chore: overhaul CI/CD security scanning and harden workflows

.github/dependabot.yml

@@ -13,3 +13,17 @@ updates:
       interval: "weekly"
     commit-message:
       prefix: "chore"
+
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore"

.github/renovate.json

@@ -0,0 +1,28 @@
+{
+  "extends": ["config:recommended"],
+  "automerge": false,
+  "timezone": "Europe/Amsterdam",
+  "labels": ["dependencies"],
+  "schedule": ["before 3am on Monday"],
+  "prHourlyLimit": 2,
+  "prConcurrentLimit": 5,
+  "packageRules": [
+    {
+      "managers": ["gomod"],
+      "groupName": "go modules",
+      "schedule": ["before 3am on Monday"]
+    },
+    {
+      "managers": ["pip"],
+      "groupName": "python packages",
+      "schedule": ["before 3am on Monday"]
+    },
+    {
+      "managers": ["github-actions"],
+      "groupName": "github actions",
+      "automerge": true,
+      "automergeType": "minor",
+      "schedule": ["before 3am on Monday"]
+    }
+  ]
+}

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,36 @@
+name: "CodeQL Analysis"
+
+on:
+  push:
+    branches: [ main, development ]
+  pull_request:
+    branches: [ main, development ]
+  schedule:
+    - cron: '0 3 * * 0'
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  analyze:
+    name: Analyze (python)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        with:
+          languages: python
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        with:
+          category: "/language:python"

.github/workflows/hugo.yml

@@ -22,22 +22,23 @@ jobs:
   build:
     runs-on: ubuntu-latest
     env:
-      HUGO_VERSION: 0.152.2
+      HUGO_VERSION: 0.160.0
     steps:
       - name: Install Hugo CLI
-        run: |
-          wget -O ${{ runner.temp }}/hugo.deb https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb \
-          && sudo dpkg -i ${{ runner.temp }}/hugo.deb
+        uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3.0.0
+        with:
+          hugo-version: '0.160.1'
+          extended: true
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: recursive
           fetch-depth: 0
 
       - name: Setup Pages
         id: pages
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
 
       - name: Build with Hugo
         env:
@@ -51,7 +52,7 @@ jobs:
             --baseURL "${{ steps.pages.outputs.base_url }}/"
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
         with:
           path: ./public
 
@@ -64,4 +65,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

.github/workflows/pr-checks.yml

@@ -34,7 +34,7 @@ jobs:
     name: Markdown lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: DavidAnson/markdownlint-cli2-action@ce4853d43830c74c1753b39f3cf40f71c2031eb9 # v23.0.0
         with:
           globs: "content/**/*.md"
@@ -44,8 +44,8 @@ jobs:
     name: Python security (bandit)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
       - run: pip install bandit
@@ -57,7 +57,7 @@ jobs:
     name: No PNG/JPG in static/images
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Find non-AVIF images
         id: check
@@ -78,7 +78,7 @@ jobs:
 
       - name: Post PR comment
         if: steps.check.outputs.found == 'true'
-        uses: actions/github-script@v8
+        uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0
         env:
           FILES: ${{ steps.check.outputs.files }}
           ACTOR: ${{ github.event.pull_request.user.login }}
@@ -128,7 +128,7 @@ jobs:
     name: EN/NL file parity
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Check every .md has a matching .nl.md
         run: |
           missing=""
@@ -154,7 +154,7 @@ jobs:
     env:
       HUGO_VERSION: 0.152.2
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: recursive
           fetch-depth: 0
@@ -170,7 +170,7 @@ jobs:
           TZ: Europe/Amsterdam
         run: hugo --gc --minify --baseURL "http://localhost/"
       - name: Upload built site
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: hugo-public
           path: public/
@@ -182,7 +182,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: hugo-build
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: hugo-public
           path: public/
@@ -203,7 +203,7 @@ jobs:
     if: always()
     needs: [pr-title, bilingual, image-format, hugo-build, link-check]
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0
         env:
           RESULT_PR_TITLE:    ${{ needs.pr-title.result }}
           RESULT_BILINGUAL:   ${{ needs.bilingual.result }}

.github/workflows/python-checks.yml

@@ -0,0 +1,32 @@
+name: Python Checks
+
+on:
+  push:
+    branches: [ main, development ]
+  pull_request:
+    branches: [ main, development ]
+  schedule:
+    - cron: '0 5 * * 0'
+  workflow_dispatch:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.14'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install flake8 bandit
+
+      - name: Lint with flake8
+        run: flake8 static/scripts/saxion-eduroam.py --max-line-length=120
+
+      - name: Security scan with bandit
+        run: bandit -r static/scripts/saxion-eduroam.py -ll

.github/workflows/trivy-scan.yml

@@ -0,0 +1,30 @@
+name: "Trivy filesystem scan"
+
+on:
+  schedule:
+    - cron: '0 2 * * 0'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Run Trivy filesystem scan
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        with:
+          scan-type: fs
+          severity: CRITICAL,HIGH
+          format: sarif
+          output: trivy-results.sarif
+
+      - name: Upload Trivy results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif

README.md

@@ -7,6 +7,45 @@ CachyOS on the ASUS ROG Zephyrus G16 GA605WV (2024). My personal setup log: docu
 **Browse the full documentation site: [zephyrus-linux.stensel.nl](https://zephyrus-linux.stensel.nl/)**
 
 
+## System information
+
+```
+❯ fish
+					 .-------------------------:                    sten@Sten-Laptop
+					.+=========================.                    ----------------
+				 :++===++==================-       :++-           OS: CachyOS x86_64
+				:*++====+++++=============-        .==:           Host: ROG Zephyrus G16 GA605WV_GA605WV (1.0)
+			 -*+++=====+***++==========:                        Kernel: Linux 6.19.11-1-cachyos
+			=*++++========------------:                         Uptime: 3 hours, 49 mins
+		 =*+++++=====-                     ...                Packages: 1695 (pacman), 22 (flatpak)
+	 .+*+++++=-===:                    .=+++=:              Shell: fish 4.6.0
+	:++++=====-==:                     -*****+              Display (LQ160R1JW02): 2560x1600 @ 1.33x in 16", 240 Hz [Built-in]
+ :++========-=.                      .=+**+.              DE: GNOME 50.0
+.+==========-.                          .                 WM: Mutter (Wayland)
+ :+++++++====-                                .--==-.     WM Theme: Adwaita
+	:++==========.                             :+++++++:    Theme: Adwaita [GTK2/3/4]
+	 .-===========.                            =*****+*+    Icons: Adwaita [GTK2/3/4]
+		.-===========:                           .+*****+:    Font: Adwaita Sans (11pt) [GTK2/3/4]
+			-=======++++:::::::::::::::::::::::::-:  .---:      Cursor: Adwaita (24px)
+			 :======++++====+++******************=.             Terminal: GNOME Console 50.0
+				:=====+++==========++++++++++++++*-               Terminal Font: Adwaita Mono (11pt)
+				 .====++==============++++++++++*-                CPU: AMD Ryzen AI 9 HX 370 (24) @ 5.16 GHz
+					.===+==================+++++++:                 GPU 1: AMD Radeon 890M Graphics [Integrated]
+					 .-=======================+++:                  GPU 2: NVIDIA GeForce RTX 4060 Max-Q / Mobile [Discrete]
+						 ..........................                   Memory: 10.24 GiB / 28.98 GiB (35%)
+																													Swap: 1.28 MiB / 28.98 GiB (0%)
+																													Disk (/): 270.70 GiB / 951.85 GiB (28%) - btrfs
+																													Local IP (wlan0): 192.168.0.72/24
+																													Battery (A32-K55): 100% [AC Connected]
+																													Locale: en_US.UTF-8
+
+
+
+~
+❯ 
+```
+
+
 ## About this project
 
 This is my personal setup log for running CachyOS on this laptop. I'm not a software engineer or developer: just someone who switched to Linux and ran into a lot of things that didn't work out of the box. I figured I'd write it all down so others don't have to go through the same trial and error I did.

README.nl.md

@@ -7,6 +7,45 @@ CachyOS op de ASUS ROG Zephyrus G16 GA605WV (2024). Mijn persoonlijke setup-log:
 **Bekijk de volledige documentatiesite: [zephyrus-linux.stensel.nl](https://zephyrus-linux.stensel.nl/nl/)**
 
 
+## Systeeminformatie
+
+```
+❯ fish
+					 .-------------------------:                    sten@Sten-Laptop
+					.+=========================.                    ----------------
+				 :++===++==================-       :++-           OS: CachyOS x86_64
+				:*++====+++++=============-        .==:           Host: ROG Zephyrus G16 GA605WV_GA605WV (1.0)
+			 -*+++=====+***++==========:                        Kernel: Linux 6.19.11-1-cachyos
+			=*++++========------------:                         Uptime: 3 hours, 49 mins
+		 =*+++++=====-                     ...                Packages: 1695 (pacman), 22 (flatpak)
+	 .+*+++++=-===:                    .=+++=:              Shell: fish 4.6.0
+	:++++=====-==:                     -*****+              Display (LQ160R1JW02): 2560x1600 @ 1.33x in 16", 240 Hz [Built-in]
+ :++========-=.                      .=+**+.              DE: GNOME 50.0
+.+==========-.                          .                 WM: Mutter (Wayland)
+ :+++++++====-                                .--==-.     WM Theme: Adwaita
+	:++==========.                             :+++++++:    Theme: Adwaita [GTK2/3/4]
+	 .-===========.                            =*****+*+    Icons: Adwaita [GTK2/3/4]
+		.-===========:                           .+*****+:    Font: Adwaita Sans (11pt) [GTK2/3/4]
+			-=======++++:::::::::::::::::::::::::-:  .---:      Cursor: Adwaita (24px)
+			 :======++++====+++******************=.             Terminal: GNOME Console 50.0
+				:=====+++==========++++++++++++++*-               Terminal Font: Adwaita Mono (11pt)
+				 .====++==============++++++++++*-                CPU: AMD Ryzen AI 9 HX 370 (24) @ 5.16 GHz
+					.===+==================+++++++:                 GPU 1: AMD Radeon 890M Graphics [Integrated]
+					 .-=======================+++:                  GPU 2: NVIDIA GeForce RTX 4060 Max-Q / Mobile [Discrete]
+						 ..........................                   Memory: 10.24 GiB / 28.98 GiB (35%)
+																													Swap: 1.28 MiB / 28.98 GiB (0%)
+																													Disk (/): 270.70 GiB / 951.85 GiB (28%) - btrfs
+																													Local IP (wlan0): 192.168.0.72/24
+																													Battery (A32-K55): 100% [AC Connected]
+																													Locale: en_US.UTF-8
+
+
+
+~
+❯ 
+```
+
+
 ## Over dit project
 
 Dit is mijn persoonlijke setup-log voor CachyOS op deze laptop. Ik ben geen software-engineer of developer: gewoon iemand die naar Linux is overgestapt en daarna tegen van alles aanliep wat niet meteen werkte. Ik heb alles opgeschreven zodat anderen niet hetzelfde hoeven uitzoeken als ik.

content/_index.md

@@ -38,8 +38,8 @@ toc: false
 | **iGPU** | AMD Radeon 890M |
 | **dGPU** | NVIDIA GeForce RTX 4060 Laptop (Max-Q) |
 | **OS** | CachyOS (Arch) |
-| **Kernel** | 6.19.8-1-cachyos |
-| **Display Server** | Wayland (GNOME 49) |
+| **Kernel** | 6.19.11-1-cachyos |
+| **Display Server** | Wayland (GNOME 50) |
 | **CPU Scheduler** | scx_lavd (sched_ext) |
 | **Secure Boot** | Enabled |
 

content/_index.nl.md

@@ -38,8 +38,8 @@ toc: false
 | **iGPU** | AMD Radeon 890M |
 | **dGPU** | NVIDIA GeForce RTX 4060 Laptop (Max-Q) |
 | **OS** | CachyOS (Arch) |
-| **Kernel** | 6.19.8-1-cachyos |
-| **Display Server** | Wayland (GNOME 49) |
+| **Kernel** | 6.19.11-1-cachyos |
+| **Display Server** | Wayland (GNOME 50) |
 | **CPU Scheduler** | scx_lavd (sched_ext) |
 | **Secure Boot** | Ingeschakeld |