[StepSecurity] Apply security best practices

.github/workflows/dependency-review-reusable.yml

@@ -0,0 +1,60 @@
+name: Dependency Review
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    inputs:
+      config-file:
+        description: "Path to the dependency review configuration file"
+        required: false
+        type: string
+        default: "windlasstech/.github/.github/dependency-review-config.yml@main"
+      fail-on-severity:
+        description: "Minimum severity to fail the check (low, moderate, high, critical)"
+        required: false
+        type: string
+        default: ""
+      comment-summary-in-pr:
+        description: "Post summary comment to PR (always, on-failure, never)"
+        required: false
+        type: string
+        default: "on-failure"
+      warn-only:
+        description: "Report only, never fail"
+        required: false
+        type: boolean
+        default: false
+      external-repo-token:
+        description: "Token for accessing external repository config files"
+        required: false
+        type: string
+        default: ""
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # Required when comment-summary-in-pr is enabled
+      pull-requests: write
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          config-file: ${{ inputs.config-file }}
+          comment-summary-in-pr: ${{ inputs.comment-summary-in-pr }}
+          warn-only: ${{ inputs.warn-only }}
+          fail-on-severity: ${{ inputs.fail-on-severity }}
+          external-repo-token: ${{ inputs.external-repo-token }}

.github/workflows/lint-and-format.yml

@@ -0,0 +1,70 @@
+name: Repository Lint and Format
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    paths:
+      - "**/*.md"
+      - "**/*.mdx"
+      - "**/*.yml"
+      - "**/*.yaml"
+      - "**/*.json"
+      - "**/*.jsonc"
+      - ".github/workflows/lint-and-format.yml"
+      - ".markdownlint-cli2.jsonc"
+      - ".prettierignore"
+      - ".prettierrc"
+      - "bun.lock"
+      - "lefthook.yml"
+      - "package.json"
+  push:
+    branches: [main]
+    paths:
+      - "**/*.md"
+      - "**/*.mdx"
+      - "**/*.yml"
+      - "**/*.yaml"
+      - "**/*.json"
+      - "**/*.jsonc"
+      - ".github/workflows/lint-and-format.yml"
+      - ".markdownlint-cli2.jsonc"
+      - ".prettierignore"
+      - ".prettierrc"
+      - "bun.lock"
+      - "lefthook.yml"
+      - "package.json"
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Check formatting with Prettier
+        run: bun run format:check
+
+      - name: Lint Markdown with markdownlint
+        run: bun run lint:md
+
+      - name: Lint workflow files with actionlint
+        uses: windlasstech/actionlint-hardened-action@043a16f2538fe7bee89d8e19bbd5292e925210e0 # v1.0.0
+        with:
+          paths: |
+            .github/workflows/*.yml
+            .github/workflows/*.yaml

.github/workflows/osv-scanner-full-reusable.yml

@@ -0,0 +1,96 @@
+name: OSV Scanner Full
+
+on:
+  workflow_call:
+    inputs:
+      scan-args:
+        description: "Additional scan arguments, one per line. Do not set --format or --output."
+        required: false
+        type: string
+        default: |-
+          --recursive
+          ./
+      results-file-name:
+        description: "SARIF results file name"
+        required: false
+        type: string
+        default: "results.sarif"
+      download-artifact:
+        description: "Optional artifact name to download before scanning"
+        required: false
+        type: string
+        default: ""
+      ref:
+        description: "Optional branch, tag, or commit to scan"
+        required: false
+        type: string
+        default: ""
+      upload-sarif:
+        description: "Upload SARIF to code scanning when available for this repository"
+        required: false
+        type: boolean
+        default: true
+      fail-on-vuln:
+        description: "Fail when vulnerabilities are found"
+        required: false
+        type: boolean
+        default: true
+      checkout-submodules:
+        description: "Checkout git submodules"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  scan-full:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          submodules: ${{ inputs.checkout-submodules }}
+          ref: ${{ inputs.ref }}
+
+      - name: Download custom artifact if specified
+        if: ${{ inputs.download-artifact != '' }}
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.0
+        with:
+          name: ${{ inputs.download-artifact }}
+          path: ./
+
+      - name: Run scanner
+        uses: google/osv-scanner-action/osv-scanner-action@6e4298ebc4db23e847df9b2e2de2939d6f066c67 # v2.5.1
+        continue-on-error: true
+        with:
+          scan-args: |-
+            --output=results.json
+            --format=json
+            ${{ inputs.scan-args }}
+
+      - name: Build SARIF report
+        uses: google/osv-scanner-action/osv-reporter-action@6e4298ebc4db23e847df9b2e2de2939d6f066c67 # v2.5.1
+        with:
+          scan-args: |-
+            --output=${{ inputs.results-file-name }}
+            --new=results.json
+            --gh-annotations=false
+            --fail-on-vuln=${{ inputs.fail-on-vuln }}
+
+      - name: Upload SARIF to code scanning
+        if: ${{ inputs.upload-sarif }}
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        with:
+          sarif_file: ${{ inputs.results-file-name }}

.github/workflows/osv-scanner-pr-reusable.yml

@@ -0,0 +1,98 @@
+name: OSV Scanner PR
+
+on:
+  workflow_call:
+    inputs:
+      scan-args:
+        description: "Additional scan arguments, one per line. Do not set --format or --output."
+        required: false
+        type: string
+        default: |-
+          --recursive
+          ./
+      results-file-name:
+        description: "SARIF results file name"
+        required: false
+        type: string
+        default: "results.sarif"
+      upload-sarif:
+        description: "Upload SARIF to code scanning when available for this repository"
+        required: false
+        type: boolean
+        default: true
+      fail-on-vuln:
+        description: "Fail when the pull request introduces new vulnerabilities"
+        required: false
+        type: boolean
+        default: true
+      checkout-submodules:
+        description: "Checkout git submodules"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  scan-pr:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          submodules: ${{ inputs.checkout-submodules }}
+
+      - name: Checkout target branch
+        run: |
+          git checkout "$GITHUB_BASE_REF"
+          git submodule update --recursive
+
+      - name: Run scanner on base branch
+        uses: google/osv-scanner-action/osv-scanner-action@6e4298ebc4db23e847df9b2e2de2939d6f066c67 # v2.5.1
+        continue-on-error: true
+        with:
+          scan-args: |-
+            --format=json
+            --output=old-results.json
+            ${{ inputs.scan-args }}
+
+      - name: Checkout current branch
+        run: |
+          git checkout -f "$GITHUB_SHA"
+          git submodule update --recursive
+
+      - name: Run scanner on PR branch
+        uses: google/osv-scanner-action/osv-scanner-action@6e4298ebc4db23e847df9b2e2de2939d6f066c67 # v2.5.1
+        continue-on-error: true
+        with:
+          scan-args: |-
+            --format=json
+            --output=new-results.json
+            ${{ inputs.scan-args }}
+
+      - name: Build SARIF report
+        uses: google/osv-scanner-action/osv-reporter-action@6e4298ebc4db23e847df9b2e2de2939d6f066c67 # v2.5.1
+        with:
+          scan-args: |-
+            --output=${{ inputs.results-file-name }}
+            --old=old-results.json
+            --new=new-results.json
+            --gh-annotations=true
+            --fail-on-vuln=${{ inputs.fail-on-vuln }}
+
+      - name: Upload SARIF to code scanning
+        if: ${{ inputs.upload-sarif }}
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        with:
+          sarif_file: ${{ inputs.results-file-name }}

.github/workflows/osv-scanner-smoke.yml

@@ -0,0 +1,39 @@
+name: OSV Scanner Smoke
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/osv-scanner-*.yml"
+      - "README.md"
+      - "SECURITY.md"
+      - "bun.lock"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  pr-smoke:
+    if: github.event_name == 'pull_request'
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: ./.github/workflows/osv-scanner-pr-reusable.yml
+    with:
+      scan-args: |-
+        --lockfile=./bun.lock
+      upload-sarif: true
+
+  full-smoke:
+    if: github.event_name == 'workflow_dispatch'
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: ./.github/workflows/osv-scanner-full-reusable.yml
+    with:
+      scan-args: |-
+        --lockfile=./bun.lock
+      upload-sarif: true
+      fail-on-vuln: false