Harden release gate workflow

.github/workflows/build-and-test.yml

@@ -22,16 +22,36 @@ jobs:
   secret-scan:
     name: Secret Scan
     runs-on: ubuntu-24.04
+    env:
+      GITLEAKS_VERSION: "8.30.1"
+      GITLEAKS_LINUX_X64_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
+      - name: Install gitleaks
+        run: |
+          set -euo pipefail
+          archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}"
+          curl -fsSLo "/tmp/${archive}" "$url"
+          echo "${GITLEAKS_LINUX_X64_SHA256}  /tmp/${archive}" | sha256sum -c -
+          tar -xzf "/tmp/${archive}" -C /tmp gitleaks
+          install /tmp/gitleaks /usr/local/bin/gitleaks
+
       - name: Run gitleaks
-        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          gitleaks detect \
+            --source . \
+            --log-opts=-1 \
+            --no-banner \
+            --redact \
+            --exit-code 2 \
+            --report-format sarif \
+            --report-path results.sarif
 
   build:
     name: Frontend & Backend
@@ -41,10 +61,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '20'
           cache: npm
@@ -82,7 +102,7 @@ jobs:
         run: npm run check:bundlesize
 
       - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
@@ -116,11 +136,11 @@ jobs:
 
       - name: Upload benchmark results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: bench-results
           path: bench-results.txt
-          retention-days: 90
+          retention-days: 7
 
       - name: Install benchstat
         run: go install golang.org/x/perf/cmd/benchstat@v0.0.0-20260211190930-8161c38c6cdc
@@ -131,14 +151,14 @@ jobs:
 
       - name: Cache benchmark baseline (main branch)
         if: github.ref == 'refs/heads/main'
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: bench-baseline.txt
           key: go-bench-baseline-${{ github.sha }}
 
       - name: Restore benchmark baseline (PRs)
         if: github.event_name == 'pull_request'
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: bench-baseline.txt
           key: go-bench-baseline-

internal/hostmetrics/collector_bench_test.go

@@ -4,12 +4,15 @@ import (
 	"context"
 	"testing"
 
+	"github.com/rs/zerolog"
 	godisk "github.com/shirou/gopsutil/v4/disk"
 )
 
 // BenchmarkCollectDiskFiltering measures the disk filtering and deduplication
 // logic that runs on every collection cycle.
 func BenchmarkCollectDiskFiltering(b *testing.B) {
+	disableBenchmarkLogging(b)
+
 	origPartitions := diskPartitions
 	origUsage := diskUsage
 	b.Cleanup(func() {
@@ -43,6 +46,16 @@ func BenchmarkCollectDiskFiltering(b *testing.B) {
 
 // BenchmarkSummarizeZFSPools measures ZFS pool summarization with a mix of pool types.
 func BenchmarkSummarizeZFSPools(b *testing.B) {
+	disableBenchmarkLogging(b)
+
+	origQueryZpoolStats := queryZpoolStats
+	queryZpoolStats = func(context.Context, []string) (map[string]zpoolStats, error) {
+		return nil, nil
+	}
+	b.Cleanup(func() {
+		queryZpoolStats = origQueryZpoolStats
+	})
+
 	datasets := []zfsDatasetUsage{
 		{Pool: "rpool", Dataset: "rpool", Used: 100e9, Free: 400e9, Total: 500e9, Mountpoint: "/"},
 		{Pool: "rpool", Dataset: "rpool/data", Used: 50e9, Free: 400e9, Total: 450e9, Mountpoint: "/data"},
@@ -78,3 +91,12 @@ func buildSamplePartitions(n int) []godisk.PartitionStat {
 	}
 	return parts
 }
+
+func disableBenchmarkLogging(b *testing.B) {
+	b.Helper()
+	origLevel := zerolog.GlobalLevel()
+	zerolog.SetGlobalLevel(zerolog.Disabled)
+	b.Cleanup(func() {
+		zerolog.SetGlobalLevel(origLevel)
+	})
+}