[StepSecurity] Apply security best practices

[stepsecurity-app]

Summary

This pull request has been generated by StepSecurity as part of your enterprise subscription to ensure compliance with recommended security best practices. Please review and merge the pull request to apply these security enhancements.

Security Fixes

Recommended GitHub Actions Workflows

These workflows are part of the organization's recommended set and were previously missing from this repository.

Feedback

For bug reports, feature requests, and general feedback; please create an issue in step-security/secure-repo or contact us via our website.

---

Summary by cubic

Adds six organization-recommended GitHub Actions workflows covering dependency review, vulnerability scanning, supply-chain scoring, and linting/formatting. All actions are pinned to commit SHAs and use step-security/harden-runner.

Security scans

• Dependency Review fails PRs introducing vulnerable dependencies per the shared config, with options to warn or comment instead.
• OSV Scanner checks bun.lock on PRs and on demand, uploads SARIF results to code scanning, and can fail on new vulnerabilities.
• Scorecard produces an OpenSSF supply-chain score, publishing results to the OpenSSF REST API and code scanning.

Lint check

• Lint and Format runs Prettier, markdownlint, and actionlint on PRs and pushes that touch docs, configs, workflow files, or the lockfile.

^{Written for commit 0e284be. Summary will update on new commits.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!