fix(ci): align gateway build base and add image security audit

Pin the Rust builder to Bookworm to match the runtime glibc, scan trogon-gateway canary images with Trivy/SBOM in CI, and keep docs builds on Corepack-managed pnpm with frozen installs.

Author: yordis

.github/workflows/canary-container-images.yml

@@ -51,6 +51,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push canary image
+        id: build_image
         uses: docker/build-push-action@v7
         with:
           context: ${{ steps.service_config.outputs.context }}
@@ -61,3 +62,38 @@ jobs:
             ${{ steps.image.outputs.name }}:sha-${{ steps.image.outputs.short_sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          sbom: true
+          provenance: mode=max
+
+      - name: Scan image for vulnerabilities
+        uses: aquasecurity/trivy-action@0.32.0
+        with:
+          image-ref: ${{ steps.image.outputs.name }}:canary
+          scanners: vuln
+          format: table
+          output: trivy-results.txt
+          ignore-unfixed: true
+          exit-code: 0
+
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0.20.6
+        with:
+          image: ${{ steps.image.outputs.name }}:canary
+          artifact-name: sbom-${{ matrix.service }}-spdx
+          format: spdx-json
+
+      - name: Document image security audit
+        shell: bash
+        run: |
+          {
+            echo "## Image security audit: \`${{ matrix.service }}\`"
+            echo ""
+            echo "- Image: \`${{ steps.image.outputs.name }}:canary\`"
+            echo "- Runtime base: \`debian:bookworm-20260518-slim\`"
+            echo "- SBOM artifact: \`sbom-${{ matrix.service }}-spdx\` (SPDX JSON)"
+            echo ""
+            echo "### Vulnerability scan (Trivy, image packages)"
+            echo '```text'
+            cat trivy-results.txt
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/docs-pages.yml

@@ -24,18 +24,16 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@fdbc4fdcf7d143a5d0a39e9a02e103b13e309024
-        with:
-          version: 11.5.1
-
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
-          node-version: 24
+          node-version: 26
           cache: pnpm
           cache-dependency-path: docs/pnpm-lock.yaml
 
+      - name: Enable Corepack
+        run: corepack enable
+
       - name: Setup Pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d
 

.mise.toml

@@ -18,7 +18,7 @@ depends = ["build:rust", "build:docs"]
 
 [tasks."build:docs"]
 dir = "docs"
-run = "pnpm docs:build"
+run = "pnpm install --frozen-lockfile && pnpm docs:build"
 
 [tasks."build:rust"]
 dir = "rsworkspace"

devops/docker/compose/services/trogon-gateway/Dockerfile

@@ -1,5 +1,5 @@
 # ── Stage 1: chef — generate dependency recipe ──────────────────────────────
-FROM rust:1.96.0-slim AS chef
+FROM rust:1.96.0-slim-bookworm AS chef
 
 RUN cargo install cargo-chef --locked