create-daloy 0.34.2 → 0.35.0

package/sbom.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:6244f261-e99d-5b5f-9ccb-5a10bc0de8b7",
+  "serialNumber": "urn:uuid:94862215-9d79-5a0f-9ee1-81c52885d00f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-23T09:06:22.609Z",
+    "timestamp": "2026-05-24T23:40:28.395Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.34.2"
+        "version": "0.35.0"
       }
     ],
     "authors": [],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/create-daloy@0.34.2",
+      "bom-ref": "pkg:npm/create-daloy@0.35.0",
       "name": "create-daloy",
-      "version": "0.34.2",
+      "version": "0.35.0",
       "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
-      "purl": "pkg:npm/create-daloy@0.34.2",
+      "purl": "pkg:npm/create-daloy@0.35.0",
       "licenses": [
         {
           "license": {
@@ -35,12 +35,16 @@
         {
           "type": "website",
           "url": "https://github.com/daloyjs/daloy/tree/main/packages/create-daloy#readme"
+        },
+        {
+          "type": "distribution",
+          "url": "https://www.npmjs.com/package/create-daloy"
         }
       ],
       "swid": {
-        "tagId": "swidtag-create-daloy-0.34.2",
+        "tagId": "swidtag-create-daloy-0.35.0",
         "name": "create-daloy",
-        "version": "0.34.2",
+        "version": "0.35.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -49,7 +53,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/create-daloy@0.34.2",
+      "ref": "pkg:npm/create-daloy@0.35.0",
       "dependsOn": []
     }
   ]

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "create-daloy-0.34.2",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-0.34.2-6244f261-e99d-5b5f-9ccb-5a10bc0de8b7",
+  "name": "create-daloy-0.35.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-0.35.0-94862215-9d79-5a0f-9ee1-81c52885d00f",
   "creationInfo": {
-    "created": "2026-05-23T09:06:22.609Z",
+    "created": "2026-05-24T23:40:28.395Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package-create-daloy",
       "name": "create-daloy",
-      "versionInfo": "0.34.2",
+      "versionInfo": "0.35.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/create-daloy@0.34.2"
+          "referenceLocator": "pkg:npm/create-daloy@0.35.0"
         }
       ]
     }

package/templates/_ci/deno/SECURITY.md

@@ -23,14 +23,43 @@ The `--with-ci` bundle adds these defaults:
 - If the generated project keeps the `Dockerfile`, container scanning lints it
 	with hadolint, scans the source tree and built image with Trivy, and warns
 	when `FROM` lines are not pinned to an immutable `@sha256:` digest.
-- CodeQL, OpenSSF Scorecard, zizmor, Dependabot for GitHub Actions and Docker
+- CodeQL, Opengrep (second SAST engine, Aikido's LGPL-2.1 fork of
+  Semgrep, verified via sigstore cosign before execution), OpenSSF
+  Scorecard, zizmor, Dependabot for GitHub Actions and Docker
 	base images, and CODEOWNERS are generated.
+- A `secret-scan.yml` workflow runs [gitleaks](https://github.com/gitleaks/gitleaks) against the working tree on every PR / push and against the **full git history** on a daily schedule. The gitleaks binary is downloaded from a pinned official release and verified by SHA-256 before execution so the scan does not introduce a new third-party action into the supply chain. Findings block the merge; matched values are redacted from the public log. The rationale (and the remediation playbook for a confirmed leak) follows Aikido's [Secrets Detection guide](https://www.aikido.dev/blog/secret-detection-application-security): a secret in any commit, branch, or tag should be treated as compromised, and detection must consider the entire history — not just the latest snapshot — alongside GitHub-native push protection.
+
+## Cloud posture (operator checklist)
+
+The framework cannot author your cloud configuration for you, but the
+[Aikido "Top 7 Cloud Security Vulnerabilities"](https://www.aikido.dev/blog/top-cloud-security-vulnerabilities)
+write-up maps cleanly onto a short checklist. Adopt these alongside the
+container and CI defaults above:
+
+- **IMDSv2 only.** On EC2 / equivalent, require token-based IMDSv2 and disable
+  IMDSv1. Combined with the framework's `fetchGuard()` on user-controlled
+  outbound fetches, this closes the Capital One 2019 / Pandoc CVE-2025-51591
+  SSRF → IAM chain.
+- **Least-privilege execution role.** Scope the workload's IAM role to the
+  minimum actions and resource ARNs the handler actually calls (e.g.
+  `s3:GetObject` on a single bucket prefix, never `s3:*`).
+- **Pod security on Kubernetes.** `runAsNonRoot: true`,
+  `readOnlyRootFilesystem: true`, `allowPrivilegeEscalation: false`,
+  `capabilities: { drop: ["ALL"] }`, and `automountServiceAccountToken: false`
+  on pods that do not call the kube API.
+- **Network segmentation.** Keep dev / staging / prod in separate accounts /
+  projects. Apply default-deny `NetworkPolicy` or Security Group egress so a
+  compromised workload cannot freely reach the metadata service or the
+  database tier.
+- **Log agent isolation.** Run FluentBit / Vector under its own ServiceAccount
+  with read-only access to the log path, pin the agent image to a digest, and
+  subscribe to its CVE feed.
 
 ## Required repository settings
 
 Before relying on these files for a company project:
 
 1. Replace `@your-org/security-team` in `.github/CODEOWNERS` or pass `--code-owner` when scaffolding.
-2. Protect the `main` branch and require the CI, CodeQL, Scorecard, and zizmor checks.
+2. Protect the `main` branch and require the CI, CodeQL, Opengrep, Scorecard, and zizmor checks.
 3. Enable GitHub secret scanning and push protection.
 4. Keep Deno permissions narrow; do not switch tasks to `--allow-all`.

package/templates/_ci/deno/_github/CODEOWNERS

@@ -6,6 +6,8 @@
 # Workflow / CI / CD.
 /.github/                         __CODE_OWNER__
 /.github/workflows/               __CODE_OWNER__
+/.github/workflows/osv-scan.yml   __CODE_OWNER__
+/.github/workflows/secret-scan.yml __CODE_OWNER__
 /.github/dependabot.yml           __CODE_OWNER__
 /.github/CODEOWNERS               __CODE_OWNER__
 

package/templates/_ci/deno/_github/workflows/container-scan.yml

@@ -1,12 +1,20 @@
-# Container security scan generated by create-daloy --with-ci.
+# Container + IaC security scan generated by create-daloy --with-ci.
 #
-# The Deno template has no npm package manager, but its Dockerfile still
-# deserves the same container review as Node-based scaffolds:
+# The Deno template has no npm package manager, but its Dockerfile and any
+# IaC files (Terraform / Kubernetes / Helm / CloudFormation) the project
+# adds still deserve the same review as Node-based scaffolds. Modeled on
+# Aikido's "IaC security scanning for Terraform & Kubernetes
+# misconfigurations" article
+# (https://www.aikido.dev/blog/iac-security-scanning-terraform-kubernetes-misconfigurations):
 #
 #   - hadolint lints the Dockerfile for known anti-patterns and unsafe
 #     instructions (CIS Docker Benchmark coverage).
-#   - Trivy scans the source tree (config + secrets + vulnerable lockfile
-#     entries), then scans the built image for OS + language CVEs.
+#   - Trivy filesystem scan with the `misconfig` scanner enabled catches
+#     IaC misconfigurations (Terraform, Kubernetes, Helm, Dockerfile,
+#     CloudFormation) plus secrets and vulnerable lockfile entries. It
+#     runs even when no Dockerfile is present, so a project that only
+#     ships Terraform / K8s still gets the Aikido-style posture review.
+#   - Trivy image scan covers OS + language CVEs once the image is built.
 #   - SARIF results are uploaded to the Code Scanning tab so findings show
 #     up in the same place as CodeQL.
 
@@ -19,6 +27,17 @@ on:
       - ".dockerignore"
       - "deno.json"
       - "deno.lock"
+      - "**/*.tf"
+      - "**/*.tfvars"
+      - "**/*.hcl"
+      - "k8s/**"
+      - "helm/**"
+      - "**/deployment.yaml"
+      - "**/deployment.yml"
+      - "**/kustomization.yaml"
+      - "**/kustomization.yml"
+      - "**/Chart.yaml"
+      - "**/values.yaml"
       - ".github/workflows/container-scan.yml"
   push:
     branches: [main]
@@ -27,6 +46,17 @@ on:
       - ".dockerignore"
       - "deno.json"
       - "deno.lock"
+      - "**/*.tf"
+      - "**/*.tfvars"
+      - "**/*.hcl"
+      - "k8s/**"
+      - "helm/**"
+      - "**/deployment.yaml"
+      - "**/deployment.yml"
+      - "**/kustomization.yaml"
+      - "**/kustomization.yml"
+      - "**/Chart.yaml"
+      - "**/values.yaml"
       - ".github/workflows/container-scan.yml"
   schedule:
     # Weekly run catches newly-disclosed base-image CVEs even when the
@@ -114,12 +144,17 @@ jobs:
           sarif_file: hadolint.sarif
           category: hadolint
 
-      - name: Trivy filesystem scan (config + secrets + vulns)
-        if: steps.detect.outputs.present == 'true'
+      - name: Trivy filesystem scan (IaC misconfig + secrets + vulns)
+        # `misconfig` is the IaC posture scanner — Terraform, Kubernetes,
+        # Helm, Dockerfile, CloudFormation — per Aikido's "IaC security
+        # scanning for Terraform & Kubernetes misconfigurations" article.
+        # It runs unconditionally so a project that only ships Terraform
+        # or K8s (no Dockerfile) still gets reviewed on every PR.
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: fs
           scan-ref: .
+          scanners: vuln,secret,misconfig
           severity: HIGH,CRITICAL
           ignore-unfixed: true
           format: sarif
@@ -127,7 +162,6 @@ jobs:
           exit-code: "0"
 
       - name: Upload Trivy filesystem SARIF
-        if: steps.detect.outputs.present == 'true'
         uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
         with:
           sarif_file: trivy-fs.sarif

package/templates/_ci/deno/_github/workflows/deploy.yml

@@ -0,0 +1,183 @@
+# Starter deployment workflow generated by create-daloy --with-ci.
+#
+# This workflow is intentionally manual-only so a fresh scaffold does not fail
+# on every push before you wire in environment protection. Once you are ready,
+# add your preferred push/tag trigger.
+#
+# Default target: GitHub Container Registry (GHCR).
+# No extra secret is required; the workflow uses the repo-scoped GITHUB_TOKEN.
+# After the image is published, point your platform at GHCR or replace the
+# final push steps with your provider's deploy command.
+#
+# Every pushed image is also signed and attested with Sigstore Cosign
+# (keyless / OIDC) and an SPDX SBOM, so consumers can verify provenance
+# with `cosign verify` and `cosign verify-attestation --type spdxjson`
+# instead of trusting the registry alone. See Aikido's "Container
+# Security Best Practices" (https://www.aikido.dev/blog/container-security-best-practices)
+# for why signed images + SBOM attestation are the supply-chain floor.
+#
+# Optional container-host handoff examples:
+#   - Fly.io: install flyctl in a later step and run
+#       flyctl deploy --image "$IMAGE_REPO@${IMAGE_DIGEST}" --remote-only
+#   - Render: create an image-backed service that tracks
+#       ghcr.io/<owner>/<repo>@${IMAGE_DIGEST}
+
+name: Deploy
+
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: deploy-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    name: Verify before deploy
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Set up Deno
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
+        with:
+          deno-version: v2.x
+
+      - name: Typecheck
+        run: deno task typecheck
+
+      - name: Test
+        run: deno task test
+
+  deploy:
+    name: Publish container image
+    needs: verify
+    # Lock production deploys to main or a tag push. `workflow_dispatch`
+    # accepts any branch, so this guard stops an accidental dispatch from a
+    # feature branch from shipping unreviewed code.
+    if: github.ref == 'refs/heads/main' || github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    environment:
+      name: production
+    permissions:
+      contents: read
+      # `packages: write` lets us push to GHCR; `id-token: write` lets
+      # Cosign mint a short-lived OIDC identity for keyless image signing
+      # + SBOM attestation. Both are scoped to this single job — the
+      # top-level workflow still has `permissions: {}`.
+      packages: write
+      id-token: write
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Log in to GHCR
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -eu
+          echo "$GH_TOKEN" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Derive image name
+        run: |
+          set -eu
+          owner="${GITHUB_REPOSITORY_OWNER,,}"
+          repo="${GITHUB_REPOSITORY#*/}"
+          repo="${repo,,}"
+          echo "IMAGE_REPO=ghcr.io/${owner}/${repo}" >> "$GITHUB_ENV"
+
+      - name: Build image
+        env:
+          DOCKER_BUILDKIT: "1"
+        run: |
+          set -eu
+          docker build \
+            --tag "$IMAGE_REPO:sha-${GITHUB_SHA}" \
+            --tag "$IMAGE_REPO:latest" \
+            .
+
+      - name: Push image
+        run: |
+          set -eu
+          docker push "$IMAGE_REPO:sha-${GITHUB_SHA}"
+          docker push "$IMAGE_REPO:latest"
+
+      - name: Resolve pushed image digest
+        # Resolve and pin the immutable digest the rest of the workflow
+        # signs and attests against. Signing a mutable tag would let any
+        # later push silently re-point a "verified" tag at attacker
+        # content; binding cosign + the SBOM attestation to
+        # ${IMAGE_REPO}@sha256:<digest> closes that race.
+        run: |
+          set -eu
+          digest="$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE_REPO:sha-${GITHUB_SHA}" | awk -F@ '{print $2}')"
+          if [ -z "$digest" ]; then
+            echo "::error::Failed to resolve image digest for $IMAGE_REPO:sha-${GITHUB_SHA}" >&2
+            exit 1
+          fi
+          echo "IMAGE_DIGEST=$digest" >> "$GITHUB_ENV"
+          echo "IMAGE_REF=$IMAGE_REPO@$digest" >> "$GITHUB_ENV"
+          echo "::notice::Signed image reference: $IMAGE_REPO@$digest"
+
+      - name: Install Cosign
+        # SHA-pinned per the project's actions-pinning policy. v4.1.2,
+        # commit 6f9f17788090df1f26f669e9d70d6ae9567deba6.
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - name: Sign image with Cosign (keyless / OIDC)
+        # Keyless signing uses the workflow's `id-token` OIDC identity
+        # — no long-lived signing key to leak. Verifiers can pin to
+        # `--certificate-identity` matching this workflow URL.
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          set -eu
+          cosign sign --yes "$IMAGE_REF"
+
+      - name: Generate SPDX SBOM for image
+        # SHA-pinned per the project's actions-pinning policy. v0.24.0,
+        # commit e22c389904149dbc22b58101806040fa8d37a610.
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          image: ${{ env.IMAGE_REF }}
+          format: spdx-json
+          output-file: sbom.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Attest SBOM with Cosign
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          set -eu
+          cosign attest --yes \
+            --predicate sbom.spdx.json \
+            --type spdxjson \
+            "$IMAGE_REF"

package/templates/_ci/deno/_github/workflows/opengrep.yml

@@ -0,0 +1,137 @@
+# Opengrep — second SAST engine, complementing CodeQL.
+#
+# Why this exists in your scaffolded Daloy (Deno) project:
+#   Daloy itself runs two SAST engines (CodeQL + Opengrep) because no
+#   single rule corpus catches everything. Opengrep is the LGPL-2.1
+#   community fork of Semgrep, ships Semgrep-compatible rules, and is
+#   backed by an open consortium. See Aikido's "Ultimate SAST Guide"
+#   (https://www.aikido.dev/blog/ultimate-sast-guide-static-application-security-testing)
+#   and "Launching Opengrep" (https://www.aikido.dev/blog/launching-opengrep-why-we-forked-semgrep).
+#
+#   Pairing CodeQL (semantic, dataflow-heavy) with Opengrep
+#   (pattern-based AST matching, community rule packs) gives
+#   defense-in-depth at the source layer — the same posture Daloy
+#   maintains on its own repository.
+#
+# Hardening (matches the rest of the scaffolded bundle):
+#   * Top-level `permissions: {}`; the job opts in only to the two
+#     scopes it needs (`security-events: write`, `contents: read`).
+#   * Third-party actions are SHA-pinned with version comments.
+#   * Opengrep itself is NOT installed via a third-party action;
+#     the binary is downloaded from a pinned GitHub release and its
+#     sigstore cosign signature is verified before execution.
+#   * `step-security/harden-runner` runs in audit mode.
+#   * `actions/checkout` runs with `persist-credentials: false`.
+#   * `set -euo pipefail` on every shell step.
+
+name: Opengrep
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "51 5 * * 4"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: opengrep-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: Opengrep SAST
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      security-events: write
+      contents: read
+
+    env:
+      OPENGREP_VERSION: "v1.22.0"
+      OPENGREP_ASSET: "opengrep_manylinux_x86"
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Download Opengrep release binary + signature
+        run: |
+          set -euo pipefail
+          mkdir -p .opengrep
+          base="https://github.com/opengrep/opengrep/releases/download/${OPENGREP_VERSION}/${OPENGREP_ASSET}"
+          echo "Fetching ${base}"
+          curl --proto '=https' --tlsv1.2 -fsSL --retry 3 --retry-delay 2 \
+            -o .opengrep/opengrep      "${base}"
+          curl --proto '=https' --tlsv1.2 -fsSL --retry 3 --retry-delay 2 \
+            -o .opengrep/opengrep.cert "${base}.cert"
+          curl --proto '=https' --tlsv1.2 -fsSL --retry 3 --retry-delay 2 \
+            -o .opengrep/opengrep.sig  "${base}.sig"
+          chmod +x .opengrep/opengrep
+
+      - name: Verify Opengrep signature (cosign / sigstore)
+        run: |
+          set -euo pipefail
+          if ! command -v cosign >/dev/null 2>&1; then
+            echo "::error::cosign is required but not available on the runner."
+            exit 1
+          fi
+          cosign version
+          cosign verify-blob \
+            --cert ".opengrep/opengrep.cert" \
+            --signature ".opengrep/opengrep.sig" \
+            --certificate-identity-regexp "https://github.com/opengrep/opengrep.+" \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+            ".opengrep/opengrep"
+          echo "Opengrep ${OPENGREP_VERSION} signature verified."
+
+      - name: Print Opengrep version
+        run: |
+          set -euo pipefail
+          .opengrep/opengrep --version
+
+      - name: Run Opengrep scan (SARIF)
+        # Curated security-focused rule packs from the Semgrep registry:
+        #   * p/security-audit / p/owasp-top-ten / p/cwe-top-25 — general
+        #   * p/javascript / p/typescript — language-specific
+        #   * p/secrets — hardcoded credentials / API keys
+        # `p/nodejs` is omitted on Deno because its sinks (e.g.
+        # `require()`, `process.*`) are not idiomatic on the Deno runtime.
+        run: |
+          set -euo pipefail
+          .opengrep/opengrep scan \
+            --config p/security-audit \
+            --config p/owasp-top-ten \
+            --config p/cwe-top-25 \
+            --config p/javascript \
+            --config p/typescript \
+            --config p/secrets \
+            --sarif-output opengrep.sarif \
+            --metrics off \
+            --timeout 120 \
+            --max-target-bytes 1500000 \
+            --exclude node_modules \
+            --exclude dist \
+            --exclude build \
+            --exclude coverage \
+            --exclude .opengrep \
+            .
+
+      - name: Upload SARIF to GitHub code scanning
+        if: always()
+        uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        with:
+          sarif_file: opengrep.sarif
+          category: opengrep

package/templates/_ci/deno/_github/workflows/osv-scan.yml

@@ -0,0 +1,121 @@
+# Second-source dependency scan against the OSV.dev database
+# (Aikido "SAST vs SCA" / "npm-audit-guide — the missing layer" gate).
+#
+# Why this exists for a Deno service:
+#   Deno does not ship a built-in `audit` command, so without this
+#   workflow a scaffolded Deno project has NO scheduled SCA coverage
+#   at all. The Aikido write-up "SAST vs SCA" calls this gap out
+#   directly: SAST (CodeQL, Opengrep) only inspects your own source;
+#   it does not know that one of your `npm:` or `jsr:` imports just
+#   had a malware advisory published against the exact version your
+#   `deno.lock` pins.
+#
+#   This workflow runs Google's OSV-Scanner against `deno.lock` on
+#   every PR and on a daily schedule. OSV-Scanner queries OSV.dev and
+#   cross-references the OpenSSF `malicious-packages` corpus
+#   (https://github.com/ossf/malicious-packages), so it surfaces both
+#   classic CVEs and explicitly-flagged malware drops — the exact
+#   classes of issue the September 2025 npm phishing wave that
+#   compromised `debug`, `chalk`, and ~2B downloads/week of dependent
+#   packages (https://lwn.net/Articles/1037167/) made famous.
+#
+# Defense-in-depth context (see SECURITY.md):
+#   * Deno's permission model (`--allow-net`, etc.) limits blast radius
+#     of a compromised dep at runtime.
+#   * `deno.lock` is checked into the repo and `deno task ...` runs
+#     with `--cached-only` in CI so an attacker cannot swap a dep
+#     between scan and run.
+#   * This OSV pass is the LAST layer: "did a pinned version turn out
+#     to carry a CVE or a malware advisory after we pinned it?"
+#
+# Hardening:
+#   * `permissions: {}` at the top level; the single job opts in to
+#     `contents: read` only. No write permissions of any kind.
+#   * `step-security/harden-runner` in audit mode.
+#   * `actions/checkout` runs with `persist-credentials: false`.
+#   * The OSV-Scanner binary is downloaded directly from the official
+#     google/osv-scanner GitHub release and its SHA-256 is verified
+#     against a locally-pinned constant BEFORE the binary is executed.
+#     We deliberately avoid the third-party `google/osv-scanner-action`
+#     wrapper so the only third-party surface is the binary itself, not
+#     a layer of action-side YAML that could be retagged.
+#   * The scan is read-only and runs on the committed lockfile without
+#     fetching or executing any dependency code.
+
+name: OSV scan
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "deno.lock"
+      - "deno.json"
+      - ".github/workflows/osv-scan.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "deno.lock"
+      - "deno.json"
+      - ".github/workflows/osv-scan.yml"
+  schedule:
+    # 06:47 UTC daily — offset from Zizmor (07:00) so the SCA jobs do
+    # not collide.
+    - cron: "47 6 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: osv-scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: OSV.dev + malicious-packages scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+
+    env:
+      # Pinned OSV-Scanner release. Bump together with the SHA-256 below.
+      # Source: https://github.com/google/osv-scanner/releases/tag/v2.3.8
+      OSV_SCANNER_VERSION: "2.3.8"
+      # SHA-256 of `osv-scanner_linux_amd64` from the v2.3.8
+      # `osv-scanner_SHA256SUMS` asset.
+      OSV_SCANNER_SHA256: "bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc"
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+          disable-file-monitoring: false
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Download and verify OSV-Scanner binary
+        # Pin the binary by SHA-256 BEFORE executing it. A registry or
+        # GitHub Releases compromise that swaps the asset would fail
+        # this check and abort the job.
+        run: |
+          set -euo pipefail
+          url="https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64"
+          curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \
+            --output osv-scanner "${url}"
+          echo "${OSV_SCANNER_SHA256}  osv-scanner" | sha256sum --check --status
+          chmod +x osv-scanner
+          ./osv-scanner --version
+
+      - name: Scan deno.lock (OSV.dev + malicious-packages)
+        # Exits non-zero if any vulnerability or malware advisory matches
+        # a pinned `npm:` or `jsr:` version. This is the only scheduled
+        # SCA gate for a Deno scaffold, which has no built-in `audit`.
+        run: |
+          set -euo pipefail
+          ./osv-scanner scan source --lockfile=deno.lock --format=table