Fix deprecated actions: upload-artifact v3→v4, codeql-action v2→v3, dependency-review v3→v4; restrict Docker publish to main only

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/44b3da10-0967-404e-a999-f1e471d6aff9

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

.github/workflows/security.yml

@@ -47,7 +47,7 @@ jobs:
       continue-on-error: true
       
     - name: Upload Bandit Report
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       if: always()
       with:
         name: bandit-security-report
@@ -71,16 +71,16 @@ jobs:
       uses: actions/checkout@v4
       
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         queries: security-and-quality
         
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3
       
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
       with:
         category: "/language:${{matrix.language}}"
         
@@ -94,6 +94,6 @@ jobs:
       uses: actions/checkout@v4
       
     - name: Dependency Review
-      uses: actions/dependency-review-action@v3
+      uses: actions/dependency-review-action@v4
       with:
         fail-on-severity: moderate

.github/workflows/test.yml

@@ -91,7 +91,7 @@ jobs:
     name: Docker Build & Publish
     runs-on: ubuntu-latest
     needs: [test, lint]
-    if: github.event_name == 'push'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
       contents: read
       packages: write