[DEP-12] Deploy step does not pin trunk version (cargo install trunk --locked) #319

Audit finding from #300 (commit 679f9fe)

Severity: low
Category: dependencies / supply chain / CI
File: .github/workflows/deploy.yml:39
Obvious fix: yes

Description

The deploy workflow runs cargo install trunk --locked without a version pin, so each deploy fetches whatever trunk is latest on crates.io. A malicious or buggy trunk release would be picked up automatically and used to build the production WASM bundle that is then scped to the live server. Combined with #227 (sshpass + StrictHostKeyChecking=no) this is the supply-chain weak link from CI to prod.

Impact / Threat

A compromised trunk release reaches production unattended; build outputs are non-reproducible across re-runs of the same commit.

Suggested fix

Pin to a specific version, e.g. cargo install trunk --version 0.21.0 --locked, or use taiki-e/install-action (already used in e2e.yml at a pinned SHA) to install trunk by tagged release.

Verify

grep -n 'cargo install trunk' .github/workflows/deploy.yml