2 Commits

Include renames

Author	SHA1	Message	Date
Martin Vogel	0b81154813	ci: bump the CodeQL actions to v4.39.0 together and group their Dependabot updates ... Dependabot opened one PR per CodeQL action (#2504 init, #2505 analyze, #2506 upload-sarif), each moving to 4.38.2. Merging them one at a time would leave init and analyze on different versions in between. This moves all three to v4.39.0 (6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee, the commit the v4.39.0 tag points to) in one change, and adds a Dependabot group so future CodeQL Action updates arrive as a single PR. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>	2026-10-21 00:34:05 +02:00
Martin Vogel	dd30132e2d	Pin Actions to SHA + enforce via security audit + Dependabot ... - All GitHub Actions pinned to immutable commit SHAs (prevents tag-poisoning attacks like tj-actions/changed-files incident) - Security audit (Layer 1) now blocks unpinned Actions in CI - Dependabot configured to auto-propose SHA updates weekly - Pre-commit hooks tracked in scripts/hooks/ for contributors - Time-bomb detection + MCP file read audit added to Layer 1	2026-03-21 16:57:17 +01:00