feat(git): Add security and workflow enhancements

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# All files require review and approval by the repository owner.
+* @Arc-E-Tect

.github/SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+| ------- | --------- |
+| Latest  | ✅        |
+
+## Reporting a Vulnerability
+
+Please **do not** report security vulnerabilities through public GitHub issues.
+
+Instead, use GitHub's private vulnerability reporting:
+[Report a vulnerability](https://github.com/Arc-E-Tect/SoftwareEngineeringDoneRight-Gradle/security/advisories/new)
+
+You can expect an initial response within **5 business days**.
+Once the issue is confirmed, a patch will be released as soon as possible, and you will be credited in the release notes unless you prefer to remain anonymous.
+
+## Security Practices
+
+- All dependencies are monitored for CVEs via Dependabot and a custom NVD-based security scan integrated into the CI/CD pipeline.
+- Secrets are never stored in the repository. All credentials are managed via GitHub Secrets and injected at runtime.
+- GitHub Actions workflows are pinned to commit SHAs to prevent supply-chain attacks.

.github/dependabot.yml

@@ -0,0 +1,28 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "github-actions"
+
+  - package-ecosystem: "gradle"
+    directory: "/sedr_utils/jacoco-exclusion-report"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "gradle"
+
+  - package-ecosystem: "npm"
+    directory: "/sedr_utils/jacoco-exclusion-report"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "npm"

.github/workflows/determine-release-type.yml

@@ -15,7 +15,7 @@ jobs:
       release_type: ${{ steps.get-type.outputs.release_type }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 

.github/workflows/jacoco-exclusion-report-build.yml

@@ -39,19 +39,19 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           distribution: 'temurin'
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
 
       - name: Update version in Gradle property file
         run: |

.github/workflows/jacoco-exclusion-report-release.yml

@@ -47,19 +47,19 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           distribution: 'temurin'
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
 
       - name: Update version in Gradle property file
         run: |
@@ -81,7 +81,7 @@ jobs:
 
       - name: Upload test report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: jacoco-exclusion-report-plugin-test-results
           path: sedr_utils/jacoco-exclusion-report/build/reports/tests/**
@@ -109,19 +109,19 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           ref: ${{ github.ref_name }}
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           distribution: 'temurin'
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
 
       - name: Update version in Gradle property file
         run: |

.github/workflows/security-scan.yml

@@ -61,19 +61,19 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           distribution: 'temurin'
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
 
       - name: Update version in Gradle property file
         run: |
@@ -84,7 +84,7 @@ jobs:
           cat ${{ env.GRADLE_PROPERTIES_FILE }}
 
       - name: Cache NVD Database
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: ~/.gradle/dependency-check-data
           key: ${{ runner.os }}-dependency-check-${{ hashFiles('**/*.gradle*', '**/gradle.properties') }}
@@ -107,7 +107,7 @@ jobs:
           FAIL_ON_FATAL: ${{ inputs.fail_on_fatal }}
 
       - name: Upload Vulnerability Test Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: ${{ env.PROJECT_NAME}}-reports-vulnerability
           path: ${{ env.REPORTS_DIR }}/dependency-check-report.html

.github/workflows/semantic-version-apply.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           ref: ${{ github.ref_name }}
@@ -40,7 +40,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.sem_rel_token_token }}
 
       - name: cache NPM
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         id: npm-cache
         with:
           path: |
@@ -50,7 +50,7 @@ jobs:
             ${{ runner.os }}-node-
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: "lts/*"
 

.github/workflows/semantic-version-calculate.yml

@@ -38,14 +38,14 @@ jobs:
       next_version: ${{ steps.calculate_semantic_version.outputs.next_version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           ref: ${{ github.ref_name }}
           persist-credentials: false
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: "lts/*"