ci(secruity): hardening + lock files + dependabot cooldown - #48

Merged

Frando merged 9 commits into

mainfrom

Sep 13, 2026

Commits on Sep 11, 2026

ci(security): add dependabot config
Arqu
committed
e8f96bb
ci(security): deny yanked crates
Arqu
committed
21730ff
ci(security): pin actions to commit SHAs
Arqu
committed
982d7e4
ci(security): default workflow permissions to read-only
Arqu
committed
412a37f
ci(security): don't persist credentials in checkouts
Arqu
committed
472c3fe
ci(security): publish the rolling release with gh, not a third-party action
Arqu
committed
c79715e
ci(security): build from the lockfile
Arqu
committed
9e0044e
ci(security): pass untrusted values through env, not templates
Arqu
committed
cc71b8f
ci(security): lint workflows with zizmor and pinact
Arqu
committed
796f2d3