cache: false # restore and save cache
+          skip-save-cache: false # allow saving any new cache
           cache-invalidation-interval: 7 # auto-invalidate (refresh) once per week
-      
+
       # Save artifacts on failure
       - name: Save artifacts
         if: failure()
+        # Through the environment, not through ${{ }}. An expression is spliced into the
+        # script text before the shell runs, and a fork's repository name is chosen by
+        # whoever owns the fork, so it can carry shell metacharacters. printf rather than
+        # echo because echo's handling of a leading dash or a backslash varies by shell.
+        env:
+          GH_OWNER: ${{ github.repository_owner }}
+          GH_REPO: ${{ github.event.repository.name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
           mkdir -p wr_actions
-          echo ${{ github.repository_owner }} > wr_actions/ghowner.txt
-          echo ${{ github.event.repository.name }} > wr_actions/ghrepo.txt
-          echo ${{ github.event.pull_request.number }} > wr_actions/prnumber.txt
-      
+          printf '%s\n' "$GH_OWNER" > wr_actions/ghowner.txt
+          printf '%s\n' "$GH_REPO" > wr_actions/ghrepo.txt
+          printf '%s\n' "$PR_NUMBER" > wr_actions/prnumber.txt
+
       - name: Upload artifacts
         if: failure()
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: artifact
           path: wr_actions
-      
+
       # Comment on failure
       - name: Get run url
         if: failure()
         run: |
-          echo "gha_url=https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}" >> $GITHUB_ENV
-          
+          echo "gha_url=https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}" >> "$GITHUB_ENV"
+
       - name: Send build failure comment
         if: failure()
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           result-encoding: string
+          # No ${{ }} in the script body: github-script provides the issue number
+          # through its own context, and gha_url is already in the environment from the
+          # previous step, so both are read at run time rather than pasted into the
+          # source before it is evaluated.
           script: |
             github.rest.issues.createComment({
-              issue_number: ${{ github.event.pull_request.number }},
+              issue_number: context.issue.number,
               owner: context.repo.owner,
               repo: context.repo.repo,
-              body: '<b>Build failure</b> \n\n This pull request contains a build failure which needs addressed [here](${{ env.gha_url}}) .'
-            })
+              body: `<b>Build failure</b> \n\n This pull request contains a build failure which needs addressed [here](${process.env.gha_url}) .`,
+            })