Before broad adoption, add baseline supply-chain security: - [ ] `.github/dependabot.yml` for npm, maven, github-actions and docker - [ ] **CodeQL** workflow (Java + JS/TS) on push/PR + weekly schedule - [ ] Pin third-party GitHub Actions to commit SHAs - [ ] Enable secret scanning + push protection (repo setting)
Before broad adoption, add baseline supply-chain security:
.github/dependabot.ymlfor npm, maven, github-actions and docker