chore(ci): supply-chain hardening — SHA-pin actions, dependabot, deploy gate

[frankbria]

Hardens the public repo's CI/CD supply chain ahead of beta traffic. From a security pass over all workflows + repo settings.

Workflow changes (this PR)

• SHA-pin every action across all workflows (were mutable tags / @latest). A repointed/compromised action otherwise runs with the workflow's permissions + secrets. Highest-risk pins: webfactory/ssh-agent (holds the VPS SSH deploy key in deploy.yml), anomalyco/opencode/github (was @latest, a moving ref), anthropics/claude-code-action, codecov/codecov-action. Version retained in a trailing comment.
• .github/dependabot.yml (github-actions + pip + npm, weekly, grouped minor/patch) — keeps the pins fresh so they don't rot into known-vulnerable versions.
• Re-enabled the production deploy test gate — deploy.yml's production job had # needs: test commented out, so production could deploy without tests passing.
• Deleted opencode-review.yml — already disabled (if: false) and flagged by its own comment as leaking GITHUB_TOKEN into PR comments, yet still carried issues: write + pull-requests: write. Removed rather than leave a parked, one-toggle-away liability.

Settings already applied (out of band)

• ✅ Dependabot vulnerability alerts + automated security fixes — enabled (were off).
• ✅ Branch protection (main) — added strict (require up-to-date branch before merge) + required conversation resolution; existing required checks / no-force-push preserved.

Verification

• All workflow YAML + dependabot.yml parse.
• Zero active unpinned uses: remain (commented-out lines intentionally untouched).
• This PR's own CI runs test.yml with the new pins — a wrong SHA fails here.

Deliberately NOT changed (your call)

• Required PR review / enforce_admins — would block you merging your own PRs as sole maintainer; skipped per your decision.
• AI workflows on public input (claude.yml/opencode.yml on issue_comment; claude-code-review on every PR) — read-only tokens, fork secrets withheld by GitHub, so limited blast radius. Left as-is.
• Runtime dependency slimming (pytest/ruff/hypothesis are runtime deps) — regression risk; separate change.

Note: confirm anomalyco/opencode is the publisher you intend (upstream OpenCode is sst/opencode).

Summary by CodeRabbit

Release Notes

• Chores
  • Configured automated dependency management for GitHub Actions, Python packages, and npm dependencies.
  • Updated CI/CD workflows to use pinned versions of GitHub Actions.
  • Removed deprecated code review workflow.

[coderabbitai]

Warning

Review limit reached

@frankbria, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 3 hours, 21 minutes, and 11 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a9b41433-b9dc-46ae-b202-37f5de53345a

📥 Commits

Reviewing files that changed from the base of the PR and between c7f78f4 and 754edac.

📒 Files selected for processing (1)

• .github/workflows/opencode.yml

Walkthrough

Adds .github/dependabot.yml to automate weekly minor/patch dependency updates for GitHub Actions, pip, and npm. Pins all GitHub Action uses: references across every workflow file from floating version tags to specific commit SHAs. Removes the permanently-disabled opencode-review.yml workflow. Restores explicit needs: test gating on both deploy-staging and deploy-production jobs.

Changes

CI/CD Security Hardening

Layer / File(s)	Summary
Dependabot configuration .github/dependabot.yml	New file configuring weekly minor/patch-only updates for github-actions (root), pip (root), and npm (/web-ui), each grouped and capped at 5 open PRs.
SHA pinning across all workflows .github/workflows/test.yml, .github/workflows/lifecycle.yml, .github/workflows/deploy.yml, .github/workflows/claude.yml, .github/workflows/claude-code-review.yml, .github/workflows/opencode.yml	Replaces all floating version tags (@v4, @v5, @v1, @latest, etc.) with specific commit SHAs for every uses: step across all six workflows, covering actions/checkout, actions/setup-python, astral-sh/setup-uv, actions/setup-node, codecov/codecov-action, actions/upload-artifact, webfactory/ssh-agent, anthropics/claude-code-action, and anomalyco/opencode/github.
Deploy test gating and opencode-review removal .github/workflows/deploy.yml, .github/workflows/opencode-review.yml	deploy-staging and deploy-production jobs re-add needs: test so deployments require passing tests. The entirely-disabled (if: false) opencode-review.yml workflow is deleted.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• frankbria/codeframe#1: Introduced the Claude Code GitHub workflows that use anthropics/claude-code-action and actions/checkout, the exact action references now being pinned to commit SHAs in this PR.

Poem

🐇 Hop hop, no more floating tags to fear,
Each SHA is pinned, the supply chain is clear.
Dependabot watches while the bunny rests,
Deploy won't ship until it passes tests!
The opencode ghost workflow finally gone —
The warren is tidy, the CI marches on. 🌿

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main changes: supply-chain hardening through SHA-pinning of GitHub Actions and implementing Dependabot with deploy gate re-enablement.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/ci-security-hardening

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/opencode.yml:
- Line 24: The actions/checkout action in the opencode.yml workflow is using v6
(SHA df4cb1c069e1874edd31b4311f1884172cec0e10) while all other workflows in the
PR use v4 (SHA 34e114876b0b11c390a56381ad16ebd13914f8d5). Update the checkout
action to use the same v4 SHA and version comment as the other workflows for
consistency, replacing both the commit hash and the version identifier from v6
to v4.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 97d6695d-410e-4546-869a-207bcd0066aa

📥 Commits

Reviewing files that changed from the base of the PR and between 4637786 and c7f78f4.

📒 Files selected for processing (8)

• .github/dependabot.yml
• .github/workflows/claude-code-review.yml
• .github/workflows/claude.yml
• .github/workflows/deploy.yml
• .github/workflows/lifecycle.yml
• .github/workflows/opencode-review.yml
• .github/workflows/opencode.yml
• .github/workflows/test.yml

💤 Files with no reviewable changes (1)

• .github/workflows/opencode-review.yml