Security: fix dependency vulnerabilities

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.23'
+          go-version: '1.25'
       - run: make build
       - uses: golangci/golangci-lint-action@v7
         with:

.github/workflows/security.yml

@@ -0,0 +1,44 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dependencies:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install osv-scanner
+        run: |
+          curl -sSfL -o "$RUNNER_TEMP/osv-scanner" https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_amd64
+          chmod +x "$RUNNER_TEMP/osv-scanner"
+
+      - name: Scan dependencies
+        run: |
+          status=0
+          "$RUNNER_TEMP/osv-scanner" scan source -r . || status=$?
+          if [ "$status" -gt 1 ]; then
+            exit "$status"
+          fi
+          status=0
+          "$RUNNER_TEMP/osv-scanner" scan source -r --format json --output-file "$RUNNER_TEMP/osv.json" . || status=$?
+          if [ "$status" -gt 1 ]; then
+            exit "$status"
+          fi
+          count=$(jq '[.results[]?.packages[].groups[] | select((.max_severity // "" | tonumber? // 0) >= 7)] | length' "$RUNNER_TEMP/osv.json")
+          if [ "$count" -gt 0 ]; then
+            echo "::error::$count High/Critical vulnerabilities found"
+            exit 1
+          fi
+
+  govulncheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: golang/govulncheck-action@v1
+        with:
+          go-version-input: '1.25'

Dockerfile

@@ -1,11 +1,11 @@
-FROM golang:1.23-alpine AS builder
+FROM golang:1.25-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /uigraph-cli .
 
-FROM alpine:3.20
+FROM alpine:3.24
 RUN apk add --no-cache ca-certificates git
 COPY --from=builder /uigraph-cli /usr/local/bin/uigraph-cli
 ENTRYPOINT ["/usr/local/bin/uigraph-cli"]

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release receives security fixes.
+
+## Reporting a Vulnerability
+
+Please do not report security vulnerabilities through public GitHub issues.
+
+Report them privately through [GitHub Security Advisories](https://github.com/uigraph-oss/uigraph-cli/security/advisories/new). We will acknowledge your report within 3 business days and keep you updated until it is resolved.