deps(ci): periodic dependency & security update

[qw-in]

periodic dependency & security update

[arcjet-review]

Arcjet Review — 🟢 Low Risk

Decision: Approved

Rationale: Small, security-positive CI change: bumps two SHA-pinned GitHub Actions to newer tagged versions (harden-runner v2.16.0 → v2.21.0, actions/checkout v4.3.1 → v4.4.0) and sets persist-credentials: false on checkout to prevent the GITHUB_TOKEN from lingering in .git/config on the runner. Actions remain pinned by commit SHA with version comments, egress-policy is still audit, and no build logic changes. One escalation trigger (CI/CD) fires but the change is well-understood and net-improves supply-chain posture.

Summary of Changes

Bumps pinned versions of step-security/harden-runner and actions/checkout in the docker-build workflow and disables credential persistence on checkout.

Escalation Triggers

• CI/CD Pipeline: Modifies .github/workflows/docker-build.yml

Notes

Verified both new SHAs correspond to the labeled tags (harden-runner v2.21.0 and actions/checkout v4.4.0) is the author's claim; reviewers should confirm SHA↔tag mapping if their policy requires it. Setting persist-credentials: false is a recommended hardening for jobs that don't push back to the repo — this workflow only builds a Docker image, so no downstream steps should break.

_{Review: e082f750 | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}