CI: restore native safety checks and harden workflows

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -16,51 +16,93 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
-  CARGO_PROFILE_DEV_DEBUG: 0
-  CARGO_PROFILE_TEST_DEBUG: 0
+  CARGO_INCREMENTAL: "0"
+  CARGO_PROFILE_DEV_DEBUG: "0"
+  CARGO_PROFILE_TEST_DEBUG: "0"
   CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: "1"
 
 jobs:
   quality:
+    # This name is a required status check on main. Keep it stable.
     name: Quality and Linux smoke test
     runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+
       - name: Install Linux application dependencies
         run: |
           sudo apt-get update
           sudo apt-get install -y \
             build-essential \
+            dbus-x11 \
+            gnome-keyring \
             libayatana-appindicator3-dev \
             librsvg2-dev \
             libssl-dev \
             libwebkit2gtk-4.1-dev \
             libxdo-dev \
             xvfb
-      - uses: pnpm/action-setup@v6
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 11.3.0
-      - uses: actions/setup-node@v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: pnpm
-      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
+
+      - name: Restore Rust cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          shared-key: ci-linux
-      - run: make setup
-      - run: make check
+          shared-key: ci-linux-x64
+          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+
+      - name: Fetch locked Rust dependencies
+        run: cargo fetch --locked
+
+      - name: Install locked frontend dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run the complete quality gate
+        run: make check
+
+      - name: Verify Linux Secret Service backup and restore
+        run: |
+          mkdir -p \
+            "$RUNNER_TEMP/cleanerx-keyring/data" \
+            "$RUNNER_TEMP/cleanerx-keyring/config" \
+            "$RUNNER_TEMP/cleanerx-keyring/runtime"
+          chmod 700 "$RUNNER_TEMP/cleanerx-keyring/runtime"
+          dbus-run-session -- bash -euo pipefail -c '
+            export XDG_DATA_HOME="$1/data"
+            export XDG_CONFIG_HOME="$1/config"
+            export XDG_RUNTIME_DIR="$1/runtime"
+            eval "$(printf "\n" | gnome-keyring-daemon --unlock --components=secrets)"
+            CLEANERX_LINUX_SECRET_SERVICE_TEST=1 \
+              cargo test --workspace --locked live_linux_secret_service_backup_round_trip -- --ignored
+          ' _ "$RUNNER_TEMP/cleanerx-keyring"
+
       - name: Build Linux debug application
-        run: cargo build -p cleanerx-app
+        run: cargo build --locked -p cleanerx-app
+
       - name: Smoke-test Linux application
         run: make smoke-linux LINUX_PROFILE=debug
 
   platform:
+    # The macOS and Windows x64 names are required status checks on main.
     name: ${{ matrix.name }} tests
     strategy:
       fail-fast: false
@@ -69,21 +111,27 @@ jobs:
           - name: macOS
             runner: macos-15
             platform: macos
+            credential_test: false
           - name: Linux ARM64
             runner: ubuntu-22.04-arm
             platform: linux
+            credential_test: false
           - name: Windows
             runner: windows-2025
             platform: windows
+            credential_test: true
           - name: Windows ARM64
             runner: windows-11-vs2026-arm
             platform: windows
+            credential_test: false
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+
       - name: Install Linux application dependencies
         if: matrix.platform == 'linux'
         run: |
@@ -96,28 +144,53 @@ jobs:
             libwebkit2gtk-4.1-dev \
             libxdo-dev \
             xvfb
-      - uses: pnpm/action-setup@v6
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 11.3.0
-      - uses: actions/setup-node@v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: pnpm
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+
+      - name: Restore Rust cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: ci-${{ runner.os }}-${{ runner.arch }}
-      - run: pnpm install --frozen-lockfile
+          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+
+      - name: Fetch locked Rust dependencies
+        run: cargo fetch --locked
+
+      - name: Install locked frontend dependencies
+        run: pnpm install --frozen-lockfile
+
       - name: Build frontend assets
         run: pnpm build
+
       - name: Test Rust workspace
-        run: cargo test --workspace
+        run: cargo test --workspace --locked
+
+      - name: Verify Windows Credential Manager backup and restore
+        if: matrix.credential_test
+        env:
+          CLEANERX_WINDOWS_CREDENTIAL_MANAGER_TEST: "1"
+        run: cargo test --workspace --locked live_windows_credential_manager_backup_round_trip -- --ignored
+
       - name: Build desktop application
-        run: cargo build -p cleanerx-app
+        run: cargo build --locked -p cleanerx-app
+
       - name: Smoke-test Windows application
         if: matrix.platform == 'windows'
         shell: pwsh
         run: ./scripts/smoke-windows.ps1 -Profile debug
+
       - name: Smoke-test Linux application
         if: matrix.platform == 'linux'
         run: make smoke-linux LINUX_PROFILE=debug

.github/workflows/release.yml

@@ -21,11 +21,11 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       - name: Require a SemVer tag from main
         env:
           RELEASE_TAG: ${{ github.ref_name }}
@@ -119,7 +119,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 40
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install Linux bundle dependencies
@@ -140,20 +140,20 @@ jobs:
         if: matrix.platform == 'windows' && matrix.arch == 'arm64'
         shell: pwsh
         run: choco install make --no-progress -y
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 11.3.0
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: pnpm
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         if: matrix.target == ''
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         if: matrix.target != ''
         with:
           targets: ${{ matrix.target }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: release-${{ matrix.platform }}-${{ matrix.arch }}
       - run: pnpm install --frozen-lockfile
@@ -313,7 +313,7 @@ jobs:
             echo "node=$(node --version)"
             echo "pnpm=$(pnpm --version)"
           } > "release-assets/CleanerX-${RELEASE_VERSION}-${RELEASE_PLATFORM}-${RELEASE_ARCH}.txt"
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-${{ matrix.platform }}-${{ matrix.arch }}
           path: release-assets/*
@@ -327,10 +327,10 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           pattern: release-*
           path: release-assets