- Add top-level on caller (ci.yml) and scheduled/event
workflows (inactive_issues.yml, needs_contributor.yml)
- Declare explicit job-level permissions across all reusable workflows
- Pin all third-party actions to immutable commit SHAs (was using mutable
tags, including the critical )
- Align codeql-action on v3 across quality.yml and cyber.yml
- Add timeout-minutes on every job to prevent runaway builds
- Add concurrency group on ci.yml with cancel-in-progress for PRs only
- Add .github/dependabot.yml for automated SHA and npm dependency updates
