build(deps): Bump docker/login-action from 4.5.2 to 4.6.0 - #1407

Dependency Audit — docker/login-action 4.5.2 → 4.6.0

Verdict: Safe — merging. Right-o, I went and poked this one properly instead of rubber-stamping it, and it came back clean as a whistle.

Change Summary

Diff Integrity (step 2d)

Clean. Every commit is accounted for by the published release notes:

• Tag integrity — both tags are lightweight refs to commits on origin/master; v4.6.0 and the floating v4 resolve to the same commit dbcb8138; release object targets master, not a draft, published by crazy-max (long-standing maintainer). No moved/orphan tag.
• Undocumented content — none. 4 substantive changes, 4 matching release-note entries; the remainder are merge commits and [dependabot skip] chore: update generated content bot commits.
• Lifecycle/install hooks — none added or modified.
• Network/exfiltration — every new URL string in the dist/index.cjs diff traces to the AWS SDK ECR clients or @actions/toolkit (api.ecr.*, 169.254.169.254 IMDS, api.github.com). No novel domains, no new credential/env reads.
• Obfuscation — none. dist/ is bundled build output, as it was before; it regenerates consistently with source (the new guard's error string is present in the bundle).
• Diff shape — proportionate. The 119/-119 dist churn is the aws-sdk minor bump, exactly what you'd expect.

The one real source change

src/context.ts → scopeToConfigDir() (docker/login-action#1059, "harden buildx scoped config path handling") is a path-traversal fix (CWE-22), and a decent one: it swaps path.join for path.resolve + an explicit isChildPath() containment check on both the registry dir and the scope dir, caps the scope at one @ separator, and validates scope actions against /^[a-z]+(,[a-z]+)*$/. Covered by 81 new lines of tests. This bump makes us strictly better off, not worse.

Known Vulnerabilities

INFO — postcss is a transitive dev-only dependency (vitest/esbuild toolchain); grep postcss dist/index.cjs = 0, so it is not bundled into the artifact we consume. The advisory (CVSS 4.0 low, attacker-controlled sourceMappingURL reading local .map files, fixed in 8.5.23) affects upstream's build box at most, never a login-action consumer.

Codebase Compliance

Pre-existing observations (NOT introduced here, NOT blocking)

1. LOW — .github/workflows/docker.yml:33: docker/setup-qemu-action@master pins a floating branch ref. Whatever lands on that branch runs with our workflow's trust; that's the genuinely soft spot in this file, not the thing Dependabot just bumped. Worth pinning to a tag or SHA in a follow-up.
2. INFO — Actions across this repo are tag-pinned rather than SHA-pinned (CWE-1357, mutable third-party reference). Defensible convention given Dependabot keeps them current; noted for completeness, no action requested in this PR.

Risk Assessment

Overall: Safe. Diff integrity clean, no applicable advisories, the only source change is a hardening, the changed code path isn't even reachable from our configuration, and CI is green. Nothing here floors the rating.

Recommendations

1. Merge this PR. (Doing so now.)
2. Follow-up, separate PR: pin docker/setup-qemu-action@master to a released tag.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}