ci: supply-chain hardening (PR 1/2) — Node 24, harden-runner, Dependabot cooldown, CodeQL - #42

Merged

Nelson Spence (Fieldnote-Echo) merged 6 commits into

mainfrom

chore/supply-chain-ci-hardening

May 25, 2026

Commits on May 25, 2026

ci: bump actions to Node 24 + add harden-runner across workflows
Nelson Spence (Fieldnote-Echo)
committed
a76cb89
ci: add Dependabot version updates with a 7-day cooldown
Nelson Spence (Fieldnote-Echo)
committed
b6c73ca
ci: add CodeQL code scanning for Rust, Python, and Actions
Nelson Spence (Fieldnote-Echo)
committed
6654601
ci: bump codeql-action v3 (node20) -> v4 (node24)
Nelson Spence (Fieldnote-Echo)
committed
350b319
ci: skip CodeQL on fork PRs (read-only token can't upload SARIF) (#42 review)
Nelson Spence (Fieldnote-Echo)
committed
4a73aa3
Merge branch 'main' into chore/supply-chain-ci-hardening
Nelson Spence (Fieldnote-Echo)
authored
7027d5e