ci: pin actions to commit SHAs, guard Docker jobs from forks, scan the image, gate publish on security (SEC-06, SEC-07, SEC-14, SEC-15, SEC-16)

docs/deployment.md

@@ -132,3 +132,25 @@ The workflows in `.gitea/workflows/` lint, test and build. The `docs-check` job
 `uv run python scripts/check_docs.py`, which fails when `docs/tools.md` or the README tool summary
 is stale, or when a document names a tool that does not exist. `scripts/generate_catalog.py
 --check` fails when `tools.json` does not match the pinned swagger.
+
+Security rules of the pipeline:
+
+- Jobs that use the runner's Docker daemon or a secret (`test-integration`, `test-mcp`,
+  `build-and-push`) do not run for pull requests from forks. Access to the daemon is
+  root-equivalent on the host, and a fork controls the workflow and test code. Also enable
+  "require approval for workflows from forks" (or the equivalent runner setting) in Gitea, and
+  keep the daemon of a shared runner free of services you cannot afford to lose.
+- Every third-party action is pinned to a full commit SHA with the version in a trailing
+  comment. Bump a pin deliberately: look up the SHA of the new tag with
+  `git ls-remote https://github.com/<owner>/<action> refs/tags/<tag>` (add `^{}` for annotated
+  tags). The registry token never reaches a third-party action: the CLI reads it from stdin and
+  `uv publish` reads `UV_PUBLISH_PASSWORD`.
+- `build-and-push` scans the built image with a pinned Trivy (`scripts/ci/install_trivy.sh`,
+  sha256 verified) before anything is pushed, and fails on HIGH or CRITICAL findings that have a
+  fix. `scan.yml` repeats the scan and the dependency audit every week, so a new advisory in a
+  pinned base image turns it red: refresh the digests in `docker/Dockerfile`. Accepted findings
+  go in `security/trivyignore.txt` with a waiver row in [security.md](security.md).
+- `publish.yml` needs the `security` job (secret scan, security tests, dependency audit, bandit
+  rules) as well as lint and tests.
+- The cleanup script removes containers only for per-run image names (`aegis-ci-<run id>-...`)
+  and immutable `:sha-` tags. Shared tags (`:latest`, `:main`, `:dev`) are only untagged.