Add supply chain hardening: SBOM, cosign signing, pinned digests, Dependabot

Enterprise supply chain improvements:
- publish.yml: Generate CycloneDX SBOM and attach to GitHub releases
- docker.yml: Sign all Docker images with Sigstore cosign (keyless OIDC)
- Dockerfile: Pin python:3.11-slim and distroless base images with SHA256
digests to prevent silent upstream changes
- Add .github/dependabot.yml for automated Docker digest, GitHub Actions,
and pip dependency update PRs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/dependabot.yml

@@ -0,0 +1,27 @@
+version: 2
+updates:
+  # Docker base image digest updates
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "docker"
+
+  # GitHub Actions version updates
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "ci"
+
+  # Python dependency updates (pip)
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "deps"
+    # Only open PRs for security updates to avoid noise
+    open-pull-requests-limit: 5

.github/workflows/docker.yml

@@ -12,6 +12,7 @@ env:
 permissions:
   contents: read
   packages: write
+  id-token: write # For cosign keyless signing via Sigstore OIDC
 
 jobs:
   docker-variant-tags:
@@ -81,3 +82,19 @@ jobs:
           set: |
             *.cache-from=type=gha
             *.cache-to=type=gha,mode=max
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+
+      - name: Sign images with cosign (keyless via Sigstore OIDC)
+        env:
+          BAKE_META: ${{ steps.bake.outputs.metadata }}
+        run: |
+          # Extract all pushed image digests from bake metadata and sign each
+          echo "$BAKE_META" | jq -r '
+            to_entries[].value."containerimage.digest" // empty
+          ' | while read -r digest; do
+            image="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${digest}"
+            echo "Signing ${image}"
+            cosign sign --yes "${image}"
+          done

.github/workflows/publish.yml

@@ -9,7 +9,8 @@ jobs:
     runs-on: ubuntu-latest
     environment: pypi
     permissions:
-      id-token: write  # For trusted publishing
+      id-token: write # For trusted publishing
+      contents: write # For uploading release assets
 
     steps:
       - uses: actions/checkout@v4
@@ -21,11 +22,23 @@ jobs:
 
       - name: Install build tools
         run: |
-          python -m pip install --upgrade pip build
+          python -m pip install --upgrade pip build cyclonedx-bom
 
       - name: Build package
         run: |
           python -m build
 
+      - name: Generate SBOM (CycloneDX)
+        run: |
+          pip install -e ".[proxy]"
+          cyclonedx-py environment \
+            --output-format json \
+            --outfile dist/headroom-sbom.cdx.json
+
+      - name: Upload SBOM to release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/headroom-sbom.cdx.json
+
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1

.gitignore

@@ -8,6 +8,9 @@ scripts/*
 # Swift SDK (separate repo)
 swift/
 
+# Local planning docs (never commit)
+ENTERPRISE_HARDENING.md
+
 # Audit/scan outputs (contain security findings — never commit)
 bandit_result.txt
 pip_audit_result.txt

Dockerfile

@@ -1,10 +1,14 @@
 ARG PYTHON_VERSION=3.11
 ARG UV_VERSION=0.6.17
+# Pinned 2026-04-15. Update via Dependabot or: docker pull python:3.11-slim
+ARG PYTHON_DIGEST=sha256:233de06753d30d120b1a3ce359d8d3be8bda78524cd8f520c99883bfe33964cf
+# Pinned 2026-04-15. Update via Dependabot or: docker pull gcr.io/distroless/python3-debian13
+ARG DISTROLESS_DIGEST=sha256:ed3a4beb46f8f8baac068743ba1b1f95ea3f793422129cf6dd23967f779b6018
 ARG DISTROLESS_IMAGE=gcr.io/distroless/python3-debian13
 ARG PYTHON_SITE_PACKAGES=/usr/local/lib/python${PYTHON_VERSION}/site-packages
 
 # ---- Build stage: compile native extensions, build wheel ----
-FROM python:${PYTHON_VERSION}-slim AS builder
+FROM python:${PYTHON_VERSION}-slim@${PYTHON_DIGEST} AS builder
 
 ARG UV_VERSION
 
@@ -32,7 +36,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     uv pip install --system --no-deps --reinstall-package headroom-ai .
 
 # ---- Runtime stage (python-slim): supports root/nonroot via build arg ----
-FROM python:${PYTHON_VERSION}-slim AS runtime-slim-base
+FROM python:${PYTHON_VERSION}-slim@${PYTHON_DIGEST} AS runtime-slim-base
 
 ARG RUNTIME_USER=nonroot
 ARG PYTHON_SITE_PACKAGES
@@ -69,7 +73,7 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
 ENTRYPOINT ["headroom", "proxy"]
 CMD ["--host", "0.0.0.0", "--port", "8787"]
 
-FROM ${DISTROLESS_IMAGE} AS runtime-slim
+FROM ${DISTROLESS_IMAGE}@${DISTROLESS_DIGEST} AS runtime-slim
 
 ARG RUNTIME_USER=nonroot
 ARG PYTHON_SITE_PACKAGES