Martin Vogel dd30132e2d Pin Actions to SHA + enforce via security audit + Dependabot ...

- All GitHub Actions pinned to immutable commit SHAs (prevents
  tag-poisoning attacks like tj-actions/changed-files incident)
- Security audit (Layer 1) now blocks unpinned Actions in CI
- Dependabot configured to auto-propose SHA updates weekly
- Pre-commit hooks tracked in scripts/hooks/ for contributors
- Time-bomb detection + MCP file read audit added to Layer 1

2026-03-21 16:57:17 +01:00

..

workflows

Pin Actions to SHA + enforce via security audit + Dependabot

2026-03-21 16:57:17 +01:00

dependabot.yml

Pin Actions to SHA + enforce via security audit + Dependabot

2026-03-21 16:57:17 +01:00