Harden hashavatar-api 1.1.2 security controls

Author: eldryoth

.github/dependabot.yml

@@ -37,3 +37,18 @@ updates:
     commit-message:
       prefix: "chore"
       include: scope
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:30"
+      timezone: Europe/Stockholm
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - containers
+    commit-message:
+      prefix: "chore"
+      include: scope

.github/workflows/ci.yml

@@ -19,20 +19,20 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@1.97.0
+        uses: dtolnay/rust-toolchain@1a3a6d54512beeaffd394f8d516ca16f2c506a20 # 1.97.0
         with:
           components: clippy, rustfmt
 
       - name: Cache cargo
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           cache-on-failure: true
 
       - name: Install security tools
-        uses: taiki-e/install-action@v2.83.0
+        uses: taiki-e/install-action@c7eb1735f09259a5035e8e5d44b1406b1cddc0fb # v2.83.0
         with:
           tool: cargo-deny,cargo-audit,cargo-sbom
 

.github/workflows/images.yml

@@ -28,16 +28,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@v4.2.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -75,12 +75,14 @@ jobs:
           } >> "${GITHUB_OUTPUT}"
 
       - name: Build and publish Wolfi image
-        uses: docker/build-push-action@v7.3.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: Dockerfile
           platforms: ${{ inputs.platforms || 'linux/amd64' }}
           push: true
+          sbom: true
+          provenance: mode=max
           cache-from: type=gha,scope=wolfi
           cache-to: type=gha,mode=max,scope=wolfi
           labels: |

CONTRIBUTING.md

@@ -1,10 +1,10 @@
 # Contributing
 
-Thanks for helping improve `hashavatar`.
+Thanks for helping improve `hashavatar-api`.
 
 ## Development
 
-Use Rust 1.95 or newer.
+Use Rust 1.97 or newer.
 
 ```bash
 scripts/checks.sh
@@ -19,4 +19,7 @@ scripts/checks.sh
 
 ## Visual Stability
 
-`hashavatar` is deterministic. Changes to shape generation, colors, hashing, randomization, or encoder behavior can affect downstream users. When a change intentionally affects output, document it in the changelog.
+The API delegates deterministic rendering to `hashavatar`. Changes to request
+normalization, namespace handling, cache keys, style options, or encoder
+selection can still affect downstream users. Document intentional output or URL
+contract changes in the release notes.