ci: pin container, go and npm dependencies (OpenSSF Scorecard)

Improves the OpenSSF Scorecard Pinned-Dependencies check:

- docker/Dockerfile.base: give build_image/base_image pinned digest
  defaults and reference them as ${...} so scorecard resolves the FROM
  images by hash (containerImage 1/3 -> 3/3). docker-bake.hcl still
  overrides them at build time.
- workflows_linting.yml: pin actionlint to v1.7.12 instead of @latest
  (goCommand 0/1 -> 1/1; scorecard treats full semver as pinned).
- docs_search_sync.yml: use `npm ci` instead of `npm install` so the
  install verifies the committed lockfile (npmCommand 0/1 -> 1/1).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: julian-risch

.github/workflows/docs_search_sync.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Install Docusaurus and build docs-website
         working-directory: docs-website
         run: |
-          npm install --ignore-scripts
+          npm ci --ignore-scripts
           npm rebuild sharp
           npm run build
 

.github/workflows/workflows_linting.yml

@@ -22,7 +22,7 @@ jobs:
           go-version: ">=1.24.0"
 
       - name: Install actionlint
-        run: go install github.com/rhysd/actionlint/cmd/actionlint@latest
+        run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
 
       - name: Run actionlint
         env:

docker/Dockerfile.base

@@ -1,7 +1,10 @@
-ARG build_image
-ARG base_image
+# Pinned digest defaults so the base images are resolvable by hash even when
+# the args are not passed (e.g. by supply-chain scanners or a plain `docker build`).
+# docker/docker-bake.hcl overrides these at build time; keep the digests in sync.
+ARG build_image=python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203
+ARG base_image=python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203
 
-FROM $build_image AS build-image
+FROM ${build_image} AS build-image
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG haystack_version
@@ -25,7 +28,7 @@ ENV PATH="/opt/venv/bin:$PATH"
 RUN uv pip install --no-cache-dir -U setuptools && \
     uv pip install --no-cache-dir .
 
-FROM $base_image AS final
+FROM ${base_image} AS final
 
 COPY --from=build-image /opt/venv /opt/venv