fix: CI/CD workflow improvements

- Mark current specification as complete and ready for the next task.
- Document completed work on CI/CD workflow fixes, including implementation summary and QA report links.
- Archive previous planning documents related to GitHub security warnings.
- Revise QA report to reflect the successful validation of CI workflow documentation updates, with zero high/critical issues found.
- Add new QA report for Grype SBOM remediation implementation, detailing security scans, validation results, and recommendations.

.github/workflows/docker-build.yml

@@ -1,5 +1,12 @@
 name: Docker Build, Publish & Test
 
+# This workflow replaced .github/workflows/docker-publish.yml (deleted in commit f640524b on Dec 21, 2025)
+# Enhancements over the previous workflow:
+# - SBOM generation and attestation for supply chain security
+# - CVE-2025-68156 verification for Caddy security patches
+# - Enhanced PR handling with dedicated scanning
+# - Improved workflow orchestration with supply-chain-verify.yml
+
 on:
   push:
     branches:

.github/workflows/security-weekly-rebuild.yml

@@ -1,5 +1,9 @@
 name: Weekly Security Rebuild
 
+# Note: This workflow filename has remained consistent. The related docker-publish.yml
+# was replaced by docker-build.yml in commit f640524b (Dec 21, 2025).
+# GitHub Advanced Security may show warnings about the old filename until its tracking updates.
+
 on:
   schedule:
     - cron: '0 2 * * 0' # Sundays at 02:00 UTC

.github/workflows/supply-chain-verify.yml

@@ -6,13 +6,15 @@ on:
 
   # Triggered after docker-build workflow completes
   # Note: workflow_run can only chain 3 levels deep; we're at level 2 (safe)
+  #
+  # IMPORTANT: No branches filter here by design
+  # GitHub Actions limitation: branches filter in workflow_run only matches the default branch.
+  # Without a filter, this workflow triggers for ALL branches where docker-build completes,
+  # providing proper supply chain verification coverage for feature branches and PRs.
+  # Security: The workflow file must exist on the branch to execute, preventing untrusted code.
   workflow_run:
     workflows: ["Docker Build, Publish & Test"]
     types: [completed]
-    branches:
-      - main
-      - development
-      - feature/beta-release
 
   schedule:
     # Run weekly on Mondays at 00:00 UTC