build: harden release provenance and package metadata

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,8 @@
 blank_issues_enabled: false
 contact_links:
-  - name: MinIO Community Support
-    url: https://slack.min.io
-    about: Please ask and answer questions here.
+  - name: Silo Documentation
+    url: https://silo.pgsty.com/
+    about: Client reference, downloads, and release notes for this fork.
+  - name: Report a Vulnerability
+    url: https://silo.pgsty.com/about/security/
+    about: Please report security issues privately instead of opening a public issue.

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+
+updates:
+  # Workflow actions are pinned to commit SHAs so a moving tag cannot change
+  # what runs in the release pipeline. Dependabot keeps those pins current.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: ci

.github/goreleaser.yml

@@ -10,8 +10,8 @@ before:
   hooks:
     - make clean
     - go generate ./...
-    - go mod tidy
     - go mod download
+    - go mod verify
 
 builds:
   - id: mcli

.github/nfpm.yml

@@ -4,15 +4,13 @@ platform: linux
 version: ${PKG_VERSION}
 version_schema: none
 release: ${NFPM_RELEASE}
-section: ""
+section: utils
 priority: optional
 maintainer: "Ruohang Feng (@Vonng) <rh@vonng.com>"
-description: |-
-  S3-Interface Libre Object Storage
-  A MinIO fork maintained by the Pigsty community.
+description: S3-Interface Libre Object Storage, Community-maintained MinIO client fork.
 vendor: PGSTY
 homepage: https://silo.pgsty.com
-license: AGPLv3
+license: AGPL-3.0-or-later
 
 contents:
   - src: ${NFPM_SOURCE}
@@ -30,4 +28,4 @@ rpm:
 deb:
   compression: gzip
   fields:
-    License: AGPLv3
+    License: AGPL-3.0-or-later

.github/workflows/docker-release.yml

@@ -54,7 +54,7 @@ jobs:
           } >> "${GITHUB_ENV}"
 
       - name: Checkout release tag
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ inputs.tag }}
           fetch-depth: 0
@@ -93,21 +93,21 @@ jobs:
           echo "RELEASE_REVISION=$(git rev-parse HEAD)" >> "${GITHUB_ENV}"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
         with:
           platforms: arm64
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push amd64 image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: docker-release/amd64
           file: docker-release/amd64/Dockerfile.goreleaser
@@ -122,7 +122,7 @@ jobs:
             org.opencontainers.image.revision=${{ env.RELEASE_REVISION }}
 
       - name: Build and push arm64 image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: docker-release/arm64
           file: docker-release/arm64/Dockerfile.goreleaser

.github/workflows/go-cross.yml

@@ -23,8 +23,8 @@ jobs:
         go-version: [1.26.5]
         os: [ubuntu-latest]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: ${{ matrix.go-version }}
           check-latest: true

.github/workflows/go.yml

@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Test on Go ${{ matrix.go-version }} and ${{ matrix.os }}
@@ -23,13 +26,13 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - name: Set up Go ${{ matrix.go-version }} on ${{ matrix.os }}
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: ${{ matrix.go-version }}
         id: go
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Build on ${{ matrix.os }}
         if: matrix.os == 'windows-latest'
@@ -73,12 +76,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: 1.26.5
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      # The release build no longer runs `go mod tidy`, so drift has to be
+      # caught here instead of being silently applied while cutting a release.
+      - name: Check go.mod and go.sum are tidy
+        run: |
+          go mod tidy
+          git diff --exit-code -- go.mod go.sum
 
       - name: Test 386
         run: GOOS=linux GOARCH=386 go test -short ./...

.github/workflows/release.yml

@@ -13,16 +13,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
 
+      - name: Verify clean checkout
+        run: |
+          set -euo pipefail
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "Refusing to release from a dirty working tree:" >&2
+            git status --porcelain >&2
+            exit 1
+          fi
+
       - name: Compute release variables
         run: |
           set -euo pipefail
@@ -47,7 +56,7 @@ jobs:
           echo "LDFLAGS: ${LDFLAGS}"
 
       - name: Build Draft release with GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
           version: v2.17.1
           args: release --clean --skip=validate --config .github/goreleaser.yml
@@ -56,6 +65,11 @@ jobs:
           LDFLAGS: ${{ env.LDFLAGS }}
           PKG_VERSION: ${{ env.PKG_VERSION }}
 
+      - name: Verify binary provenance stamps
+        run: |
+          set -euo pipefail
+          buildscripts/verify-build-provenance.sh
+
       - name: Install nFPM
         run: |
           set -euo pipefail
@@ -82,7 +96,7 @@ jobs:
 
       - name: Upload dist artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: dist
           path: dist/