Pipeline updates: PR workflow

[kevinfiol]

Related Issue

#80

Changes Proposed

• add workflows for linting, typechecking, and building the lambda image
• enable pr-security-scan.yml for PRs
• add pipeline workflow to run on PRs merging into main

Additional Information

• pinned git hashes for all third-party github actions

Testing

1. See a run against this branch here: https://github.com/CDCgov/dibbs-ecr-diff/actions/runs/30038936177

2. You can test locally with act:

act workflow_dispatch -W ./.github/workflows/pipeline.yml

# or individually
act workflow_dispatch -W ./.github/workflows/typecheck.yml -j ty
act workflow_dispatch -W ./.github/workflows/lint.yml -j ruff
act workflow_dispatch -W ./.github/workflows/build.yml -j lambda-build

Note: concurrency in pipeline.yml is currently not supported by act: https://nektosact.com/not_supported.html?highlight=concurrency#planned

Checklist for Primary Reviewer

• Any large-scale changes have been deployed and smoke tested
• Any content updates (user-facing error messages, etc) have been approved by content team
• Any dependencies introduced have been vetted and discussed

[github-actions]

🔒 Security Scan Results

⚠️ Found 10 vulnerabilities

Severity	Total
🟠 High	9
🟡 Medium	1

📦 did-lambda

Severity	Count
🟠 High	9
🟡 Medium	1

---

View detailed results: Security tab
Last updated: 2026-07-23 20:10:55 UTC

[kevinfiol]

🔒 Security Scan Results

⚠️ Found 10 vulnerabilities

Severity Total
🟠 High 9
🟡 Medium 1

📦 did-lambda

Severity Count
🟠 High 9
🟡 Medium 1
View detailed results: Security tab Last updated: 2026-07-23 20:10:55 UTC

RE: Scan results.

This is expected since our security scan workflow is based on Refiners, which does NOT ignore CVEs that don't yet have a fix. CDCgov/dibbs-ecr-refiner#1459

In our case, the vulnerabilities lie with the public.ecr.aws/lambda/python:3.14 base image.