chore: configure free repository security automation

.github/dependabot.yml

@@ -0,0 +1,75 @@
+version: 2
+updates:
+- package-ecosystem: bundler
+  directory: /
+  schedule:
+    interval: weekly
+    day: monday
+    time: '10:00'
+    timezone: Asia/Tokyo
+  open-pull-requests-limit: 3
+  groups:
+    routine-updates:
+      patterns:
+      - '*'
+      update-types:
+      - minor
+      - patch
+    security-updates:
+      applies-to: security-updates
+      patterns:
+      - '*'
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly
+    day: monday
+    time: '10:00'
+    timezone: Asia/Tokyo
+  open-pull-requests-limit: 3
+  groups:
+    routine-updates:
+      patterns:
+      - '*'
+      update-types:
+      - minor
+      - patch
+    security-updates:
+      applies-to: security-updates
+      patterns:
+      - '*'
+- package-ecosystem: gitsubmodule
+  directory: /
+  schedule:
+    interval: weekly
+    day: monday
+    time: '10:00'
+    timezone: Asia/Tokyo
+  open-pull-requests-limit: 3
+  groups:
+    routine-updates:
+      patterns:
+      - '*'
+    security-updates:
+      applies-to: security-updates
+      patterns:
+      - '*'
+- package-ecosystem: nuget
+  directory: /wrappers/csharp/LibPLATEAU.NET/CSharpPLATEAU.Test
+  schedule:
+    interval: weekly
+    day: monday
+    time: '10:00'
+    timezone: Asia/Tokyo
+  open-pull-requests-limit: 3
+  groups:
+    routine-updates:
+      patterns:
+      - '*'
+      update-types:
+      - minor
+      - patch
+    security-updates:
+      applies-to: security-updates
+      patterns:
+      - '*'

.github/workflows/check-submodule-license.yml

@@ -33,5 +33,19 @@ jobs:
       with:
         version: '4.x'
 
+    # licensed が other と判定する json は、確認済みコミットと MIT 本文を固定して照合します。
+    # submodule を更新した場合は、ライセンス本文を再確認して両方の値を更新してください。
+    - name: Verify reviewed JSON license
+      shell: bash
+      run: |
+        set -euo pipefail
+        expected_commit=a3e6e26dc83a726b292f5be0492fcc408663ce55
+        actual_commit=$(git -C 3rdparty/json rev-parse HEAD)
+        if [ "$actual_commit" != "$expected_commit" ]; then
+          echo "::error::JSON submodule changed; review its license before updating the approved commit."
+          exit 1
+        fi
+        echo '86b998c792894ccb911a1cb7994f7a9652894e7a094c0b5e45be2f553f45cf14  3rdparty/json/LICENSE.MIT' | sha256sum --check --strict
+
     - run: licensed cache
     - run: licensed status

.github/workflows/dependency-review.yml

@@ -0,0 +1,23 @@
+name: Dependency review
+'on':
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+permissions:
+  contents: read
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository configuration
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      with:
+        persist-credentials: false
+        sparse-checkout: .github
+    - name: Review dependency changes
+      uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294
+      with:
+        fail-on-severity: high
+        fail-on-scopes: runtime, development, unknown

.github/workflows/upload-dlls-older-visual-studio.yml

@@ -81,6 +81,12 @@ jobs:
     runs-on: ubuntu-latest
     needs: [upload-dlls, upload_mobile_dlls]
 
+    permissions:
+      contents: read
+      actions: read
+      id-token: write
+      attestations: write
+
     steps:
       - name: download-all-artifacts
         uses: actions/download-artifact@v4
@@ -114,6 +120,14 @@ jobs:
           cp ~/a/libplateau-macos-14-x86_64/*.a ~/a/plateau-plugins/static-libs/macos/x86_64
           cp ~/a/libplateau-macos-14-arm64/*.a ~/a/plateau-plugins/static-libs/macos/arm64
 
+      - name: Locate the attestation subjects
+        run: echo "ATTEST_SUBJECT_DIR=$HOME/a/plateau-plugins" >> "$GITHUB_ENV"
+
+      - name: Attest the compiled libraries
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: "${{ env.ATTEST_SUBJECT_DIR }}/**/*"
+
       - name: upload artifact
         uses: actions/upload-artifact@v4
         with:

.github/workflows/upload-dlls.yml

@@ -84,6 +84,12 @@ jobs:
     runs-on: ubuntu-latest
     needs: [upload-dlls, upload_mobile_dlls]
 
+    permissions:
+      contents: read
+      actions: read
+      id-token: write
+      attestations: write
+
     steps:
       - name: download-all-artifacts
         uses: actions/download-artifact@v4
@@ -118,6 +124,14 @@ jobs:
           cp ~/a/libplateau-macos-14-x86_64/*.a ~/a/plateau-plugins/static-libs/macos/x86_64
           cp ~/a/libplateau-macos-14-arm64/*.a ~/a/plateau-plugins/static-libs/macos/arm64
 
+      - name: Locate the attestation subjects
+        run: echo "ATTEST_SUBJECT_DIR=$HOME/a/plateau-plugins" >> "$GITHUB_ENV"
+
+      - name: Attest the compiled libraries
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: "${{ env.ATTEST_SUBJECT_DIR }}/**/*"
+
       - name: upload artifact
         uses: actions/upload-artifact@v4
         with:

.licensed.yml

@@ -9,6 +9,7 @@ allowed:
 
 reviewed:
   git_submodule:
+    - json # MIT。CI で確認済みコミット・ライセンス本文のハッシュを照合
     - libxml2 # MITライセンスなのでOK
     - openssl-cmake # 再配布可能、要著作権表示
     - pybind11 # BSD-3ライセンスなのでOK

SECURITY.md

@@ -0,0 +1,7 @@
+# セキュリティ上の問題の報告
+
+脆弱性や認証情報の漏えいが疑われる場合は、公開のIssueやPRに詳細・秘密情報を書き込まず、
+このリポジトリの **Security → Advisories → Report a vulnerability** から非公開で報告してください。
+
+再現手順、影響するバージョン、影響範囲を、秘密情報の値を含めずに記載してください。
+対応時期やサポート対象についての個別の約束は、この文書では定めません。