fix(security): refresh client trust and adopt corrected upstream SearXNG (#6791)

Select the official immutable SearXNG release with corrected system and certifi stores in all Compose deployments. Retain native offline, actual-entrypoint and Compose/live regression checks while removing the custom trust-repair image and registry publication path. Reuse the canonical CA inventory checker.

Include released Python, certifi, grpcio, uv and Docker CLI trust updates and strict fourteen-chain validation. Keep unreleased CPython verifier and native-helper fixes separate from claims about shipped artifacts.

Part of #6784 and #6790.

Co-authored-by: Léo <leograndcontact@gmail.com>

.github/workflows/ci.yml

@@ -171,7 +171,7 @@ jobs:
       - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
         if: steps.docs-check.outputs.docs_only != 'true'
         with:
-          version: "0.13.4"
+          version: "0.13.5"
           enable-cache: true
           cache-dependency-glob: requirements.txt
           prune-cache: false

.github/workflows/searxng-image.yml

@@ -0,0 +1,79 @@
+name: ci / SearXNG trust
+
+on:
+  pull_request:
+    paths:
+      - 'docker/searxng/**'
+      - 'scripts/check_ca_trust.py'
+      - 'tests/fixtures/ca-trust/**'
+      - 'tests/test_searxng*'
+      - 'docker-compose*.yml'
+      - 'config/searxng/**'
+      - 'scripts/migrate_searxng_settings.py'
+      - '.github/scripts/*searxng*'
+      - '.github/searxng-validation.compose.yml'
+      - '.github/workflows/searxng-image.yml'
+  push:
+    branches: [dev, main]
+    paths:
+      - 'docker/searxng/**'
+      - 'scripts/check_ca_trust.py'
+      - 'tests/fixtures/ca-trust/**'
+      - 'docker-compose*.yml'
+      - 'config/searxng/**'
+      - 'scripts/migrate_searxng_settings.py'
+      - '.github/scripts/*searxng*'
+      - '.github/searxng-validation.compose.yml'
+      - '.github/workflows/searxng-image.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: searxng-image-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: SearXNG validate (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Select the immutable upstream image from Compose
+        id: image
+        run: |
+          docker compose --env-file /dev/null -f docker-compose.yml config --format json |
+            python3 -c 'import json, re, sys; image = json.load(sys.stdin)["services"]["searxng"]["image"]; re.fullmatch(r"docker\.io/searxng/searxng:[0-9]{4}\.[^@\s]+@sha256:[0-9a-f]{64}", image) or sys.exit("Invalid SearXNG pin"); print("image=" + image)' >> "$GITHUB_OUTPUT"
+      - name: Pull the upstream image without registry credentials
+        env:
+          SEARXNG_TEST_IMAGE: ${{ steps.image.outputs.image }}
+        run: docker pull "$SEARXNG_TEST_IMAGE"
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - name: Check unmodified upstream trust and actual entrypoint offline
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: docker/searxng/Dockerfile
+          target: validation
+          build-args: SEARXNG_IMAGE=${{ steps.image.outputs.image }}
+          network: none
+          platforms: ${{ matrix.platform }}
+          no-cache-filters: validation
+      - name: Validate the selected upstream runtime through Compose and live HTTPS
+        env:
+          SEARXNG_TEST_IMAGE: ${{ steps.image.outputs.image }}
+        run: bash .github/scripts/validate-searxng-image.sh "$SEARXNG_TEST_IMAGE"