[fix] clear the SonarCloud board: CI supply-chain hardening + native controls in the panel

[YJack0000]

Clears all 27 open SonarCloud issues. Three groups, one theme each.

Workflows — supply chain

• Every third-party action pinned to a full commit SHA (dtolnay/rust-toolchain, Swatinem/rust-cache, oven-sh/setup-bun, tauri-apps/tauri-action, softprops/action-gh-release), with the tag kept in a trailing comment. actions/* are GitHub-owned and were not flagged, so they stay on tags.
  • The one trap: rust-toolchain defaults its toolchain input to github.action_ref — which is exactly how @stable selects the channel. Pinned to a SHA that default becomes the SHA, so all four uses now say toolchain: stable explicitly. Without this the pin is a broken build, not a hardening.
• bun install --ignore-scripts. Nothing in the tree needs a lifecycle script — esbuild and the tauri CLI ship their platform binaries as optional deps, not postinstall downloads. Verified by wiping node_modules and doing a clean --frozen-lockfile --ignore-scripts install followed by a full bun run build.
• --locked on every cargo invocation, so CI fails loudly on a stale lockfile instead of quietly resolving a different dependency tree. Both lockfiles were checked and already satisfy it.
• release.yml drops to contents: read at the workflow level; only the release job raises itself to contents: write. The three jobs that handle the Apple signing secrets now run with a token that cannot publish a release.

Scripts

• macos-keychain.sh fetches Apple's CA anchors with --proto '=https' --proto-redir '=https' --tlsv1.2. It passes -L, so without the redirect guard a 302 into http:// would have been followed and the trust anchors fetched in the clear.
• [ → [[ throughout bump-version.sh and macos-keychain.sh (17 issues). Semantics preserved — every RHS stays quoted, so nothing turns into a glob match.

Panel — real controls instead of ARIA impersonations

The recurring finding was non-interactive elements carrying role="button", a tabIndex, and a hand-rolled Enter/Space handler. Rather than paper over each one, the four affected surfaces became native elements:

was	now
<article role="button" tabIndex={0} onKeyDown> (tool card)	<button class="card">
<div role="button" tabIndex onKeyDown aria-disabled> (profile switch target)	<button class="dprofile-body" disabled>
<code onClick> (copyable command)	<button class="copyable">
<div class="scrim" onClick> + <aside role="dialog">	<button class="scrim"> + <dialog open>

The last row is not a new pattern — KeysView already ships exactly that pair for the add-key drawer, and the dialog.detail / .scrim resets were already in styles.css waiting for it.

A button may only contain phrasing content, so the layout elements inside the card and the profile row moved from <header>/<h2>/<footer>/<div>/<dl> onto spans; the CSS classes carry the boxes either way, plus a UA-chrome reset and an explicit display: block on .dprofile-id (it lost its block box when the <div> became a <span>). Tooltips on the badges survive, which an absolutely-positioned overlay button would have swallowed.

Also: explicit type="button" on all 14 non-submit buttons; ToolDetail split into PermissionsSection / ProfileFoot / NoteList / Scopes, which takes both cognitive-complexity hotspots (18 and 19) under 15 and unpicks five nested ternaries; notes and SVG layers keyed by content instead of array index; props marked Readonly; headlineExpiry sorts with an explicit localeCompare; duplicate .dprofile selector folded; boot-splash light-mode text darkened from 4.1:1 to 5.3:1 to clear WCAG AA.

Verification

Full local CI equivalent, all green:

• cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, cargo test --workspace --locked (601 tests), cargo build --workspace --locked
• cargo clippy --all-targets --locked and cargo build --locked in app/src-tauri
• clean bun install --frozen-lockfile --ignore-scripts + bun run build (tsc + vite)
• logo check: 25 tools, 25 marks, none missing

The four rebuilt components were also rendered against the compiled stylesheet and checked visually — card grid rows, the profile-id block, the kvs two-column grid and the copyable flex row all hold, and .side-item was already a shipped <button> with display: flex, so flex/grid on a button is proven in this webview.

The TODO(linux)

Resolved by doing it, not by deleting it. The TODO claimed a Linux job "would fail on path assumptions" — that turned out not to hold. patchbay-core has no cfg(target_os) branch anywhere: the macOS-shaped tool locations are plain strings built under a caller-supplied home, and the suite supplies a synthetic one. The Keychain path is covered through MemoryKeystore, so no test shells out to security.

So the core suite was already portable, and ci.yml now has a core (Linux) job that keeps it that way — it goes red the moment core reaches for a real $HOME, a security invocation, or a platform cfg. CI confirms it passes. This is not a claim that patchbay runs on Linux; pb, the panel and the probes remain macOS-only, which is why exactly one crate is built there.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud