argosback · Oct 18, 2026 · Oct 18, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,4 +1,4 @@
-name: CI
+name: 🧪 PR Checks
 
 on:
   pull_request:
@@ -13,45 +13,45 @@ on:
 jobs:
   workflow-lint:
     name: Lint (Actions)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: 📥 Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Lint workflows
+      - name: 🔍 Lint workflows
         uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
 
   tests:
     name: Tests (Go)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: 📥 Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - name: 🐹 Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.mod
 
-      - name: Run tests
+      - name: 🧪 Run tests
         run: go test -race ./...
 
   lint:
     name: Lint (Go)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: 📥 Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - name: 🐹 Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.mod
 
-      - name: Lint
-        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
+      - name: 🧹 Lint
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: latest
+          version: v2.15.0
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
@@ -1,4 +1,4 @@
-name: Deploy Documentation
+name: 📚 Deploy Documentation
 
 on:
   pull_request:
@@ -22,44 +22,44 @@ concurrency:
 
 jobs:
   build:
-    name: Build
-    runs-on: ubuntu-latest
+    name: 🏗️ Build
+    runs-on: ubuntu-24.04
     steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: 📥 Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - name: 🐍 Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.13"
 
-      - name: Install MkDocs Material
+      - name: 📦 Install MkDocs Material
         run: pip install --only-binary ':all:' --require-hashes -r docs/requirements.txt
 
-      - name: Build docs
+      - name: 🏗️ Build docs
         run: mkdocs build -f docs/mkdocs.yml
 
   deploy:
-    name: Deploy
+    name: 🚀 Deploy
     needs: build
     if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: 📥 Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - name: 🐍 Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.13"
 
-      - name: Install MkDocs Material
+      - name: 📦 Install MkDocs Material
         run: pip install --only-binary ':all:' --require-hashes -r docs/requirements.txt
 
-      - name: Build docs
+      - name: 🏗️ Build docs
         run: mkdocs build -f docs/mkdocs.yml
 
-      - name: Deploy via FTPS
+      - name: 🚀 Deploy via FTPS
         uses: SamKirkland/FTP-Deploy-Action@110f9186c050f71550953127052e77650219c287 # v4.4.0
         with:
           server: ${{ secrets.FTP_HOST }}

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -1,4 +1,4 @@
-name: Build and Push Docker Image
+name: 🐳 Build and Push Docker Image
 
 on:
   push:
@@ -20,27 +20,27 @@ on:
 
 jobs:
   security-scan:
-    name: Security Scan
-    runs-on: ubuntu-latest
+    name: 🛡️ Security Scan
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       security-events: write
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: 📥 Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Read version
+      - name: 🏷️ Read version
         id: version
         run: |
           VERSION=$(cat VERSION)
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+      - name: 🐳 Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
 
-      - name: Build image for security scan
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
+      - name: 🔨 Build image for security scan
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         env:
           DOCKER_BUILD_SUMMARY: false
           DOCKER_BUILD_RECORD_UPLOAD: false
@@ -49,11 +49,13 @@ jobs:
           platforms: linux/amd64
           load: true
           tags: fayrus/syncret:${{ steps.version.outputs.version }}
+          build-args: |
+            VERSION=${{ steps.version.outputs.version }}
           pull: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      - name: Scan image with Trivy
+      - name: 🛡️ Scan image with Trivy
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: fayrus/syncret:${{ steps.version.outputs.version }}
@@ -63,26 +65,26 @@ jobs:
           ignore-unfixed: true
           exit-code: ${{ github.event_name == 'workflow_dispatch' && inputs.allow_vulnerable_image && '0' || '1' }}
 
-      - name: Upload Trivy results to GitHub Security
+      - name: 📤 Upload Trivy results to GitHub Security
         if: always()
-        uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: trivy-results.sarif
 
   publish:
-    name: Publish
+    name: 📦 Publish
     needs: security-scan
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: 📥 Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Read version
+      - name: 🏷️ Read version
         id: version
         run: |
           VERSION=$(cat VERSION)
@@ -92,21 +94,21 @@ jobs:
             echo "minor=$(echo "$VERSION" | grep -oP 'v\d+\.\d+')"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
+      - name: 🖥️ Set up QEMU
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+      - name: 🐳 Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
 
-      - name: Log in to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+      - name: 🔑 Log in to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Extract metadata
+      - name: 🏷️ Extract metadata
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         with:
           images: fayrus/syncret
           tags: |
@@ -115,20 +117,22 @@ jobs:
             type=raw,value=${{ steps.version.outputs.minor }}
             type=raw,value=${{ steps.version.outputs.major }}
 
-      - name: Build and push
+      - name: 🚀 Build and push
         id: publish
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VERSION=${{ steps.version.outputs.version }}
           pull: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      - name: Create git tag
+      - name: 🔖 Create git tag
         id: git_tag
         run: |
           VERSION=$(cat VERSION)
@@ -142,7 +146,7 @@ jobs:
             echo "created=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Check if README changed
+      - name: 📝 Check if README changed
         id: readme
         run: |
           if git diff --name-only HEAD~1 HEAD | grep -q "^README.md$"; then
@@ -151,15 +155,15 @@ jobs:
             echo "changed=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Update Docker Hub description
+      - name: 📝 Update Docker Hub description
         if: steps.readme.outputs.changed == 'true'
         uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
           repository: fayrus/syncret
 
-      - name: Publish summary
+      - name: 📋 Publish summary
         if: always()
         run: |
           {

diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
@@ -1,4 +1,4 @@
-name: SonarCloud Analysis
+name: 📊 SonarCloud Analysis
 
 on:
   push:
@@ -25,30 +25,31 @@
 
 jobs:
   sonarcloud:
-    runs-on: ubuntu-latest
+    name: 📊 SonarCloud
+    runs-on: ubuntu-24.04
     steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: 📥 Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - name: 🐹 Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.mod
 
-      - name: Run tests with coverage
+      - name: 🧪 Run tests with coverage
         run: go test -covermode=atomic -coverprofile=coverage.out ./...
 
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0
+      - name: 📊 SonarCloud Scan
+        uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
           SONAR_HOST_URL: https://sonarcloud.io
 
-      - name: Check Quality Gate
-        uses: SonarSource/sonarqube-quality-gate-action@cf038b0e0cdecfa9e56c198bbb7d21d751d62c3b # v1.2.0
+      - name: 🚦 Check Quality Gate
+        uses: SonarSource/sonarqube-quality-gate-action@7a5fffe8e523c40e0c740b6bc2712ab503e52efa # v1.2.1
         timeout-minutes: 5
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.4] - 2026-10-18
+
+### Fixed
+
+- **Docs dependencies upgraded** in `docs/requirements.txt` — `urllib3` 2.8.0 resolves three Dependabot alerts (unbounded chunk-size buffering and ignored HTTPS proxy TLS configuration, both high; infinite loop in chunked deflate streaming, medium) and `mkdocs-material` 9.7.7 resolves a DOM XSS in search suggestions (medium). Docs-only dependencies; no runtime impact.
+- **Published images now report their real version** — the publish workflow passes `VERSION` as a Docker build arg; previously images were built with the default `dev`, so the startup log showed `version=dev`.
+- **`docker/setup-qemu-action` upgraded to v4.4.0** in the publish workflow — removes the spurious `Failed to save: Unable to reserve cache` warning caused by a minification bug in v4.1.0 ([docker/setup-qemu-action#306](https://github.com/docker/setup-qemu-action/issues/306)).
+
+### Changed
+
+- **GitHub Actions upgraded** (SHA-pinned) — `actions/checkout` v7.0.1, `actions/setup-go` v7, `actions/setup-python` v7, `docker/build-push-action` v7.4.0, `docker/login-action` v4.6.0, `docker/metadata-action` v6.2.0, `docker/setup-buildx-action` v4.4.1, `github/codeql-action/upload-sarif` v4.39.0, `golangci/golangci-lint-action` v9.3.0, `SonarSource/sonarqube-scan-action` v8.3.0, `SonarSource/sonarqube-quality-gate-action` v1.2.1.
+- **CI runners pinned to `ubuntu-24.04`** instead of `ubuntu-latest`, so runner image upgrades (e.g., Ubuntu 26.04) are adopted deliberately.
+- **golangci-lint pinned to v2.15.0** instead of `latest`, so new linter releases cannot break CI unexpectedly.
+- **Workflow, job, and step names refreshed with icons**; the `CI` workflow is now `🧪 PR Checks`. Jobs used as required status checks (`Lint (Actions)`, `Tests (Go)`, `Lint (Go)`) keep their names.
+
 ## [0.4.3] - 2026-10-18
 
 ### Fixed

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-v0.4.3
+v0.4.4