Backports and pin down dependencies (v2-edge) (#490)

Backports the entire delta from `main` into `v2-edge`.

Also pins down the Micro* deps for docs, pipeline and go.

Closes #374.

.github/workflows/commits.yml

@@ -1,14 +1,36 @@
 name: Commits
 on:
-  - pull_request
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
 
 jobs:
   commits:
-    name: Canonical CLA signed
-    runs-on: ubuntu-22.04
+    name: Branch target and CLA
+    runs-on: ubuntu-latest
     steps:
+      - name: Check branch target
+        env:
+          TARGET: ${{ github.event.pull_request.base.ref }}
+          TITLE: ${{ github.event.pull_request.title }}
+        if: ${{ github.actor != 'dependabot[bot]' }}
+        run: |
+          set -eux
+          TARGET_FROM_PR_TITLE="$(echo "${TITLE}" | sed -n 's/.*(\(v[0-9]-\(edge\|candidate\)\))$/\1/p')"
+          if [ -z "${TARGET_FROM_PR_TITLE}" ]; then
+            TARGET_FROM_PR_TITLE="main"
+          else
+            echo "Branch target overridden from PR title"
+          fi
+          [ "${TARGET}" = "${TARGET_FROM_PR_TITLE}" ] && exit 0
+
+          echo "Invalid branch target: ${TARGET} != ${TARGET_FROM_PR_TITLE}"
+          exit 1
+
       - name: Check if CLA signed
-        uses: canonical/has-signed-canonical-cla@main
+        uses: canonical/has-signed-canonical-cla@046337b42822b7868ad62970988929c79f9c1d40 # 1.2.3

.github/workflows/security.yml

@@ -18,28 +18,45 @@ defaults:
 
 jobs:
   trivy-repo:
-    name: Trivy vulnerability scanner - Repository
+    name: Trivy - Repository
     runs-on: ubuntu-22.04
     if: ${{ github.ref_name == 'main' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
         with:
           ref: main
 
       - name: Install Trivy
         uses: canonical/lxd/.github/actions/install-trivy@main
 
+      - name: Download Trivy DB
+        id: db_download
+        run: trivy fs --download-db-only --cache-dir /home/runner/vuln-cache
+        continue-on-error: true
+
+      - name: Use previous downloaded database
+        if: ${{ steps.db_download.outcome == 'failure' }}
+        uses: actions/cache/restore@3624ceb22c1c5a301c8db4169662070a689d9ea8 # v4.1.1
+        with:
+          path: /home/runner/vuln-cache
+          key: trivy-latest-cache
+
       - name: Run Trivy vulnerability scanner
         run: |
-          trivy fs --quiet --scanners vuln,secret,misconfig --format sarif --cache-dir /home/runner/vuln-cache \
-          --severity LOW,MEDIUM,HIGH,CRITICAL --output trivy-microcloud-repo-scan-results.sarif .
+          trivy fs --skip-db-update \
+          --scanners vuln,secret,misconfig \
+          --format sarif \
+          --cache-dir /home/runner/vuln-cache \
+          --severity LOW,MEDIUM,HIGH,CRITICAL \
+          --output trivy-microcloud-repo-scan-results.sarif .
 
-      - name: Cache trivy and vulnerability database
-        uses: actions/cache/save@v4
+      - name: Cache Trivy vulnerability database
+        if: ${{ steps.db_download.outcome == 'success' }}
+        uses: actions/cache/save@3624ceb22c1c5a301c8db4169662070a689d9ea8 # v4.1.1
         with:
-            path: /home/runner/vuln-cache
-            key: trivy-cache-${{ github.run_id }}
+          path: /home/runner/vuln-cache
+          key: trivy-latest-cache
 
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v3
@@ -49,47 +66,54 @@ jobs:
           ref: refs/heads/main
 
   trivy-snap:
-    name: Trivy vulnerability scanner - Snap
+    name: Trivy - Snap
     runs-on: ubuntu-22.04
     if: ${{ github.ref_name == 'main' }}
     needs: trivy-repo
     strategy:
       matrix:
-        version:
-          - "latest"
+        include:
+          - channel: "3/edge"
+            branch: "main"
+          - channel: "2/candidate"
+            branch: "v2-edge"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
         with:
-          ref: ${{ (matrix.version == 'latest' && 'main') || format('stable-{0}', matrix.version) }}
+          ref: ${{ matrix.branch }}
 
       - name: Install Trivy
         uses: canonical/lxd/.github/actions/install-trivy@main
 
       - name: Restore cached Trivy vulnerability database
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@3624ceb22c1c5a301c8db4169662070a689d9ea8 # v4.1.1
         with:
           path: /home/runner/vuln-cache
-          key: trivy-cache-${{ github.run_id }}
+          key: trivy-latest-cache
 
       - name: Download snap for scan
         run: |
-          snap download microcloud --channel=${{ matrix.version }}/stable
+          snap download microcloud --channel=${{ matrix.channel }}
           unsquashfs ./microcloud*.snap
 
       - name: Run Trivy vulnerability scanner
         run: |
-          trivy rootfs --quiet --scanners vuln,secret,misconfig --format sarif --cache-dir /home/runner/vuln-cache \
-          --severity LOW,MEDIUM,HIGH,CRITICAL --output ${{ matrix.version }}-stable.sarif squashfs-root
+          trivy rootfs --skip-db-update \
+          --scanners vuln,secret,misconfig \
+          --format sarif \
+          --cache-dir /home/runner/vuln-cache \
+          --severity LOW,MEDIUM,HIGH,CRITICAL \
+          --output snap-scan-results.sarif squashfs-root
 
       - name: Flag snap scanning alerts
         run: |
-          jq '.runs[].tool.driver.rules[] |= (.shortDescription.text |= "Snap scan - " + .)' ${{ matrix.version }}-stable.sarif > tmp.json
-          mv tmp.json ${{ matrix.version }}-stable.sarif
+          jq '.runs[].tool.driver.rules[] |= (.shortDescription.text |= "Snap scan - " + .)' snap-scan-results.sarif > tmp.json
+          mv tmp.json snap-scan-results.sarif
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@f779452ac5af1c261dce0346a8f964149f49322b # v3.26.13
         with:
-          sarif_file: "${{ matrix.version }}-stable.sarif"
+          sarif_file: "snap-scan-results.sarif"
           sha: ${{ github.sha }}
-          ref: refs/heads/${{ (matrix.version == 'latest' && 'main') || format('stable-{0}', matrix.version) }}
+          ref: refs/heads/${{ matrix.branch }}