chore: harden OpenSSF Scorecard from 4.3 to ~7.0 (#142)

mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00

Token-Permissions (0 -> 10): Set permissions: {} at workflow top level
across all 7 workflows, moved write scopes to per-job minimum.

SAST (0 -> 10): Added CodeQL workflow for JavaScript/TypeScript and
Python analysis on push, PR, and weekly schedule.

Vulnerabilities (0 -> ~8): Added 13 pnpm overrides to patch transitive
dependency vulnerabilities (38 -> 2 remaining, both in dev-only tools).

Pinned-Dependencies (5 -> 8-9): Pinned all Docker FROM images to SHA
digests, pinned pip-audit version in CI, pinned pip version in
Dockerfile.

This commit is contained in:

SnapOtter

2026-05-18 15:57:17 +08:00

committed by

GitHub

parent 697566d00e

commit ec6ff3d8a8

12 changed files with 443 additions and 768 deletions

									
										.github/workflows/deploy-landing.yml
									
		+3
		
												View File
												
				@@ -11,6 +11,9 @@ concurrency:

				  group: deploy-landing

				  cancel-in-progress: true

				permissions:

				  contents: read

				jobs:

				  deploy:

				    name: Deploy