chore: refresh the hardened example's pins, scan workflows with CodeQL

.github/workflows/codeql-analysis.yml

@@ -22,7 +22,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'python' ]
+        # 'actions' scans the workflow files themselves. CodeQL was already
+        # expecting a /language:actions configuration and warned on every pull
+        # request that it could not find one, so workflow changes were going
+        # unscanned - including the two workflows edited in #187.
+        language: [ 'python', 'actions' ]
 
     steps:
     - name: Checkout repository
@@ -35,7 +39,10 @@ jobs:
         # Run additional queries for comprehensive security analysis
         queries: +security-extended,security-and-quality
 
+    # Autobuild resolves source dependencies; the 'actions' language analyses
+    # YAML in place and has nothing to build.
     - name: Autobuild
+      if: matrix.language != 'actions'
       uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
 
     - name: Perform CodeQL Analysis

CHANGELOG.md

@@ -50,6 +50,19 @@ All notable changes to DockSec are documented in this file.
 
 ### Fixed
 
+- Refreshed the hardened compose example's base images (`nginx:1.25.3-alpine` ->
+  `1.31.6-alpine`, `postgres:15.5-alpine` -> `15.19-alpine`). The old pins dated
+  from June and carried 35 CRITICAL/HIGH CVEs, which nothing surfaced while the
+  example's images were silently failing to scan. nginx is now clean; the
+  remaining 22 findings are all in the Go `stdlib` compiled into the official
+  postgres image, which has no fix available upstream at any tag - `18.6-alpine`
+  reports exactly the same 22, so staying on the 15 line costs nothing and keeps
+  the example about configuration rather than a major version upgrade.
+
+- CodeQL now scans the workflow files themselves (`language: actions`). It was
+  already expecting that configuration and warned on every pull request that it
+  could not find one, so workflow changes were going unanalyzed.
+
 - **The container image ignored every command-line argument.** `entrypoint.sh`
   built its argument list only from the Action's `INPUT_*` variables and never
   forwarded `"$@"`, so `docker run ghcr.io/owasp/docksec:latest --version` and

examples/compose/docker-compose-secure.yml

@@ -1,7 +1,7 @@
 version: '3.8'
 services:
   web:
-    image: nginx:1.25.3-alpine
+    image: nginx:1.31.6-alpine
     ports:
       - "127.0.0.1:8080:80"
     read_only: true
@@ -22,7 +22,7 @@ services:
       - frontend
 
   db:
-    image: postgres:15.5-alpine
+    image: postgres:15.19-alpine
     user: "70:70"
     read_only: true
     environment: