Security posture

• R-SEC-01: Pin every external action and reusable workflow to a full commit SHA · oss-harden
• R-SEC-02: Workflows declare least-privilege permissions · oss-harden
• R-SEC-03: Automated dependency updates cover both application dependencies and CI dependencies · oss-harden
• R-SEC-04: The default branch requires review and passing checks before merge, and rejects force pushes · oss-harden
• R-SEC-05: Release tags are signed and verifiable · oss-harden
• R-SEC-06: A GitLab pipeline pins external execution inputs and restricts inbound job-token access · oss-harden
• R-SEC-07: Untrusted input never reaches a privileged context · oss-harden
• R-SEC-08: Registry dependencies resolve through a committed lockfile · oss-harden
• R-SEC-09: Static analysis runs on pull requests where the language supports it · oss-harden