ci(pip-audit): audit on Python 3.13 instead of ignoring filelock CVEs

The audit env ran Python 3.10, which can't install filelock 4.2+, so
every new filelock CVE in pip-audit's own CacheControl dependency broke
the job and had to be ignored by ID (11 more landed today). Audit on
3.13, which matches the bot's runtime on LXC 151 (Debian trixie), so
the fixed filelock installs and the per-CVE ignores can go. Also scan
discord-bridge/ for secrets.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

.gitea/workflows/lint.yml

@@ -82,28 +82,21 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - name: Install Python 3.10 and pip-audit
+      - name: Install Python 3.13 and pip-audit
         run: |
-          # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary
-          curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \
+          # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary.
+          # 3.13 matches the bot's runtime on LXC 151 (Debian trixie).
+          curl -sSL "https://github.com/astral-sh/python-build-standalone/releases/download/20250317/cpython-3.13.2+20250317-x86_64-unknown-linux-gnu-install_only.tar.gz" \
             | tar -xz -C /opt
           # Install bot deps + pip-audit into the same env; --local below avoids
           # pip-audit creating an internal venv (ensurepip fails on standalone builds)
           /opt/python/bin/pip install --upgrade pip setuptools
-          /opt/python/bin/pip install pip-audit -r matrixbot/requirements.txt
+          /opt/python/bin/pip install --upgrade pip-audit -r matrixbot/requirements.txt
 
       - name: Audit matrixbot dependencies
         # --local scans the env without spawning a venv (required for standalone Python)
         # CVE-2026-3219 is in pip itself, not our code — ignore it explicitly.
-        # The filelock CVEs (fixed in 4.2.1) are in pip-audit's own dependency
-        # (CacheControl[filecache]); the bot doesn't use filelock, and 4.2+
-        # needs Python 3.11, which this 3.10 audit env can't install.
-        run: >-
-          /opt/python/bin/pip-audit --local
-          --ignore-vuln CVE-2026-3219
-          --ignore-vuln CVE-2026-112906 --ignore-vuln CVE-2026-112907
-          --ignore-vuln CVE-2026-112913 --ignore-vuln CVE-2026-112914
-          --ignore-vuln CVE-2026-112937 --ignore-vuln CVE-2026-112940
+        run: /opt/python/bin/pip-audit --local --ignore-vuln CVE-2026-3219
 
   secret-scan:
     name: Secret scan (gitleaks)
@@ -124,7 +117,7 @@ jobs:
         run: |
           # Scan application code directories — deploy/ is excluded because
           # it contains intentional Gitea webhook HMAC secrets in hooks-lxc*.json
-          for dir in matrixbot/ hookshot/ .gitea/ systemd/ cinny/ landing/; do
+          for dir in matrixbot/ hookshot/ .gitea/ systemd/ cinny/ landing/ discord-bridge/; do
             [ -d "$dir" ] || continue
             gitleaks detect --source "$dir" --no-git --config .gitleaks.toml \
               --redact --exit-code 1