fix(ci): allow the pinned security scanner containers

Carry the verified starter bootstrap correction into the Windows application. Keep the selected-actions policy and required security checks while allowing only the two published scanner digests.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <jmaes@dmdbrands.com>

build/GitHubRepository.Tests.ps1

@@ -47,6 +47,21 @@ Describe 'Required checks match standalone workflow jobs' `
 
 Describe 'Generated repository administration' `
 {
+   It 'allows the digest-pinned security containers without permitting arbitrary container actions' `
+   {
+      $plan = Get-GitHubRepositoryPlan -Repository 'Example/Notes'
+      $policy = ($plan.Requests | Where-Object Path -Like '*/actions/permissions/selected-actions').Body
+      $policy.patterns_allowed.Count | Should -Be 3
+      $policy.patterns_allowed | Should -Contain 'KofTwentyTwo/standards/*@*'
+      $containers = @($policy.patterns_allowed | Where-Object { $_.StartsWith('docker://', [StringComparison]::Ordinal) })
+      $containers.Count | Should -Be 2
+      foreach($container in $containers)
+      {
+         $container | Should -Match '^docker://ghcr\.io/(gitleaks/gitleaks:v8\.30\.1|aquasecurity/trivy:0\.75\.0)@sha256:[0-9a-f]{64}$'
+         $container | Should -Not -Match '\*'
+      }
+   }
+
    InModuleScope GitHubRepository `
    {
       BeforeEach `

build/GitHubRepository.psm1

@@ -74,7 +74,14 @@ function Get-GitHubRepositoryPlan
       @{ Method = 'PUT'; Path = "$root/actions/permissions/workflow"; Body = @{ default_workflow_permissions = 'read'; can_approve_pull_request_reviews = $false } },
       @{ Method = 'PUT'; Path = "$root/actions/permissions/fork-pr-contributor-approval"; Body = @{ approval_policy = 'all_external_contributors' } },
       @{ Method = 'PUT'; Path = "$root/actions/permissions"; Body = @{ enabled = $true; allowed_actions = 'selected' } },
-      @{ Method = 'PUT'; Path = "$root/actions/permissions/selected-actions"; Body = @{ github_owned_allowed = $true; verified_allowed = $true; patterns_allowed = @('KofTwentyTwo/standards/*@*') } },
+      @{ Method = 'PUT'; Path = "$root/actions/permissions/selected-actions"; Body = @{
+            github_owned_allowed = $true; verified_allowed = $true
+            # Exact container actions used by the published v0.1.2 security builder.
+            patterns_allowed = @('KofTwentyTwo/standards/*@*',
+               'docker://ghcr.io/gitleaks/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f',
+               'docker://ghcr.io/aquasecurity/trivy:0.75.0@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa')
+         }
+      },
       @{ Method = 'PUT'; Path = "$root/environments/release"; Body = @{ deployment_branch_policy = @{ protected_branches = $false; custom_branch_policies = $true } } },
       @{ Method = 'POST'; Path = "$root/environments/release/deployment-branch-policies"; Body = @{ name = 'v*'; type = 'tag' } },
       @{ Method = 'POST'; Path = "$root/rulesets"; Body = $main },

docs/repository-setup.md

@@ -9,7 +9,7 @@ hooks, and run [CONTRIBUTING.md](../CONTRIBUTING.md)'s checks. Node 24 and Power
 The default command works offline and writes thirteen non-secret API requests:
 
 ```powershell
-./build/Initialize-GitHubRepository.ps1 -Repository KofTwentyTwo/MarkdownViewr.Windows
+./build/Initialize-GitHubRepository.ps1 -Repository KofTwentyTwo/windows-app-template
 Get-Content artifacts/repository-setup.json
 ```
 
@@ -66,6 +66,12 @@ and environment protections are retained. API failures stop immediately; earlier
 successful requests may remain, so validate and resolve the reported failure before
 rerunning. The tool never creates repositories, pushes, merges, tags or releases.
 
+The selected Actions policy permits the shared standards workflows, GitHub-owned
+and verified actions, and the exact digest-pinned Gitleaks/Trivy container actions
+used by the published security builder. GitHub also checks container actions
+against this policy; missing entries prevent the security workflow from starting.
+Review these exact references whenever the shared builder pin changes.
+
 ## Finish and verify
 
 Register ownership/tier in the standards `MAINTAINERS.md` inventory through a