Fix codeql warnings

Author: webstackdev

.github/workflows/build-release.yml

@@ -52,16 +52,20 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: 11.1.2
+
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "22"
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
+          node-version: "24"
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
 
       - name: Install frontend dependencies
-        working-directory: frontend
-        run: npm ci
+        run: pnpm install --filter=@digestengine/frontend --frozen-lockfile
 
       - name: Prepare frontend env
         working-directory: frontend
@@ -70,12 +74,11 @@ jobs:
           echo "NEXTAUTH_SECRET=ci-build-secret" >> .env.local
 
       - name: Build frontend
-        working-directory: frontend
         env:
           NEXT_PUBLIC_API_URL: http://localhost:8000
           NEXTAUTH_URL: http://localhost:3000
           NEXTAUTH_SECRET: ci-build-secret
-        run: npm run build
+        run: pnpm --filter=@digestengine/frontend run build
 
   build-backend:
     name: Build and scan backend image
@@ -96,6 +99,7 @@ jobs:
         with:
           image-ref: digest-engine-ci:${{ github.sha }}
           scan-type: image
+          scanners: vuln
           severity: HIGH,CRITICAL
           ignore-unfixed: true
           exit-code: "1"

.github/workflows/lint.yml

@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
         with:
           version: "0.8.17"
           enable-cache: true
@@ -31,12 +31,17 @@ jobs:
         run: uv python install 3.13
 
       - name: Initialize Pants
-        uses: pantsbuild/actions/init-pants@v10
+        uses: pantsbuild/actions/init-pants@ab362158088bb31685015e7f5728a4c1df3c0e6e # v10
         with:
           gha-cache-key: cache0-py313
           named-caches-hash: ${{ hashFiles('3rdparty/python/default.lock', 'pants.toml') }}
           pants-ci-config: ""
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: 11.1.0
+
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:

.github/workflows/test.yml

@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
         with:
           version: "0.8.17"
           enable-cache: true
@@ -31,12 +31,17 @@ jobs:
         run: uv python install 3.13
 
       - name: Initialize Pants
-        uses: pantsbuild/actions/init-pants@v10
+        uses: pantsbuild/actions/init-pants@ab362158088bb31685015e7f5728a4c1df3c0e6e # v10
         with:
           gha-cache-key: cache0-py313
           named-caches-hash: ${{ hashFiles('3rdparty/python/default.lock', 'pants.toml') }}
           pants-ci-config: ""
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: 11.1.0
+
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:

core/permissions.py

@@ -13,9 +13,11 @@
     class PermissionBase(permissions.BasePermission):
         """Typed shim for DRF permissions whose default methods return bool."""
 
-        def has_permission(self, request, view) -> bool: ...
+        def has_permission(self, request, view) -> bool:
+            raise NotImplementedError()
 
-        def has_object_permission(self, request, view, obj) -> bool: ...
+        def has_object_permission(self, request, view, obj) -> bool:
+            raise NotImplementedError()
 
 else:
     PermissionBase = permissions.BasePermission

docker/web/Dockerfile

@@ -9,6 +9,7 @@ ARG UV_VERSION=0.8.17
 WORKDIR /app
 
 RUN apt-get update \
+    && apt-get upgrade --yes \
     && apt-get install --yes --no-install-recommends build-essential curl libpq-dev \
     && rm -rf /var/lib/apt/lists/*