Add dependencias fijas

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  # Mantiene al día los SHA de las actions fijadas en los workflows.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    # Misma política que tools:update: no se adoptan releases de menos de 7 días.
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/code-report.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
           cache: npm
@@ -47,11 +47,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: getgitops/cli-github-action@v1
+      - uses: getgitops/cli-github-action@9051a668ce26ef933b26b5b9a07cfca77f3f7f3c # v1.0.0
         with:
           command: creport scan
+          version: 1.2.1
           api-key: ${{ secrets.GITOPS_API_KEY }}
           service: gitops-cli
           project: gitops

.github/workflows/release.yml

@@ -19,10 +19,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
           registry-url: https://registry.npmjs.org

.github/workflows/update-tools.yml

@@ -0,0 +1,77 @@
+name: Update scanners
+
+# Revisa cada semana si hay versiones nuevas de Trivy, Syft y Gitleaks con al
+# menos 7 días y abre una PR con src/utils/tool-versions.ts regenerado. Las
+# firmas y checksums se verifican igual que en local (npm run tools:update).
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: update-tools
+  cancel-in-progress: false
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    env:
+      BRANCH: chore/update-scanners
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
+        with:
+          cosign-release: v3.1.3
+
+      - name: Update pinned versions
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: npm run --silent tools:update -- --latest | tee "$RUNNER_TEMP/summary.txt"
+
+      - name: Open pull request
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if git diff --quiet; then
+            echo "Sin cambios."
+            exit 0
+          fi
+
+          {
+            echo "Versiones nuevas de los scanners (publicadas hace al menos 7 días, firmas y checksums verificados):"
+            echo
+            grep '^- ' "$RUNNER_TEMP/summary.txt"
+            echo
+            echo "Antes de mergear revisa las release notes. Después publica una nueva versión de la CLI."
+          } > "$RUNNER_TEMP/body.md"
+
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git checkout -B "$BRANCH"
+          git commit -am 'chore: update pinned scanners'
+          git push --force origin "$BRANCH"
+
+          if gh pr view "$BRANCH" --json state --jq .state 2>/dev/null | grep -q OPEN; then
+            gh pr edit "$BRANCH" --body-file "$RUNNER_TEMP/body.md"
+          else
+            gh pr create --base main --head "$BRANCH" \
+              --title 'chore: update pinned scanners' \
+              --body-file "$RUNNER_TEMP/body.md"
+          fi

.npmrc

@@ -0,0 +1 @@
+save-exact=true

README.md

@@ -83,7 +83,9 @@ ref) automatically. The `--git-*` flags take precedence.
 `gops creport scan` downloads Trivy, Syft and Gitleaks on first use into
 `~/.gitops-cli/tools/<tool>/<version>/`. Versions are pinned in
 `src/utils/tool-versions.ts`, together with the SHA-256 of every release
-archive; a download whose checksum does not match is rejected.
+archive and of the binary it contains; a download whose checksum does not match
+is rejected. Installed binaries are verified again on every use, so a tampered
+tools directory (for example, a poisoned CI cache) is detected and reinstalled.
 
 Run `gops tools install` to download them ahead of time (for example, when
 building a Docker image). `GOPS_TOOLS_DIR` changes the install directory.
@@ -94,10 +96,23 @@ That file is generated, do not edit it by hand. To review and bump versions
 ```bash
 npm run tools:update                                  # pinned vs. available versions
 npm run tools:update -- trivy=0.75.0 syft=1.54.0      # pin new versions
+npm run tools:update -- --latest                      # pin the newest eligible version of each
 ```
 
+The `Update scanners` workflow runs `--latest` every Monday and opens a pull
+request (`chore/update-scanners`) when there is a newer eligible version.
+
+Trivy still refreshes its vulnerability database on every scan (it is data, not
+code), always from the official repositories: the CLI passes them as flags, so a
+`trivy.yaml` in the scanned repository cannot redirect it. Update checks and
+telemetry of the scanners are disabled.
+
 Releases younger than 7 days are refused by default (`--allow-recent` overrides
-it) to leave time for a compromised release to be detected. Review the upstream
+it) to leave time for a compromised release to be detected. The script needs
+[cosign](https://docs.sigstore.dev/cosign/system_config/installation/) in the
+`PATH`: the `checksums.txt` of Trivy and Syft is only accepted if it is signed
+by their release workflow. Gitleaks does not sign its releases, so it is only
+checked against its `checksums.txt` and the GitHub asset digest. Review the upstream
 release notes, commit the regenerated file and publish a new CLI version.
 
 ## Releases

package.json

@@ -31,11 +31,11 @@
     "access": "public"
   },
   "dependencies": {
-    "commander": "^12.0.0"
+    "commander": "12.1.0"
   },
   "devDependencies": {
-    "@types/node": "^20.0.0",
-    "tsx": "^4.7.0",
-    "typescript": "^5.0.0"
+    "@types/node": "20.19.43",
+    "tsx": "4.23.12",
+    "typescript": "5.9.3"
   }
 }