ci: harden GitHub Actions security

[kratsg]

Summary

CI security hardening for .github/workflows/base_builder.yaml. No source code, lint config, or test code changed.

• Pinned every action reference to its resolved commit SHA (with a version comment), via actions-up --min-age=7 --style=sha --include-branches.
• Fixed all zizmor --persona=pedantic findings on .github:
  • artipacked: added persist-credentials: false to the checkout step.
  • excessive-permissions: set permissions: {} at the workflow level, and granted the docker job only contents: read (needed by checkout).
  • concurrency-limits: added a per-ref concurrency group with cancel-in-progress: true.
  • anonymous-definition (info): named the docker job.
• Added .github/dependabot.yml (none existed) for monthly, grouped, 7-day-cooldown updates of GitHub Actions.

This repo has no .pre-commit-config.yaml, pyproject.toml, or pixi.toml, so the pre-commit-hook-update and exclude-newer/cooldown steps of the secure-ci checklist don't apply here.

Major version changes

actions-up bumped every action in the workflow to its latest release (all were outside the 7-day cooldown). All are major version bumps:

Action	Before	After
actions/checkout	v4.2.2	v7.0.1
docker/metadata-action	v5.7.0	v6.2.0
docker/setup-qemu-action	v3.6.0	v4.2.0
docker/setup-buildx-action	v3.10.0	v4.2.0
docker/login-action (x2)	v3.4.0	v4.6.0
docker/build-push-action (x2)	v6.15.0	v7.3.0
peter-evans/repository-dispatch	v3.0.0	v4.0.1

Each pinned SHA was verified against git ls-remote for the corresponding tag, and each new version is newer than what was previously pinned (no actions-up sorting mixups observed). Since this workflow builds and pushes real images consumed by GitOps (usatlas/analysisbase-dask-uc), please review the major bumps - especially docker/build-push-action v6 to v7 and actions/checkout v4 to v7 - before merging, given none of this could be exercised locally (registry logins and the repository-dispatch trigger require repo secrets).

Held-back items

None. No .pre-commit-config.yaml exists, so no hook updates were needed, and no action update was inside the cooldown window or broke anything in scope.

zizmor ignores

None added - every finding was fixed directly rather than suppressed.

Not done (flagged for a separate change set)

The secure-ci checklist also recommends isolating deploy jobs from build jobs (separate job + artifact hand-off) so push credentials aren't live during the image build step. base_builder.yaml currently does the QEMU/buildx setup, both registry logins, the build, the push, and the GitOps repository-dispatch all in one job. Splitting this cleanly would mean exporting the built image as an artifact from a build job and loading/pushing it from a separate deploy job, which is a real change to the release pipeline (two registries + a downstream GitOps trigger) rather than a pure hardening tweak. I held this back rather than risk breaking the image publish path in a security-hardening PR - happy to do it as a follow-up if you want it.

Verification

• uvx zizmor --persona=pedantic .github → no findings.
• No action reference in .github is a tag or branch; all are SHAs with a version comment (verified via grep).
• .pre-commit-config.yaml does not exist in this repo, so prek was not applicable.